From 89d915493fb83c5e0abe8db0fc1800bedc5be42b Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Fri, 27 Mar 2026 01:55:16 -0300
Subject: [PATCH 01/64] Fix NPE on external/unmanaged instance import using
 custom offerings (#12884)

* Fix NPE on external/unmanaged instance import using custom offerings
---
 .../vm/UnmanagedVMsManagerImpl.java           | 254 ++++++++++++------
 .../vm/UnmanagedVMsManagerImplTest.java       | 118 +++++++-
 2 files changed, 280 insertions(+), 92 deletions(-)

diff --git a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
index 75f879315917..18ba2d171798 100644
--- a/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImpl.java
@@ -1387,10 +1387,7 @@ private UserVmResponse baseImportInstance(ImportUnmanagedInstanceCmd cmd) {
         List<String> managedVms = new ArrayList<>(additionalNameFilters);
         managedVms.addAll(getHostsManagedVms(hosts));
 
-        List<String> resourceLimitHostTags = resourceLimitService.getResourceLimitHostTags(serviceOffering, template);
-        try (CheckedReservation vmReservation = new CheckedReservation(owner, Resource.ResourceType.user_vm, resourceLimitHostTags, 1L, reservationDao, resourceLimitService);
-             CheckedReservation cpuReservation = new CheckedReservation(owner, Resource.ResourceType.cpu, resourceLimitHostTags, Long.valueOf(serviceOffering.getCpu()), reservationDao, resourceLimitService);
-             CheckedReservation memReservation = new CheckedReservation(owner, Resource.ResourceType.memory, resourceLimitHostTags, Long.valueOf(serviceOffering.getRamSize()), reservationDao, resourceLimitService)) {
+        try {
 
             ActionEventUtils.onStartedActionEvent(userId, owner.getId(), EventTypes.EVENT_VM_IMPORT,
                     cmd.getEventDescription(), null, null, true, 0);
@@ -1560,7 +1557,7 @@ private UserVm importUnmanagedInstanceFromHypervisor(DataCenter zone, Cluster cl
                                                          String hostName, Account caller, Account owner, long userId,
                                                          ServiceOfferingVO serviceOffering, Map<String, Long> dataDiskOfferingMap,
                                                          Map<String, Long> nicNetworkMap, Map<String, Network.IpAddresses> nicIpAddressMap,
-                                                         Map<String, String> details, Boolean migrateAllowed, List<String> managedVms, boolean forced) {
+                                                         Map<String, String> details, Boolean migrateAllowed, List<String> managedVms, boolean forced) throws ResourceAllocationException {
         UserVm userVm = null;
         for (HostVO host : hosts) {
             HashMap<String, UnmanagedInstanceTO> unmanagedInstances = getUnmanagedInstancesForHost(host, instanceName, managedVms);
@@ -1604,11 +1601,18 @@ private UserVm importUnmanagedInstanceFromHypervisor(DataCenter zone, Cluster cl
 
                     template.setGuestOSId(guestOSHypervisor.getGuestOsId());
                 }
-                userVm = importVirtualMachineInternal(unmanagedInstance, instanceName, zone, cluster, host,
-                        template, displayName, hostName, CallContext.current().getCallingAccount(), owner, userId,
-                        serviceOffering, dataDiskOfferingMap,
-                        nicNetworkMap, nicIpAddressMap,
-                        details, migrateAllowed, forced, true);
+
+                List<Reserver> reservations = new ArrayList<>();
+                try {
+                    checkVmResourceLimitsForUnmanagedInstanceImport(owner, unmanagedInstance, serviceOffering, template, reservations);
+                    userVm = importVirtualMachineInternal(unmanagedInstance, instanceName, zone, cluster, host,
+                            template, displayName, hostName, CallContext.current().getCallingAccount(), owner, userId,
+                            serviceOffering, dataDiskOfferingMap,
+                            nicNetworkMap, nicIpAddressMap,
+                            details, migrateAllowed, forced, true);
+                } finally {
+                    ReservationHelper.closeAll(reservations);
+                }
                 break;
             }
             if (userVm != null) {
@@ -1618,6 +1622,36 @@ private UserVm importUnmanagedInstanceFromHypervisor(DataCenter zone, Cluster cl
         return userVm;
     }
 
+    protected void checkVmResourceLimitsForUnmanagedInstanceImport(Account owner, UnmanagedInstanceTO unmanagedInstance, ServiceOfferingVO serviceOffering, VMTemplateVO template, List<Reserver> reservations) throws ResourceAllocationException {
+        // When importing an unmanaged instance, the amount of CPUs and memory is obtained from the hypervisor unless powered off
+        // and not using a dynamic offering, unlike the external VM import that always obtains it from the compute offering
+        Integer cpu = serviceOffering.getCpu();
+        Integer memory = serviceOffering.getRamSize();
+
+        if (serviceOffering.isDynamic() || !UnmanagedInstanceTO.PowerState.PowerOff.equals(unmanagedInstance.getPowerState())) {
+            cpu = unmanagedInstance.getCpuCores();
+            memory = unmanagedInstance.getMemory();
+        }
+
+        if (cpu == null || cpu == 0) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("CPU cores [%s] is not valid for importing VM [%s].", cpu, unmanagedInstance.getName()));
+        }
+        if (memory == null || memory == 0) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Memory [%s] is not valid for importing VM [%s].", memory, unmanagedInstance.getName()));
+        }
+
+        List<String> resourceLimitHostTags = resourceLimitService.getResourceLimitHostTags(serviceOffering, template);
+
+        CheckedReservation vmReservation = new CheckedReservation(owner, Resource.ResourceType.user_vm, resourceLimitHostTags, 1L, reservationDao, resourceLimitService);
+        reservations.add(vmReservation);
+
+        CheckedReservation cpuReservation = new CheckedReservation(owner, Resource.ResourceType.cpu, resourceLimitHostTags, cpu.longValue(), reservationDao, resourceLimitService);
+        reservations.add(cpuReservation);
+
+        CheckedReservation memReservation = new CheckedReservation(owner, Resource.ResourceType.memory, resourceLimitHostTags, memory.longValue(), reservationDao, resourceLimitService);
+        reservations.add(memReservation);
+    }
+
     private Pair<UnmanagedInstanceTO, Boolean> getSourceVmwareUnmanagedInstance(String vcenter, String datacenterName, String username,
                                                                                 String password, String clusterName, String sourceHostName,
                                                                                 String sourceVM, ServiceOfferingVO serviceOffering) {
@@ -1674,7 +1708,7 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
                                                           Account caller, Account owner, long userId,
                                                           ServiceOfferingVO serviceOffering, Map<String, Long> dataDiskOfferingMap,
                                                           Map<String, Long> nicNetworkMap, Map<String, Network.IpAddresses> nicIpAddressMap,
-                                                          Map<String, String> details, ImportVmCmd cmd, boolean forced) {
+                                                          Map<String, String> details, ImportVmCmd cmd, boolean forced) throws ResourceAllocationException {
         Long existingVcenterId = cmd.getExistingVcenterId();
         String vcenter = cmd.getVcenter();
         String datacenterName = cmd.getDatacenterName();
@@ -1719,6 +1753,8 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
         DataStoreTO temporaryConvertLocation = null;
         String ovfTemplateOnConvertLocation = null;
         ImportVmTask importVMTask = null;
+        List<Reserver> reservations = new ArrayList<>();
+
         try {
             HostVO convertHost = selectKVMHostForConversionInCluster(destinationCluster, convertInstanceHostId);
             HostVO importHost = selectKVMHostForImportingInCluster(destinationCluster, importInstanceHostId);
@@ -1741,6 +1777,10 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
             Pair<UnmanagedInstanceTO, Boolean> sourceInstanceDetails = getSourceVmwareUnmanagedInstance(vcenter, datacenterName, username, password, clusterName, sourceHostName, sourceVMName, serviceOffering);
             sourceVMwareInstance = sourceInstanceDetails.first();
             isClonedInstance = sourceInstanceDetails.second();
+
+            // Ensure that the configured resource limits will not be exceeded before beginning the conversion process
+            checkVmResourceLimitsForUnmanagedInstanceImport(owner, sourceVMwareInstance, serviceOffering, template, reservations);
+
             boolean isWindowsVm = sourceVMwareInstance.getOperatingSystem().toLowerCase().contains("windows");
             if (isWindowsVm) {
                 checkConversionSupportOnHost(convertHost, sourceVMName, true);
@@ -1793,6 +1833,7 @@ protected UserVm importUnmanagedInstanceFromVmwareToKvm(DataCenter zone, Cluster
             if (temporaryConvertLocation != null  && StringUtils.isNotBlank(ovfTemplateOnConvertLocation)) {
                 removeTemplate(temporaryConvertLocation, ovfTemplateOnConvertLocation);
             }
+            ReservationHelper.closeAll(reservations);
         }
     }
 
@@ -2581,10 +2622,7 @@ private UserVmResponse importKvmInstance(ImportVmCmd cmd) {
 
         UserVm userVm = null;
 
-        List<String> resourceLimitHostTags = resourceLimitService.getResourceLimitHostTags(serviceOffering, template);
-        try (CheckedReservation vmReservation = new CheckedReservation(owner, Resource.ResourceType.user_vm, resourceLimitHostTags, 1L, reservationDao, resourceLimitService);
-             CheckedReservation cpuReservation = new CheckedReservation(owner, Resource.ResourceType.cpu, resourceLimitHostTags, Long.valueOf(serviceOffering.getCpu()), reservationDao, resourceLimitService);
-             CheckedReservation memReservation = new CheckedReservation(owner, Resource.ResourceType.memory, resourceLimitHostTags, Long.valueOf(serviceOffering.getRamSize()), reservationDao, resourceLimitService)) {
+        try {
 
             if (ImportSource.EXTERNAL == importSource) {
                 String username = cmd.getUsername();
@@ -2647,6 +2685,7 @@ private UserVm importExternalKvmVirtualMachine(final UnmanagedInstanceTO unmanag
 
         List<Reserver> reservations = new ArrayList<>();
         try {
+            checkVmResourceLimitsForExternalKvmVmImport(owner, serviceOffering, (VMTemplateVO) template, details, reservations);
             checkVolumeResourceLimitsForExternalKvmVmImport(owner, rootDisk, dataDisks, diskOffering, dataDiskOfferingMap, reservations);
 
             // Check NICs and supplied networks
@@ -2811,98 +2850,135 @@ private UserVm importKvmVirtualMachineFromDisk(final ImportSource importSource,
         profiles.add(nicProfile);
         networkNicMap.put(network.getUuid(), profiles);
 
+        List<Reserver> reservations = new ArrayList<>();
         try {
+            checkVmResourceLimitsForExternalKvmVmImport(owner, serviceOffering, (VMTemplateVO) template, details, reservations);
             userVm = userVmManager.importVM(zone, null, template, null, displayName, owner,
                     null, caller, true, null, owner.getAccountId(), userId,
                     serviceOffering, null, hostName,
                     Hypervisor.HypervisorType.KVM, allDetails, powerState, networkNicMap);
-        } catch (InsufficientCapacityException ice) {
-            logger.error(String.format("Failed to import vm name: %s", instanceName), ice);
-            throw new ServerApiException(ApiErrorCode.INSUFFICIENT_CAPACITY_ERROR, ice.getMessage());
-        }
-        if (userVm == null) {
-            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Failed to import vm name: %s", instanceName));
-        }
 
-        DiskOfferingVO diskOffering = diskOfferingDao.findById(serviceOffering.getDiskOfferingId());
+            if (userVm == null) {
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Failed to import vm name: %s", instanceName));
+            }
 
-        List<Reserver> reservations = new ArrayList<>();
-        List<String> resourceLimitStorageTags = resourceLimitService.getResourceLimitStorageTagsForResourceCountOperation(true, diskOffering);
-        try {
-        CheckedReservation volumeReservation = new CheckedReservation(owner, Resource.ResourceType.volume, resourceLimitStorageTags,
+            DiskOfferingVO diskOffering = diskOfferingDao.findById(serviceOffering.getDiskOfferingId());
+            List<String> resourceLimitStorageTags = resourceLimitService.getResourceLimitStorageTagsForResourceCountOperation(true, diskOffering);
+            CheckedReservation volumeReservation = new CheckedReservation(owner, Resource.ResourceType.volume, resourceLimitStorageTags,
                     CollectionUtils.isNotEmpty(resourceLimitStorageTags) ? 1L : 0L, reservationDao, resourceLimitService);
-        reservations.add(volumeReservation);
+            reservations.add(volumeReservation);
 
-        String rootVolumeName = String.format("ROOT-%s", userVm.getId());
-        DiskProfile diskProfile = volumeManager.allocateRawVolume(Volume.Type.ROOT, rootVolumeName, diskOffering, null, null, null, userVm, template, owner, null, false);
+            String rootVolumeName = String.format("ROOT-%s", userVm.getId());
+            DiskProfile diskProfile = volumeManager.allocateRawVolume(Volume.Type.ROOT, rootVolumeName, diskOffering, null, null, null, userVm, template, owner, null, false);
 
-        final VirtualMachineProfile profile = new VirtualMachineProfileImpl(userVm, template, serviceOffering, owner, null);
-        ServiceOfferingVO dummyOffering = serviceOfferingDao.findById(userVm.getId(), serviceOffering.getId());
-        profile.setServiceOffering(dummyOffering);
-        DeploymentPlanner.ExcludeList excludeList = new DeploymentPlanner.ExcludeList();
-        final DataCenterDeployment plan = new DataCenterDeployment(zone.getId(), null, null, hostId, poolId, null);
-        DeployDestination dest = null;
-        try {
-            dest = deploymentPlanningManager.planDeployment(profile, plan, excludeList, null);
-        } catch (Exception e) {
-            logger.warn("Import failed for Vm: {} while finding deployment destination", userVm, e);
-            cleanupFailedImportVM(userVm);
-            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Import failed for Vm: %s while finding deployment destination", userVm.getInstanceName()));
-        }
-        if(dest == null) {
-            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Import failed for Vm: %s. Suitable deployment destination not found", userVm.getInstanceName()));
-        }
+            final VirtualMachineProfile profile = new VirtualMachineProfileImpl(userVm, template, serviceOffering, owner, null);
+            ServiceOfferingVO dummyOffering = serviceOfferingDao.findById(userVm.getId(), serviceOffering.getId());
+            profile.setServiceOffering(dummyOffering);
+            DeploymentPlanner.ExcludeList excludeList = new DeploymentPlanner.ExcludeList();
+            final DataCenterDeployment plan = new DataCenterDeployment(zone.getId(), null, null, hostId, poolId, null);
+            DeployDestination dest = null;
+            try {
+                dest = deploymentPlanningManager.planDeployment(profile, plan, excludeList, null);
+            } catch (Exception e) {
+                logger.warn("Import failed for Vm: {} while finding deployment destination", userVm, e);
+                cleanupFailedImportVM(userVm);
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Import failed for Vm: %s while finding deployment destination", userVm.getInstanceName()));
+            }
+            if(dest == null) {
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Import failed for Vm: %s. Suitable deployment destination not found", userVm.getInstanceName()));
+            }
 
-        Map<Volume, StoragePool> storage = dest.getStorageForDisks();
-        Volume volume = volumeDao.findById(diskProfile.getVolumeId());
-        StoragePool storagePool = storage.get(volume);
-        CheckVolumeCommand checkVolumeCommand = new CheckVolumeCommand();
-        checkVolumeCommand.setSrcFile(diskPath);
-        StorageFilerTO storageTO = new StorageFilerTO(storagePool);
-        checkVolumeCommand.setStorageFilerTO(storageTO);
-        Answer answer = agentManager.easySend(dest.getHost().getId(), checkVolumeCommand);
-        if (!(answer instanceof CheckVolumeAnswer)) {
-            cleanupFailedImportVM(userVm);
-            throw new CloudRuntimeException("Disk not found or is invalid");
-        }
-        CheckVolumeAnswer checkVolumeAnswer = (CheckVolumeAnswer) answer;
-        try {
-            checkVolume(checkVolumeAnswer.getVolumeDetails());
-        } catch (CloudRuntimeException e) {
+            Map<Volume, StoragePool> storage = dest.getStorageForDisks();
+            Volume volume = volumeDao.findById(diskProfile.getVolumeId());
+            StoragePool storagePool = storage.get(volume);
+            CheckVolumeCommand checkVolumeCommand = new CheckVolumeCommand();
+            checkVolumeCommand.setSrcFile(diskPath);
+            StorageFilerTO storageTO = new StorageFilerTO(storagePool);
+            checkVolumeCommand.setStorageFilerTO(storageTO);
+            Answer answer = agentManager.easySend(dest.getHost().getId(), checkVolumeCommand);
+            if (!(answer instanceof CheckVolumeAnswer)) {
+                cleanupFailedImportVM(userVm);
+                throw new CloudRuntimeException("Disk not found or is invalid");
+            }
+            CheckVolumeAnswer checkVolumeAnswer = (CheckVolumeAnswer) answer;
+            try {
+                checkVolume(checkVolumeAnswer.getVolumeDetails());
+            } catch (CloudRuntimeException e) {
+                cleanupFailedImportVM(userVm);
+                throw e;
+            }
+            if (!checkVolumeAnswer.getResult()) {
+                cleanupFailedImportVM(userVm);
+                throw new CloudRuntimeException("Disk not found or is invalid");
+            }
+            diskProfile.setSize(checkVolumeAnswer.getSize());
+
+            CheckedReservation primaryStorageReservation = new CheckedReservation(owner, Resource.ResourceType.primary_storage, resourceLimitStorageTags,
+                    CollectionUtils.isNotEmpty(resourceLimitStorageTags) ? diskProfile.getSize() : 0L, reservationDao, resourceLimitService);
+            reservations.add(primaryStorageReservation);
+
+            List<Pair<DiskProfile, StoragePool>> diskProfileStoragePoolList = new ArrayList<>();
+            try {
+                long deviceId = 1L;
+                if(ImportSource.SHARED == importSource) {
+                    diskProfileStoragePoolList.add(importKVMSharedDisk(userVm, diskOffering, Volume.Type.ROOT,
+                            template, deviceId, poolId, diskPath, diskProfile));
+                } else if(ImportSource.LOCAL == importSource) {
+                    diskProfileStoragePoolList.add(importKVMLocalDisk(userVm, diskOffering, Volume.Type.ROOT,
+                            template, deviceId, hostId, diskPath, diskProfile));
+                }
+            } catch (Exception e) {
+                logger.error(String.format("Failed to import volumes while importing vm: %s", instanceName), e);
+                cleanupFailedImportVM(userVm);
+                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Failed to import volumes while importing vm: %s. %s", instanceName, StringUtils.defaultString(e.getMessage())));
+            }
+            networkOrchestrationService.importNic(macAddress, 0, network, true, userVm, requestedIpPair, zone, true);
+            publishVMUsageUpdateResourceCount(userVm, dummyOffering, template);
+            return userVm;
+
+        } catch (InsufficientCapacityException ice) { // This will be thrown by com.cloud.vm.UserVmService.importVM
+            logger.error(String.format("Failed to import vm name: %s", instanceName), ice);
+            throw new ServerApiException(ApiErrorCode.INSUFFICIENT_CAPACITY_ERROR, ice.getMessage());
+        } catch (ResourceAllocationException e) {
             cleanupFailedImportVM(userVm);
             throw e;
+        } finally {
+            ReservationHelper.closeAll(reservations);
         }
-        if (!checkVolumeAnswer.getResult()) {
-            cleanupFailedImportVM(userVm);
-            throw new CloudRuntimeException("Disk not found or is invalid");
-        }
-        diskProfile.setSize(checkVolumeAnswer.getSize());
+    }
 
-        CheckedReservation primaryStorageReservation = new CheckedReservation(owner, Resource.ResourceType.primary_storage, resourceLimitStorageTags,
-                CollectionUtils.isNotEmpty(resourceLimitStorageTags) ? diskProfile.getSize() : 0L, reservationDao, resourceLimitService);
-        reservations.add(primaryStorageReservation);
+    protected void checkVmResourceLimitsForExternalKvmVmImport(Account owner, ServiceOfferingVO serviceOffering, VMTemplateVO template, Map<String, String> details, List<Reserver> reservations) throws ResourceAllocationException {
+        // When importing an external VM, the amount of CPUs and memory is always obtained from the compute offering,
+        // unlike the unmanaged instance import that obtains it from the hypervisor unless the VM is powered off and the offering is fixed
+        Integer cpu = serviceOffering.getCpu();
+        Integer memory = serviceOffering.getRamSize();
 
-        List<Pair<DiskProfile, StoragePool>> diskProfileStoragePoolList = new ArrayList<>();
-        try {
-            long deviceId = 1L;
-            if(ImportSource.SHARED == importSource) {
-                diskProfileStoragePoolList.add(importKVMSharedDisk(userVm, diskOffering, Volume.Type.ROOT,
-                        template, deviceId, poolId, diskPath, diskProfile));
-            } else if(ImportSource.LOCAL == importSource) {
-                diskProfileStoragePoolList.add(importKVMLocalDisk(userVm, diskOffering, Volume.Type.ROOT,
-                        template, deviceId, hostId, diskPath, diskProfile));
-            }
-        } catch (Exception e) {
-            logger.error(String.format("Failed to import volumes while importing vm: %s", instanceName), e);
-            cleanupFailedImportVM(userVm);
-            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, String.format("Failed to import volumes while importing vm: %s. %s", instanceName, StringUtils.defaultString(e.getMessage())));
+        if (serviceOffering.isDynamic()) {
+            cpu = getDetailAsInteger(VmDetailConstants.CPU_NUMBER, details);
+            memory = getDetailAsInteger(VmDetailConstants.MEMORY, details);
         }
-        networkOrchestrationService.importNic(macAddress, 0, network, true, userVm, requestedIpPair, zone, true);
-        publishVMUsageUpdateResourceCount(userVm, dummyOffering, template);
-        return userVm;
 
-        } finally {
-            ReservationHelper.closeAll(reservations);
+        List<String> resourceLimitHostTags = resourceLimitService.getResourceLimitHostTags(serviceOffering, template);
+
+        CheckedReservation vmReservation = new CheckedReservation(owner, Resource.ResourceType.user_vm, resourceLimitHostTags, 1L, reservationDao, resourceLimitService);
+        reservations.add(vmReservation);
+
+        CheckedReservation cpuReservation = new CheckedReservation(owner, Resource.ResourceType.cpu, resourceLimitHostTags, cpu.longValue(), reservationDao, resourceLimitService);
+        reservations.add(cpuReservation);
+
+        CheckedReservation memReservation = new CheckedReservation(owner, Resource.ResourceType.memory, resourceLimitHostTags, memory.longValue(), reservationDao, resourceLimitService);
+        reservations.add(memReservation);
+    }
+
+    protected Integer getDetailAsInteger(String key, Map<String, String> details) {
+        String detail = details.get(key);
+        if (detail == null) {
+            throw new InvalidParameterValueException(String.format("Detail '%s' must be provided.", key));
+        }
+        try {
+            return Integer.valueOf(detail);
+        } catch (NumberFormatException e) {
+            throw new InvalidParameterValueException(String.format("Please provide a valid integer value for detail '%s'.", key));
         }
     }
 
diff --git a/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java
index 9935a228c5b4..544c37d57e92 100644
--- a/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/vm/UnmanagedVMsManagerImplTest.java
@@ -38,9 +38,11 @@
 import java.util.Map;
 import java.util.UUID;
 
+import com.cloud.exception.ResourceAllocationException;
 import com.cloud.offering.DiskOffering;
 import com.cloud.resourcelimit.CheckedReservation;
 import com.cloud.vm.ImportVMTaskVO;
+import com.cloud.vm.VmDetailConstants;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ResponseGenerator;
 import org.apache.cloudstack.api.ResponseObject;
@@ -60,6 +62,7 @@
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.reservation.dao.ReservationDao;
+import org.apache.cloudstack.resourcelimit.Reserver;
 import org.apache.cloudstack.storage.datastore.db.ImageStoreDao;
 import org.apache.cloudstack.storage.datastore.db.ImageStoreVO;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
@@ -167,7 +170,6 @@
 import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.VirtualMachine;
-import com.cloud.vm.VmDetailConstants;
 import com.cloud.vm.dao.NicDao;
 import com.cloud.vm.dao.UserVmDao;
 import com.cloud.vm.dao.VMInstanceDao;
@@ -178,7 +180,7 @@ public class UnmanagedVMsManagerImplTest {
 
     @Spy
     @InjectMocks
-    private UnmanagedVMsManagerImpl unmanagedVMsManager = new UnmanagedVMsManagerImpl();
+    private UnmanagedVMsManagerImpl unmanagedVMsManager;
 
     @Mock
     private UserVmManager userVmManager;
@@ -255,11 +257,18 @@ public class UnmanagedVMsManagerImplTest {
     ImportVMTaskVO importVMTaskVO;
     @Mock
     private VMInstanceDetailsDao vmInstanceDetailsDao;
-
     @Mock
     private ConfigKey<Boolean> configKeyMockParamsAllowed;
     @Mock
     private ConfigKey<String> configKeyMockParamsAllowedList;
+    @Mock
+    private Account accountMock;
+    @Mock
+    private ServiceOfferingVO serviceOfferingMock;
+    @Mock
+    private VMTemplateVO templateMock;
+    @Mock
+    private UnmanagedInstanceTO unmanagedInstanceMock;
 
     private static final long virtualMachineId = 1L;
 
@@ -386,6 +395,11 @@ public void setUp() throws Exception {
 
         when(vmDao.findById(virtualMachineId)).thenReturn(virtualMachine);
         when(virtualMachine.getState()).thenReturn(VirtualMachine.State.Running);
+
+        when(unmanagedInstanceMock.getCpuCores()).thenReturn(8);
+        when(unmanagedInstanceMock.getMemory()).thenReturn(4096);
+        when(serviceOfferingMock.getCpu()).thenReturn(4);
+        when(serviceOfferingMock.getRamSize()).thenReturn(2048);
     }
 
     @NotNull
@@ -1321,4 +1335,102 @@ public void testAddServiceOfferingDetailsToParamsCustomUnconstrainedOffering() {
         Assert.assertFalse(params.containsKey(VmDetailConstants.CPU_SPEED));
         Assert.assertFalse(params.containsKey(VmDetailConstants.MEMORY));
     }
+
+    @Test
+    public void checkVmResourceLimitsForUnmanagedInstanceImportTestUsesInformationFromHypervisorWhenOfferingIsDynamic() throws Exception {
+        when(serviceOfferingMock.isDynamic()).thenReturn(true);
+        List<Reserver> reservations = new ArrayList<>();
+
+        try (MockedConstruction<CheckedReservation> mockedConstruction = Mockito.mockConstruction(CheckedReservation.class)) {
+            unmanagedVMsManager.checkVmResourceLimitsForUnmanagedInstanceImport(accountMock, unmanagedInstanceMock, serviceOfferingMock, templateMock, reservations);
+
+            Assert.assertEquals(3, mockedConstruction.constructed().size());
+            Assert.assertEquals(3, reservations.size());
+            verify(unmanagedInstanceMock).getCpuCores();
+            verify(unmanagedInstanceMock).getMemory();
+        }
+    }
+
+    @Test
+    public void checkVmResourceLimitsForUnmanagedInstanceImportTestUsesInformationFromHypervisorWhenVmIsPoweredOn() throws Exception {
+        when(unmanagedInstanceMock.getPowerState()).thenReturn(UnmanagedInstanceTO.PowerState.PowerOn);
+        when(serviceOfferingMock.isDynamic()).thenReturn(false);
+        List<Reserver> reservations = new ArrayList<>();
+
+        try (MockedConstruction<CheckedReservation> mockedConstruction = Mockito.mockConstruction(CheckedReservation.class)) {
+            unmanagedVMsManager.checkVmResourceLimitsForUnmanagedInstanceImport(accountMock, unmanagedInstanceMock, serviceOfferingMock, templateMock, reservations);
+
+            Assert.assertEquals(3, mockedConstruction.constructed().size());
+            Assert.assertEquals(3, reservations.size());
+            verify(unmanagedInstanceMock).getCpuCores();
+            verify(unmanagedInstanceMock).getMemory();
+        }
+    }
+
+    @Test
+    public void checkVmResourceLimitsForUnmanagedInstanceImportTestUsesInformationFromOfferingWhenOfferingIsNotDynamicAndVmIsPoweredOff() throws Exception {
+        when(unmanagedInstanceMock.getPowerState()).thenReturn(UnmanagedInstanceTO.PowerState.PowerOff);
+        when(serviceOfferingMock.isDynamic()).thenReturn(false);
+        List<Reserver> reservations = new ArrayList<>();
+
+        try (MockedConstruction<CheckedReservation> mockedConstruction = Mockito.mockConstruction(CheckedReservation.class)) {
+            unmanagedVMsManager.checkVmResourceLimitsForUnmanagedInstanceImport(accountMock, unmanagedInstanceMock, serviceOfferingMock, templateMock, reservations);
+
+            Assert.assertEquals(3, mockedConstruction.constructed().size());
+            Assert.assertEquals(3, reservations.size());
+            verify(serviceOfferingMock).getCpu();
+            verify(serviceOfferingMock).getRamSize();
+            verify(unmanagedInstanceMock, Mockito.never()).getCpuCores();
+            verify(unmanagedInstanceMock, Mockito.never()).getMemory();
+        }
+    }
+
+    @Test
+    public void checkVmResourceLimitsForExternalKvmVmImportTestUsesInformationFromOfferingWhenOfferingIsNotDynamic() throws ResourceAllocationException {
+        when(serviceOfferingMock.isDynamic()).thenReturn(false);
+        Map<String, String> details = new HashMap<>();
+        List<Reserver> reservations = new ArrayList<>();
+
+        try (MockedConstruction<CheckedReservation> mockedConstruction = Mockito.mockConstruction(CheckedReservation.class)) {
+            unmanagedVMsManager.checkVmResourceLimitsForExternalKvmVmImport(accountMock, serviceOfferingMock, templateMock, details, reservations);
+
+            Assert.assertEquals(3, mockedConstruction.constructed().size());
+            Assert.assertEquals(3, reservations.size());
+            verify(serviceOfferingMock).getCpu();
+            verify(serviceOfferingMock).getRamSize();
+            verify(unmanagedVMsManager, Mockito.never()).getDetailAsInteger(VmDetailConstants.CPU_NUMBER, details);
+            verify(unmanagedVMsManager, Mockito.never()).getDetailAsInteger(VmDetailConstants.MEMORY, details);
+        }
+    }
+
+    @Test
+    public void checkVmResourceLimitsForExternalKvmVmImportTestUsesInformationFromDetailsWhenOfferingIsDynamic() throws ResourceAllocationException {
+        when(serviceOfferingMock.isDynamic()).thenReturn(true);
+        Map<String, String> details = new HashMap<>();
+        details.put(VmDetailConstants.CPU_NUMBER, "8");
+        details.put(VmDetailConstants.MEMORY, "4096");
+        List<Reserver> reservations = new ArrayList<>();
+
+        try (MockedConstruction<CheckedReservation> mockedConstruction = Mockito.mockConstruction(CheckedReservation.class)) {
+            unmanagedVMsManager.checkVmResourceLimitsForExternalKvmVmImport(accountMock, serviceOfferingMock, templateMock, details, reservations);
+
+            Assert.assertEquals(3, mockedConstruction.constructed().size());
+            Assert.assertEquals(3, reservations.size());
+            verify(unmanagedVMsManager).getDetailAsInteger(VmDetailConstants.CPU_NUMBER, details);
+            verify(unmanagedVMsManager).getDetailAsInteger(VmDetailConstants.MEMORY, details);
+        }
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void getDetailAsIntegerTestThrowsInvalidParameterValueExceptionWhenDetailIsNull() {
+        Map<String, String> details = new HashMap<>();
+        unmanagedVMsManager.getDetailAsInteger("non-existent", details);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void getDetailAsIntegerTestThrowsInvalidParameterValueExceptionWhenValueIsInvalid() {
+        Map<String, String> details = new HashMap<>();
+        details.put("key", "not-a-number");
+        unmanagedVMsManager.getDetailAsInteger("key", details);
+    }
 }

From a127a26ebd3cb2b3cdfed3e8a6b5f1a2c855a5cd Mon Sep 17 00:00:00 2001
From: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Date: Fri, 27 Mar 2026 10:19:52 +0530
Subject: [PATCH 02/64] Fix Revert Instance to Snapshot with custom service
 offering (#12885)

* Fix revertVM with custom svc offering
---
 .../vm/snapshot/VMSnapshotManagerImpl.java    | 54 +++++++++++-----
 .../vm/snapshot/VMSnapshotManagerTest.java    | 62 ++++++++++++++-----
 2 files changed, 87 insertions(+), 29 deletions(-)

diff --git a/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java b/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java
index b2e820bce946..fe91e1d9caae 100644
--- a/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/snapshot/VMSnapshotManagerImpl.java
@@ -751,11 +751,17 @@ public UserVm revertToSnapshot(Long vmSnapshotId) throws InsufficientCapacityExc
                     "VM Snapshot reverting failed due to vm is not in the state of Running or Stopped.");
         }
 
-        if (userVm.getState() == VirtualMachine.State.Running && vmSnapshotVo.getType() == VMSnapshot.Type.Disk || userVm.getState() == VirtualMachine.State.Stopped
-                && vmSnapshotVo.getType() == VMSnapshot.Type.DiskAndMemory) {
+        if (userVm.getState() == VirtualMachine.State.Running && vmSnapshotVo.getType() == VMSnapshot.Type.Disk) {
             throw new InvalidParameterValueException(
-                    "VM Snapshot revert not allowed. This will result in VM state change. You can revert running VM to disk and memory type snapshot and stopped VM to disk type"
-                            + " snapshot");
+                    "Reverting to the Instance Snapshot is not allowed for running Instances as this would result in an Instance state change. " +
+                            "For running Instances only Snapshots with memory can be reverted. " +
+                            "In order to revert to a Snapshot without memory you need to first stop the Instance.");
+        }
+
+        if (userVm.getState() == VirtualMachine.State.Stopped && vmSnapshotVo.getType() == VMSnapshot.Type.DiskAndMemory) {
+            throw new InvalidParameterValueException(
+                    "Reverting to the Instance Snapshot is not allowed for stopped Instances when the Snapshot contains memory as this would result in an Instance state change. " +
+                            "In order to revert to a Snapshot with memory you need to first start the Instance.");
         }
 
         // if snapshot is not created, error out
@@ -808,20 +814,36 @@ else if (jobResult instanceof Throwable)
     }
 
     /**
-     * If snapshot was taken with a different service offering than actual used in vm, should change it back to it.
-     * We also call <code>changeUserVmServiceOffering</code> in case the service offering is dynamic in order to
-     * perform resource limit validation, as the amount of CPUs or memory may have been changed.
-     * @param vmSnapshotVo vm snapshot
+     * Check if service offering change is needed for user vm when reverting to vm snapshot.
+     * Service offering change is needed when snapshot was taken with a different service offering than actual used in vm.
+     * Service offering change is also needed when service offering is dynamic and the amount of cpu, memory or cpu speed
+     * has been changed since snapshot was taken.
+     * @param userVm
+     * @param vmSnapshotVo
+     * @return true if service offering change is needed; false otherwise
      */
-    protected void updateUserVmServiceOffering(UserVm userVm, VMSnapshotVO vmSnapshotVo) {
+    protected boolean userVmServiceOfferingNeedsChange(UserVm userVm, VMSnapshotVO vmSnapshotVo) {
         if (vmSnapshotVo.getServiceOfferingId() != userVm.getServiceOfferingId()) {
-            changeUserVmServiceOffering(userVm, vmSnapshotVo);
-            return;
+            return true;
         }
-        ServiceOfferingVO serviceOffering = _serviceOfferingDao.findById(userVm.getServiceOfferingId());
-        if (serviceOffering.isDynamic()) {
-            changeUserVmServiceOffering(userVm, vmSnapshotVo);
+
+        ServiceOfferingVO currentServiceOffering = _serviceOfferingDao.findByIdIncludingRemoved(userVm.getId(), userVm.getServiceOfferingId());
+        if (currentServiceOffering.isDynamic()) {
+            Map<String, String> vmDetails = getVmMapDetails(vmSnapshotVo);
+            ServiceOfferingVO newServiceOffering = _serviceOfferingDao.getComputeOffering(currentServiceOffering, vmDetails);
+
+            int newCpu = newServiceOffering.getCpu();
+            int newMemory = newServiceOffering.getRamSize();
+            int newSpeed = newServiceOffering.getSpeed();
+            int currentCpu = currentServiceOffering.getCpu();
+            int currentMemory = currentServiceOffering.getRamSize();
+            int currentSpeed = currentServiceOffering.getSpeed();
+
+            if (newCpu != currentCpu || newMemory != currentMemory || newSpeed != currentSpeed) {
+                return true;
+            }
         }
+        return false;
     }
 
     /**
@@ -941,7 +963,9 @@ private UserVm orchestrateRevertToVMSnapshot(Long vmSnapshotId) throws Insuffici
             Transaction.execute(new TransactionCallbackWithExceptionNoReturn<CloudRuntimeException>() {
                 @Override
                 public void doInTransactionWithoutResult(TransactionStatus status) throws CloudRuntimeException {
-                    updateUserVmServiceOffering(userVm, vmSnapshotVo);
+                    if (userVmServiceOfferingNeedsChange(userVm, vmSnapshotVo)) {
+                        changeUserVmServiceOffering(userVm, vmSnapshotVo);
+                    }
                     revertUserVmDetailsFromVmSnapshot(userVm, vmSnapshotVo);
                 }
             });
diff --git a/server/src/test/java/com/cloud/vm/snapshot/VMSnapshotManagerTest.java b/server/src/test/java/com/cloud/vm/snapshot/VMSnapshotManagerTest.java
index 7b12fc4a99c0..88af1a6325d3 100644
--- a/server/src/test/java/com/cloud/vm/snapshot/VMSnapshotManagerTest.java
+++ b/server/src/test/java/com/cloud/vm/snapshot/VMSnapshotManagerTest.java
@@ -67,7 +67,6 @@
 import org.junit.Test;
 import org.mockito.ArgumentCaptor;
 import org.mockito.Captor;
-import org.mockito.ArgumentMatchers;
 import org.mockito.Mock;
 import org.mockito.MockitoAnnotations;
 import org.mockito.Spy;
@@ -79,9 +78,12 @@
 import java.util.Map;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyLong;
 import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
 import static org.mockito.Mockito.doNothing;
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.mock;
@@ -223,6 +225,7 @@ public void setup() {
         when(vmSnapshotVO.getId()).thenReturn(VM_SNAPSHOT_ID);
         when(serviceOffering.isDynamic()).thenReturn(false);
         when(_serviceOfferingDao.findById(SERVICE_OFFERING_ID)).thenReturn(serviceOffering);
+        when(_serviceOfferingDao.findByIdIncludingRemoved(TEST_VM_ID, SERVICE_OFFERING_ID)).thenReturn(serviceOffering);
 
         for (ResourceDetail detail : Arrays.asList(userVmDetailCpuNumber, vmSnapshotDetailCpuNumber)) {
             when(detail.getName()).thenReturn("cpuNumber");
@@ -340,20 +343,51 @@ public void testAddSupportForCustomServiceOfferingDynamicServiceOffering() {
     }
 
     @Test
-    public void testUpdateUserVmServiceOfferingSameServiceOffering() {
-        _vmSnapshotMgr.updateUserVmServiceOffering(userVm, vmSnapshotVO);
-        verify(_vmSnapshotMgr, never()).changeUserVmServiceOffering(userVm, vmSnapshotVO);
+    public void testUserVmServiceOfferingNeedsChangeWhenSnapshotOfferingDiffers() {
+        when(userVm.getServiceOfferingId()).thenReturn(SERVICE_OFFERING_DIFFERENT_ID);
+        when(vmSnapshotVO.getServiceOfferingId()).thenReturn(SERVICE_OFFERING_ID);
+
+        assertTrue(_vmSnapshotMgr.userVmServiceOfferingNeedsChange(userVm, vmSnapshotVO));
+
+        verify(_serviceOfferingDao, never()).findByIdIncludingRemoved(anyLong(), anyLong());
+        verify(_serviceOfferingDao, never()).getComputeOffering(any(ServiceOfferingVO.class), any());
     }
 
     @Test
-    public void testUpdateUserVmServiceOfferingDifferentServiceOffering() throws ConcurrentOperationException, ResourceUnavailableException, ManagementServerException, VirtualMachineMigrationException {
-        when(userVm.getServiceOfferingId()).thenReturn(SERVICE_OFFERING_DIFFERENT_ID);
-        when(_userVmManager.upgradeVirtualMachine(ArgumentMatchers.eq(TEST_VM_ID), ArgumentMatchers.eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture())).thenReturn(true);
-        _vmSnapshotMgr.updateUserVmServiceOffering(userVm, vmSnapshotVO);
+    public void testUserVmServiceOfferingNeedsChangeWhenSameNonDynamicOffering() {
+        assertFalse(_vmSnapshotMgr.userVmServiceOfferingNeedsChange(userVm, vmSnapshotVO));
+
+        verify(_serviceOfferingDao).findByIdIncludingRemoved(TEST_VM_ID, SERVICE_OFFERING_ID);
+        verify(_serviceOfferingDao, never()).getComputeOffering(any(ServiceOfferingVO.class), any());
+    }
 
-        verify(_vmSnapshotMgr).changeUserVmServiceOffering(userVm, vmSnapshotVO);
+    @Test
+    public void testUserVmServiceOfferingNeedsChangeWhenDynamicOfferingMatchesSnapshot() {
+        when(serviceOffering.isDynamic()).thenReturn(true);
+        when(serviceOffering.getCpu()).thenReturn(2);
+        when(serviceOffering.getRamSize()).thenReturn(2048);
+        when(serviceOffering.getSpeed()).thenReturn(1000);
+        when(_serviceOfferingDao.getComputeOffering(eq(serviceOffering), any())).thenReturn(serviceOffering);
+
+        assertFalse(_vmSnapshotMgr.userVmServiceOfferingNeedsChange(userVm, vmSnapshotVO));
+
+        verify(_serviceOfferingDao).getComputeOffering(eq(serviceOffering), any());
         verify(_vmSnapshotMgr).getVmMapDetails(vmSnapshotVO);
-        verify(_vmSnapshotMgr).upgradeUserVmServiceOffering(ArgumentMatchers.eq(userVm), ArgumentMatchers.eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture());
+    }
+
+    @Test
+    public void testUserVmServiceOfferingNeedsChangeWhenDynamicCpuDiffersFromSnapshot() {
+        when(serviceOffering.isDynamic()).thenReturn(true);
+        when(serviceOffering.getCpu()).thenReturn(2);
+        when(serviceOffering.getRamSize()).thenReturn(2048);
+        when(serviceOffering.getSpeed()).thenReturn(1000);
+        ServiceOfferingVO fromSnapshot = mock(ServiceOfferingVO.class);
+        when(fromSnapshot.getCpu()).thenReturn(4);
+        when(fromSnapshot.getRamSize()).thenReturn(2048);
+        when(fromSnapshot.getSpeed()).thenReturn(1000);
+        when(_serviceOfferingDao.getComputeOffering(eq(serviceOffering), any())).thenReturn(fromSnapshot);
+
+        assertTrue(_vmSnapshotMgr.userVmServiceOfferingNeedsChange(userVm, vmSnapshotVO));
     }
 
     @Test
@@ -368,18 +402,18 @@ public void testGetVmMapDetails() {
 
     @Test
     public void testChangeUserVmServiceOffering() throws ConcurrentOperationException, ResourceUnavailableException, ManagementServerException, VirtualMachineMigrationException {
-        when(_userVmManager.upgradeVirtualMachine(ArgumentMatchers.eq(TEST_VM_ID), ArgumentMatchers.eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture())).thenReturn(true);
+        when(_userVmManager.upgradeVirtualMachine(eq(TEST_VM_ID), eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture())).thenReturn(true);
         _vmSnapshotMgr.changeUserVmServiceOffering(userVm, vmSnapshotVO);
         verify(_vmSnapshotMgr).getVmMapDetails(vmSnapshotVO);
-        verify(_vmSnapshotMgr).upgradeUserVmServiceOffering(ArgumentMatchers.eq(userVm), ArgumentMatchers.eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture());
+        verify(_vmSnapshotMgr).upgradeUserVmServiceOffering(eq(userVm), eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture());
     }
 
     @Test(expected=CloudRuntimeException.class)
     public void testChangeUserVmServiceOfferingFailOnUpgradeVMServiceOffering() throws ConcurrentOperationException, ResourceUnavailableException, ManagementServerException, VirtualMachineMigrationException {
-        when(_userVmManager.upgradeVirtualMachine(ArgumentMatchers.eq(TEST_VM_ID), ArgumentMatchers.eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture())).thenReturn(false);
+        when(_userVmManager.upgradeVirtualMachine(eq(TEST_VM_ID), eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture())).thenReturn(false);
         _vmSnapshotMgr.changeUserVmServiceOffering(userVm, vmSnapshotVO);
         verify(_vmSnapshotMgr).getVmMapDetails(vmSnapshotVO);
-        verify(_vmSnapshotMgr).upgradeUserVmServiceOffering(ArgumentMatchers.eq(userVm), ArgumentMatchers.eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture());
+        verify(_vmSnapshotMgr).upgradeUserVmServiceOffering(eq(userVm), eq(SERVICE_OFFERING_ID), mapDetailsCaptor.capture());
     }
 
     @Test

From 9f96c9d5eb97f1836103918cf520d72cc3395c51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erik=20B=C3=B6ck?=
 <89930804+erikbocks@users.noreply.github.com>
Date: Tue, 21 Apr 2026 07:53:11 -0300
Subject: [PATCH 03/64] Flexibilize public IP selection (#11076)

---
 .../network/dao/PublicIpQuarantineDao.java    | 12 +++
 .../dao/PublicIpQuarantineDaoImpl.java        | 22 +++++
 .../cloud/network/IpAddressManagerImpl.java   | 91 +++++++++++--------
 .../cloud/network/IpAddressManagerTest.java   |  1 +
 .../integration/smoke/test_quarantined_ips.py |  8 +-
 5 files changed, 92 insertions(+), 42 deletions(-)

diff --git a/engine/schema/src/main/java/com/cloud/network/dao/PublicIpQuarantineDao.java b/engine/schema/src/main/java/com/cloud/network/dao/PublicIpQuarantineDao.java
index ccba6bb18893..606bdaaaa7a7 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/PublicIpQuarantineDao.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/PublicIpQuarantineDao.java
@@ -19,9 +19,21 @@
 import com.cloud.network.vo.PublicIpQuarantineVO;
 import com.cloud.utils.db.GenericDao;
 
+import java.util.Date;
+import java.util.List;
+
 public interface PublicIpQuarantineDao extends GenericDao<PublicIpQuarantineVO, Long> {
 
     PublicIpQuarantineVO findByPublicIpAddressId(long publicIpAddressId);
 
     PublicIpQuarantineVO findByIpAddress(String publicIpAddress);
+
+    /**
+     * Returns a list of public IP addresses that are actively quarantined at the specified date and the previous owner differs from the specified user.
+     *
+     * @param userId used to check against the IP's previous owner;
+     * @param date used to check if the quarantine is active;
+     * @return a list of PublicIpQuarantineVOs.
+     */
+    List<PublicIpQuarantineVO> listQuarantinedIpAddressesToUser(Long userId, Date date);
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/PublicIpQuarantineDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/dao/PublicIpQuarantineDaoImpl.java
index a1b789b8a46b..0c47a0d36e30 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/PublicIpQuarantineDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/PublicIpQuarantineDaoImpl.java
@@ -26,6 +26,8 @@
 
 import javax.annotation.PostConstruct;
 import javax.inject.Inject;
+import java.util.Date;
+import java.util.List;
 
 @Component
 public class PublicIpQuarantineDaoImpl extends GenericDaoBase<PublicIpQuarantineVO, Long> implements PublicIpQuarantineDao {
@@ -33,6 +35,8 @@ public class PublicIpQuarantineDaoImpl extends GenericDaoBase<PublicIpQuarantine
 
     private SearchBuilder<IPAddressVO> ipAddressSearchBuilder;
 
+    private SearchBuilder<PublicIpQuarantineVO> quarantinedIpAddressesSearch;
+
     @Inject
     IPAddressDao ipAddressDao;
 
@@ -47,8 +51,16 @@ public void init() {
         publicIpAddressByIdSearch.join("quarantineJoin", ipAddressSearchBuilder, ipAddressSearchBuilder.entity().getId(),
                 publicIpAddressByIdSearch.entity().getPublicIpAddressId(), JoinBuilder.JoinType.INNER);
 
+        quarantinedIpAddressesSearch = createSearchBuilder();
+        quarantinedIpAddressesSearch.and("previousOwnerId", quarantinedIpAddressesSearch.entity().getPreviousOwnerId(), SearchCriteria.Op.NEQ);
+        quarantinedIpAddressesSearch.and();
+        quarantinedIpAddressesSearch.op("removedIsNull", quarantinedIpAddressesSearch.entity().getRemoved(), SearchCriteria.Op.NULL);
+        quarantinedIpAddressesSearch.and("endDate", quarantinedIpAddressesSearch.entity().getEndDate(), SearchCriteria.Op.GT);
+        quarantinedIpAddressesSearch.cp();
+
         ipAddressSearchBuilder.done();
         publicIpAddressByIdSearch.done();
+        quarantinedIpAddressesSearch.done();
     }
 
     @Override
@@ -68,4 +80,14 @@ public PublicIpQuarantineVO findByIpAddress(String publicIpAddress) {
 
         return findOneBy(sc, filter);
     }
+
+    @Override
+    public List<PublicIpQuarantineVO> listQuarantinedIpAddressesToUser(Long userId, Date date) {
+        SearchCriteria<PublicIpQuarantineVO> sc = quarantinedIpAddressesSearch.create();
+
+        sc.setParameters("previousOwnerId", userId);
+        sc.setParameters("endDate", date);
+
+        return searchIncludingRemoved(sc, null, false, false);
+    }
 }
diff --git a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
index fe555af9d50f..c5ca392a4375 100644
--- a/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/IpAddressManagerImpl.java
@@ -514,6 +514,9 @@ public boolean configure(String name, Map<String, Object> params) {
         AssignIpAddressSearch.and("allocated", AssignIpAddressSearch.entity().getAllocatedTime(), Op.NULL);
         AssignIpAddressSearch.and("vlanId", AssignIpAddressSearch.entity().getVlanId(), Op.IN);
         AssignIpAddressSearch.and("forSystemVms", AssignIpAddressSearch.entity().isForSystemVms(), Op.EQ);
+        AssignIpAddressSearch.and("id", AssignIpAddressSearch.entity().getId(), Op.NIN);
+        AssignIpAddressSearch.and("requestedAddress", AssignIpAddressSearch.entity().getAddress(), Op.EQ);
+        AssignIpAddressSearch.and("routerAddress", AssignIpAddressSearch.entity().getAddress(), Op.NEQ);
 
         SearchBuilder<VlanVO> vlanSearch = _vlanDao.createSearchBuilder();
         vlanSearch.and("type", vlanSearch.entity().getVlanType(), Op.EQ);
@@ -883,10 +886,23 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
         if (podId != null) {
             sc = AssignIpAddressFromPodVlanSearch.create();
             sc.setJoinParameters("podVlanMapSB", "podId", podId);
-            errorMessage.append(" pod id=" + podId);
+            errorMessage.append(" pod id=").append(podId);
         } else {
             sc = AssignIpAddressSearch.create();
-            errorMessage.append(" zone id=" + dcId);
+            errorMessage.append(" zone id=").append(dcId);
+        }
+
+        if (lockOneRow) {
+            logger.debug("Listing quarantined public IPs to ignore on search for public IP for system VM. The IPs ignored will be the ones that: were not associated to account [{}]; were not removed yet; and with quarantine end dates after [{}].", owner.getUuid(), new Date());
+
+            List<PublicIpQuarantineVO> quarantinedAddresses = publicIpQuarantineDao.listQuarantinedIpAddressesToUser(owner.getId(), new Date());
+            List<Long> quarantinedAddressesIDs = quarantinedAddresses.stream().map(PublicIpQuarantineVO::getPublicIpAddressId).collect(Collectors.toList());
+
+            logger.debug("Found addresses with the following IDs: [{}] that will be ignored when searching for available public IPs.", quarantinedAddressesIDs);
+
+            if (CollectionUtils.isNotEmpty(quarantinedAddressesIDs)) {
+                sc.setParameters("id", quarantinedAddressesIDs.toArray());
+            }
         }
 
         sc.setParameters("dc", dcId);
@@ -894,11 +910,11 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
         // for direct network take ip addresses only from the vlans belonging to the network
         if (vlanUse == VlanType.DirectAttached) {
             sc.setJoinParameters("vlan", "networkId", guestNetworkId);
-            errorMessage.append(", network id=" + guestNetworkId);
+            errorMessage.append(", network id=").append(guestNetworkId);
         }
         if (requestedGateway != null) {
             sc.setJoinParameters("vlan", "vlanGateway", requestedGateway);
-            errorMessage.append(", requested gateway=" + requestedGateway);
+            errorMessage.append(", requested gateway=").append(requestedGateway);
         }
         sc.setJoinParameters("vlan", "type", vlanUse);
 
@@ -908,38 +924,39 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
             NetworkDetailVO routerIpDetail = _networkDetailsDao.findDetail(network.getId(), ApiConstants.ROUTER_IP);
             routerIpAddress = routerIpDetail != null ? routerIpDetail.getValue() : null;
         }
+
         if (requestedIp != null) {
-            sc.addAnd("address", SearchCriteria.Op.EQ, requestedIp);
-            errorMessage.append(": requested ip " + requestedIp + " is not available");
+            sc.setParameters("requestedAddress", requestedIp);
+            errorMessage.append(": requested ip ").append(requestedIp).append(" is not available");
         } else if (routerIpAddress != null) {
-            sc.addAnd("address", Op.NEQ, routerIpAddress);
+            sc.setParameters("routerAddress", routerIpAddress);
         }
 
         boolean ascOrder = ! forSystemVms;
-        Filter filter = new Filter(IPAddressVO.class, "forSystemVms", ascOrder, 0l, 1l);
+        Filter filter = new Filter(IPAddressVO.class, "forSystemVms", ascOrder, 0L, 1L);
 
         filter.addOrderBy(IPAddressVO.class,"vlanId", true);
 
-        List<IPAddressVO> addrs = new ArrayList<>();
+        List<IPAddressVO> addresses = new ArrayList<>();
 
         if (forSystemVms) {
             // Get Public IPs for system vms in dedicated ranges
             sc.setParameters("forSystemVms", true);
             if (lockOneRow) {
-                addrs = _ipAddressDao.lockRows(sc, filter, true);
+                addresses = _ipAddressDao.lockRows(sc, filter, true);
             } else {
-                addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
+                addresses = new ArrayList<>(_ipAddressDao.search(sc, null));
             }
         }
-        if ((!lockOneRow || (lockOneRow && CollectionUtils.isEmpty(addrs))) &&
+        if ((!lockOneRow || (lockOneRow && CollectionUtils.isEmpty(addresses))) &&
                 !(forSystemVms && SystemVmPublicIpReservationModeStrictness.value())) {
             sc.setParameters("forSystemVms", false);
             // If owner has dedicated Public IP ranges, fetch IP from the dedicated range
             // Otherwise fetch IP from the system pool
             // Checking if network is null in the case of system VM's. At the time of allocation of IP address to systemVm, no network is present.
             if (network == null || !(network.getGuestType() == GuestType.Shared && zone.getNetworkType() == NetworkType.Advanced)) {
-                List<AccountVlanMapVO> maps = _accountVlanMapDao.listAccountVlanMapsByAccount(owner.getId());
-                for (AccountVlanMapVO map : maps) {
+                List<AccountVlanMapVO> accountVlanMaps = _accountVlanMapDao.listAccountVlanMapsByAccount(owner.getId());
+                for (AccountVlanMapVO map : accountVlanMaps) {
                     if (vlanDbIds == null || vlanDbIds.contains(map.getVlanDbId()))
                         dedicatedVlanDbIds.add(map.getVlanDbId());
                 }
@@ -958,10 +975,10 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
                 if (!dedicatedVlanDbIds.isEmpty()) {
                     fetchFromDedicatedRange = true;
                     sc.setParameters("vlanId", dedicatedVlanDbIds.toArray());
-                    errorMessage.append(", vlanId id=" + Arrays.toString(dedicatedVlanDbIds.toArray()));
+                    errorMessage.append(", vlanId id=").append(Arrays.toString(dedicatedVlanDbIds.toArray()));
                 } else if (!nonDedicatedVlanDbIds.isEmpty()) {
                     sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
-                    errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
+                    errorMessage.append(", vlanId id=").append(Arrays.toString(nonDedicatedVlanDbIds.toArray()));
                 } else {
                     if (podId != null) {
                         InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
@@ -975,13 +992,13 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
                 }
             }
             if (lockOneRow) {
-                addrs = _ipAddressDao.lockRows(sc, filter, true);
+                addresses = _ipAddressDao.lockRows(sc, filter, true);
             } else {
-                addrs = new ArrayList<>(_ipAddressDao.search(sc, null));
+                addresses = new ArrayList<>(_ipAddressDao.search(sc, null));
             }
 
             // If all the dedicated IPs of the owner are in use fetch an IP from the system pool
-            if ((!lockOneRow || (lockOneRow && addrs.size() == 0)) && fetchFromDedicatedRange && vlanUse == VlanType.VirtualNetwork) {
+            if ((!lockOneRow || (lockOneRow && addresses.isEmpty())) && fetchFromDedicatedRange && vlanUse == VlanType.VirtualNetwork) {
                 // Verify if account is allowed to acquire IPs from the system
                 boolean useSystemIps = UseSystemPublicIps.valueIn(owner.getId());
                 if (useSystemIps && !nonDedicatedVlanDbIds.isEmpty()) {
@@ -989,15 +1006,15 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
                     sc.setParameters("vlanId", nonDedicatedVlanDbIds.toArray());
                     errorMessage.append(", vlanId id=" + Arrays.toString(nonDedicatedVlanDbIds.toArray()));
                     if (lockOneRow) {
-                        addrs = _ipAddressDao.lockRows(sc, filter, true);
+                        addresses = _ipAddressDao.lockRows(sc, filter, true);
                     } else {
-                        addrs.addAll(_ipAddressDao.search(sc, null));
+                        addresses.addAll(_ipAddressDao.search(sc, null));
                     }
                 }
             }
         }
 
-        if (lockOneRow && addrs.size() == 0) {
+        if (lockOneRow && addresses.isEmpty()) {
             if (podId != null) {
                 InsufficientAddressCapacityException ex = new InsufficientAddressCapacityException("Insufficient address capacity", Pod.class, podId);
                 // for now, we hardcode the table names, but we should ideally do a lookup for the tablename from the VO object.
@@ -1011,13 +1028,12 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
         }
 
         if (lockOneRow) {
-            assert (addrs.size() == 1) : "Return size is incorrect: " + addrs.size();
-            IpAddress ipAddress = addrs.get(0);
-            boolean ipCanBeAllocated = canPublicIpAddressBeAllocated(ipAddress, owner);
+            IPAddressVO allocatableIp = addresses.get(0);
+
+            boolean isPublicIpAllocatable = canPublicIpAddressBeAllocated(allocatableIp, owner);
 
-            if (!ipCanBeAllocated) {
-                throw new InsufficientAddressCapacityException(String.format("Failed to allocate public IP address [%s] as it is in quarantine.", ipAddress.getAddress()),
-                        DataCenter.class, dcId);
+            if (!isPublicIpAllocatable) {
+                throw new InsufficientAddressCapacityException(String.format("Failed to allocate public IP [%s] as it is in quarantine.", allocatableIp.getAddress()), DataCenter.class, dcId);
             }
         }
 
@@ -1026,12 +1042,12 @@ public List<IPAddressVO> listAvailablePublicIps(final long dcId, final Long podI
             try {
                 _resourceLimitMgr.checkResourceLimit(owner, ResourceType.public_ip);
             } catch (ResourceAllocationException ex) {
-                logger.warn("Failed to allocate resource of type " + ex.getResourceType() + " for account " + owner);
+                logger.warn("Failed to allocate resource of type {} for account {}", ex.getResourceType(), owner);
                 throw new AccountLimitException("Maximum number of public IP addresses for account: " + owner.getAccountName() + " has been exceeded.");
             }
         }
 
-        return addrs;
+        return addresses;
     }
 
     @DB
@@ -2458,26 +2474,27 @@ public boolean canPublicIpAddressBeAllocated(IpAddress ip, Account newOwner) {
         PublicIpQuarantineVO publicIpQuarantineVO = publicIpQuarantineDao.findByPublicIpAddressId(ip.getId());
 
         if (publicIpQuarantineVO == null) {
-            logger.debug(String.format("Public IP address [%s] is not in quarantine; therefore, it is allowed to be allocated.", ip));
+            logger.debug("Public IP address [{}] is not in quarantine; therefore, it is allowed to be allocated.", ip);
             return true;
         }
 
         if (!isPublicIpAddressStillInQuarantine(publicIpQuarantineVO, new Date())) {
-            logger.debug(String.format("Public IP address [%s] is no longer in quarantine; therefore, it is allowed to be allocated.", ip));
+            logger.debug("Public IP address [{}] is no longer in quarantine; therefore, it is allowed to be allocated.", ip);
+            removePublicIpAddressFromQuarantine(publicIpQuarantineVO.getId(), "IP was removed from quarantine because it was no longer in quarantine.");
             return true;
         }
 
         Account previousOwner = _accountMgr.getAccount(publicIpQuarantineVO.getPreviousOwnerId());
 
         if (Objects.equals(previousOwner.getUuid(), newOwner.getUuid())) {
-            logger.debug(String.format("Public IP address [%s] is in quarantine; however, the Public IP previous owner [%s] is the same as the new owner [%s]; therefore the IP" +
-                    " can be allocated. The public IP address will be removed from quarantine.", ip, previousOwner, newOwner));
+            logger.debug("Public IP address [{}] is in quarantine; however, the Public IP previous owner [{}] is the same as the new owner [{}]; therefore the IP" +
+                    " can be allocated. The public IP address will be removed from quarantine.", ip, previousOwner, newOwner);
             removePublicIpAddressFromQuarantine(publicIpQuarantineVO.getId(), "IP was removed from quarantine because it has been allocated by the previous owner");
             return true;
         }
 
-        logger.error(String.format("Public IP address [%s] is in quarantine and the previous owner [%s] is different than the new owner [%s]; therefore, the IP cannot be " +
-                "allocated.", ip, previousOwner, newOwner));
+        logger.error("Public IP address [{}] is in quarantine and the previous owner [{}] is different than the new owner [{}]; therefore, the IP cannot be " +
+                "allocated.", ip, previousOwner, newOwner);
         return false;
     }
 
@@ -2528,7 +2545,7 @@ public void removePublicIpAddressFromQuarantine(Long quarantineProcessId, String
         publicIpQuarantineVO.setRemovalReason(removalReason);
         publicIpQuarantineVO.setRemoverAccountId(removerAccountId);
 
-        logger.debug(String.format("Removing public IP Address [%s] from quarantine by updating the removed date to [%s].", ipAddress, removedDate));
+        logger.debug("Removing public IP Address [{}] from quarantine by updating the removed date to [{}].", ipAddress, removedDate);
         publicIpQuarantineDao.persist(publicIpQuarantineVO);
     }
 
diff --git a/server/src/test/java/com/cloud/network/IpAddressManagerTest.java b/server/src/test/java/com/cloud/network/IpAddressManagerTest.java
index 824d4ee47019..cf3a886ce99f 100644
--- a/server/src/test/java/com/cloud/network/IpAddressManagerTest.java
+++ b/server/src/test/java/com/cloud/network/IpAddressManagerTest.java
@@ -356,6 +356,7 @@ public void checkIfPublicIpAddressIsNotInQuarantineAndCanBeAllocatedTestIpIsNoLo
         Mockito.when(ipAddressMock.getId()).thenReturn(dummyID);
         Mockito.when(publicIpQuarantineDaoMock.findByPublicIpAddressId(Mockito.anyLong())).thenReturn(publicIpQuarantineVOMock);
         Mockito.doReturn(false).when(ipAddressManager).isPublicIpAddressStillInQuarantine(Mockito.any(PublicIpQuarantineVO.class), Mockito.any(Date.class));
+        Mockito.doNothing().when(ipAddressManager).removePublicIpAddressFromQuarantine(Mockito.anyLong(), Mockito.anyString());
 
         boolean result = ipAddressManager.canPublicIpAddressBeAllocated(ipAddressMock, newOwnerMock);
 
diff --git a/test/integration/smoke/test_quarantined_ips.py b/test/integration/smoke/test_quarantined_ips.py
index 42349fd2a530..2469760da130 100644
--- a/test/integration/smoke/test_quarantined_ips.py
+++ b/test/integration/smoke/test_quarantined_ips.py
@@ -85,7 +85,7 @@ def setUp(self):
                                                                 self.services["root_admin"]["roletype"])
 
         """
-        Set public.ip.address.quarantine.duration to 60 minutes
+        Set public.ip.address.quarantine.duration to 1 minute
         """
         update_configuration_cmd = updateConfiguration.updateConfigurationCmd()
         update_configuration_cmd.name = "public.ip.address.quarantine.duration"
@@ -168,8 +168,7 @@ def test_only_owner_can_allocate_ip_in_quarantine_vpc(self):
                                    zoneid=self.zone.id,
                                    vpcid=root_vpc.id,
                                    ipaddress=ip_address)
-        self.assertIn(f"Failed to allocate public IP address [{ip_address}] as it is in quarantine.",
-                      exception.exception.errorMsg)
+        self.assertIn("errorCode: 533", exception.exception.errorMsg)
 
         # Owner should be able to allocate its IP in quarantine
         public_ip = PublicIPAddress.create(self.domain_admin_apiclient,
@@ -267,8 +266,7 @@ def test_only_owner_can_allocate_ip_in_quarantine_network(self):
                                    zoneid=self.zone.id,
                                    networkid=root_network.id,
                                    ipaddress=ip_address)
-        self.assertIn(f"Failed to allocate public IP address [{ip_address}] as it is in quarantine.",
-                      exception.exception.errorMsg)
+        self.assertIn("errorCode: 533", exception.exception.errorMsg)
 
         # Owner should be able to allocate its IP in quarantine
         public_ip = PublicIPAddress.create(self.domain_admin_apiclient,

From 0b169920f34c815fc169d5a105f330949c8e5259 Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Mon, 27 Apr 2026 09:13:58 +0100
Subject: [PATCH 04/64] make dh group 31 default, support 22-24+31 (#12764)

---
 .../views/network/CreateVpnCustomerGateway.vue   | 16 ++++++++++------
 .../main/java/com/cloud/utils/net/NetUtils.java  |  2 +-
 .../java/com/cloud/utils/net/NetUtilsTest.java   |  4 ++++
 3 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/ui/src/views/network/CreateVpnCustomerGateway.vue b/ui/src/views/network/CreateVpnCustomerGateway.vue
index f71fc4709e8d..bacc04cae311 100644
--- a/ui/src/views/network/CreateVpnCustomerGateway.vue
+++ b/ui/src/views/network/CreateVpnCustomerGateway.vue
@@ -258,9 +258,13 @@ export default {
         'Group 15': 'modp3072',
         'Group 16': 'modp4096',
         'Group 17': 'modp6144',
-        'Group 18': 'modp8192'
+        'Group 18': 'modp8192',
+        'Group 22': 'modp1024s160',
+        'Group 23': 'modp2048s224',
+        'Group 24': 'modp2048s256',
+        'Group 31': 'curve25519'
       },
-      ikeDhGroupInitialValue: 'Group 5(modp1536)',
+      ikeDhGroupInitialValue: 'Group 31(curve25519)',
       isSubmitted: false,
       ikeversion: 'ike'
     }
@@ -275,12 +279,12 @@ export default {
     initForm () {
       this.formRef = ref()
       this.form = reactive({
-        ikeEncryption: 'aes128',
+        ikeEncryption: 'aes256',
         ikeHash: 'sha1',
         ikeversion: 'ike',
-        ikeDh: 'Group 5(modp1536)',
-        espEncryption: 'aes128',
-        espHash: 'sha1',
+        ikeDh: 'Group 31(curve 25519)',
+        espEncryption: 'aes256',
+        espHash: 'sha256',
         perfectForwardSecrecy: 'None',
         ikelifetime: '86400',
         esplifetime: '3600',
diff --git a/utils/src/main/java/com/cloud/utils/net/NetUtils.java b/utils/src/main/java/com/cloud/utils/net/NetUtils.java
index 65878e055e73..d89d9fa2d93c 100644
--- a/utils/src/main/java/com/cloud/utils/net/NetUtils.java
+++ b/utils/src/main/java/com/cloud/utils/net/NetUtils.java
@@ -1265,7 +1265,7 @@ public static boolean isValidS2SVpnPolicy(final String policyType, final String
             if (group == null && policyType.toLowerCase().matches("ike")) {
                 return false; // StrongSwan requires a DH group for the IKE policy
             }
-            if (group != null && !group.matches("modp1024|modp1536|modp2048|modp3072|modp4096|modp6144|modp8192")) {
+            if (group != null && !group.matches("modp1024|modp1536|modp2048|modp3072|modp4096|modp6144|modp8192|modp1024s160|modp2048s224|modp2048s256|curve25519")) {
                 return false;
             }
         }
diff --git a/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java b/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
index 4495a123b07e..5c9d41f90a25 100644
--- a/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
+++ b/utils/src/test/java/com/cloud/utils/net/NetUtilsTest.java
@@ -131,6 +131,10 @@ public void testIsValidS2SVpnPolicy() {
         assertTrue(NetUtils.isValidS2SVpnPolicy("ike", "3des-md5;modp1024"));
         assertTrue(NetUtils.isValidS2SVpnPolicy("ike", "3des-sha1;modp3072,aes128-sha1;modp1536"));
         assertTrue(NetUtils.isValidS2SVpnPolicy("ike", "3des-sha256;modp3072,aes128-sha512;modp1536"));
+        assertTrue(NetUtils.isValidS2SVpnPolicy("ike", "aes256-sha256;modp1024s160"));
+        assertTrue(NetUtils.isValidS2SVpnPolicy("ike", "aes256-sha256;modp2048s224"));
+        assertTrue(NetUtils.isValidS2SVpnPolicy("ike", "aes256-sha256;modp2048s256"));
+        assertTrue(NetUtils.isValidS2SVpnPolicy("ike", "aes256-sha256;curve25519"));
         assertFalse(NetUtils.isValidS2SVpnPolicy("ike", "aes128-sha1"));
         assertFalse(NetUtils.isValidS2SVpnPolicy("ike", "3des-sha1"));
         assertFalse(NetUtils.isValidS2SVpnPolicy("ike", "3des-sha1,aes256-sha1"));

From ffebe8eaa64607e4294ee2d072e53b0347de5e9e Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Mon, 27 Apr 2026 15:38:52 +0530
Subject: [PATCH 05/64] Fix bulk power state query missing VM lifecycle state
 field (#13027)

* Fix bulk power state query missing VM lifecycle state field

The IdsPowerStateSelectSearch partial select did not include the VM
lifecycle state, causing isPowerStateInSyncWithInstanceState to always
return true when state was null. This prevented retry of failed
StopCommands on subsequent ping cycles.

* Add defensive check for instance host ID to prevent NPE

Co-authored-by: Sachin R Doddaguni <s_rudrappadoddagu@apple.com>
Co-authored-by: nvazquez <nicovazquez90@gmail.com>
---
 .../main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java    | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
index a38b6af3aa0b..d8c9b9253c89 100755
--- a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
@@ -358,7 +358,8 @@ protected void init() {
                 IdsPowerStateSelectSearch.entity().getPowerHostId(),
                 IdsPowerStateSelectSearch.entity().getPowerState(),
                 IdsPowerStateSelectSearch.entity().getPowerStateUpdateCount(),
-                IdsPowerStateSelectSearch.entity().getPowerStateUpdateTime());
+                IdsPowerStateSelectSearch.entity().getPowerStateUpdateTime(),
+                IdsPowerStateSelectSearch.entity().getState());
         IdsPowerStateSelectSearch.done();
 
         CountByOfferingId = createSearchBuilder(Integer.class);
@@ -1105,10 +1106,14 @@ public Map<Long, VirtualMachine.PowerState> updatePowerState(
 
     private boolean isPowerStateInSyncWithInstanceState(final VirtualMachine.PowerState powerState, final long powerHostId, final VMInstanceVO instance) {
         State instanceState = instance.getState();
+        if (instanceState == null) {
+            logger.warn("VM {} has null instance state during power state sync check, treating as out of sync", instance);
+            return false;
+        }
         if ((powerState == VirtualMachine.PowerState.PowerOff && instanceState == State.Running)
                 || (powerState == VirtualMachine.PowerState.PowerOn && instanceState == State.Stopped)) {
             HostVO instanceHost = hostDao.findById(instance.getHostId());
-            HostVO powerHost = powerHostId == instance.getHostId() ? instanceHost : hostDao.findById(powerHostId);
+            HostVO powerHost = instance.getHostId() != null && powerHostId == instance.getHostId() ? instanceHost : hostDao.findById(powerHostId);
             logger.debug("VM: {} on host: {} and power host : {} is in {} state, but power state is {}",
                     instance, instanceHost, powerHost, instanceState, powerState);
             return false;

From 92d82989e327470c48d3ad2123a93011c0fb5ae3 Mon Sep 17 00:00:00 2001
From: Gean Jair Silva <89494158+GeanJS@users.noreply.github.com>
Date: Thu, 30 Apr 2026 05:46:26 -0300
Subject: [PATCH 06/64] Correction of the user responsible for the  event
 (#13066)

Co-authored-by: gean.silva <gean.silva@scclouds.com.br>
---
 .../java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
index 9e7c644cf655..fad2da89cf28 100644
--- a/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
+++ b/server/src/main/java/com/cloud/resourcelimit/ResourceLimitManagerImpl.java
@@ -1037,7 +1037,8 @@ public ResourceLimitVO updateResourceLimit(Long accountId, Long domainId, Intege
 
         ResourceLimitVO limit = _resourceLimitDao.findByOwnerIdAndTypeAndTag(ownerId, ownerType, resourceType, tag);
 
-        ActionEventUtils.onActionEvent(caller.getId(), caller.getAccountId(),
+        Long callingUserId = CallContext.current().getCallingUserId();
+        ActionEventUtils.onActionEvent(callingUserId, caller.getAccountId(),
                 caller.getDomainId(), EventTypes.EVENT_RESOURCE_LIMIT_UPDATE,
                 "Resource limit updated. Resource Type: " + resourceType + ", New Value: " + max,
                 ownerResourceId, ownerResourceType.toString());

From 2eef7aa9a272a1346e5caea3c3a84f3f5264afed Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Thu, 30 Apr 2026 13:52:39 +0200
Subject: [PATCH 07/64] adding default deny keys also when there are no other
 keys

---
 .../extensions/manager/ExtensionsManagerImpl.java  | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImpl.java b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImpl.java
index 1422338ddc99..f6fd08b6da2c 100644
--- a/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImpl.java
+++ b/framework/extensions/src/main/java/org/apache/cloudstack/framework/extensions/manager/ExtensionsManagerImpl.java
@@ -1663,14 +1663,14 @@ public Extension getExtensionForCluster(long clusterId) {
     public List<String> getExtensionReservedResourceDetails(long extensionId) {
         ExtensionDetailsVO detailsVO = extensionDetailsDao.findDetail(extensionId,
                 ApiConstants.RESERVED_RESOURCE_DETAILS);
-        if (detailsVO == null || !StringUtils.isNotBlank(detailsVO.getValue())) {
-            return Collections.emptyList();
-        }
         List<String> reservedDetails = new ArrayList<>();
-        String[] parts = detailsVO.getValue().split(",");
-        for (String part : parts) {
-            if (StringUtils.isNotBlank(part)) {
-                reservedDetails.add(part.trim());
+        if (detailsVO != null && StringUtils.isNotBlank(detailsVO.getValue())) {
+            String[] parts = detailsVO.getValue().split(",");
+            for (String part : parts) {
+                String trimmedPart = part.trim();
+                if (StringUtils.isNotBlank(trimmedPart)) {
+                    reservedDetails.add(trimmedPart);
+                }
             }
         }
         addInbuiltExtensionReservedResourceDetails(extensionId, reservedDetails);

From c45596cca3ec5d3c98fd3bdc1fb3bca53a3352a1 Mon Sep 17 00:00:00 2001
From: Bryan Lima <42067040+BryanMLima@users.noreply.github.com>
Date: Thu, 30 Apr 2026 15:30:02 +0200
Subject: [PATCH 08/64] Refactor of Allocator classes (#9074)

* Refactoring Allocator classes

* Break into smaller methods random and firfit allocators.

* Added unit tests for random and firstfit allocators

* Move random allocator from cloud-plugins to cloud-server

* Add BaseAllocator abstract class for duplicate code

* Add missing license

* Add missing license to unit test file

* Remove host allocator random dependency

* Change exception message on smoke tests

* Remove conditional as it was never actually reached in the original flow

* Fix tests

* Fix flipped parameters

* Fix NPE while listing hosts for migration when suitableHosts is null

* Remove unnecessary stubbings

* Fix checkstyle

* Remove unnecessary file

* Rename exception error messages

* Apply suggestions from code review

Co-authored-by: Fabricio Duarte <fabricio.duarte.jr@gmail.com>

* Rename UserVmDetailVO references to VMInstanceDetailVO

* Remove unused imports

* Add new line at EOF

* Remove unnecessary random allocator pom

* Fix GPU allocation mistake

* Fix failing tests

---------

Co-authored-by: Fabricio Duarte <fabricio.duarte@scclouds.com.br>
Co-authored-by: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
---
 .../manager/allocator/HostAllocator.java      |  33 -
 .../com/cloud/deploy/DeploymentPlanner.java   |   2 +-
 .../admin/host/FindHostsForMigrationCmd.java  |   2 +-
 .../api/command/admin/host/ListHostsCmd.java  |   2 +-
 client/pom.xml                                |   5 -
 .../com/cloud/vm/VirtualMachineManager.java   |   9 -
 .../cloud/vm/VirtualMachineManagerImpl.java   |  18 -
 .../main/java/com/cloud/host/dao/HostDao.java |   2 +-
 .../java/com/cloud/host/dao/HostDaoImpl.java  |   4 +-
 plugins/host-allocators/random/pom.xml        |  30 -
 .../allocator/impl/RandomAllocator.java       | 196 -----
 .../host-allocator-random/module.properties   |  18 -
 .../spring-host-allocator-random-context.xml  |  34 -
 .../allocator/impl/RandomAllocatorTest.java   |  80 --
 plugins/pom.xml                               |   2 -
 .../manager/allocator/impl/BaseAllocator.java |  90 +++
 .../allocator/impl/FirstFitAllocator.java     | 546 +++++--------
 .../allocator/impl/RandomAllocator.java       | 132 +++
 .../allocator/impl/TestingAllocator.java      |  21 +-
 .../deploy/DeploymentPlanningManagerImpl.java |  22 +-
 .../cloud/server/ManagementServerImpl.java    |  10 +-
 .../spring-server-allocator-context.xml       |   3 +
 .../allocator/impl/BaseAllocatorTest.java     | 219 +++++
 .../allocator/impl/FirstFitAllocatorTest.java | 760 +++++++++++++-----
 .../allocator/impl/RandomAllocatorTest.java   | 332 ++++++++
 .../smoke/test_vm_strict_host_tags.py         |   2 +-
 26 files changed, 1593 insertions(+), 981 deletions(-)
 delete mode 100644 plugins/host-allocators/random/pom.xml
 delete mode 100644 plugins/host-allocators/random/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
 delete mode 100644 plugins/host-allocators/random/src/main/resources/META-INF/cloudstack/host-allocator-random/module.properties
 delete mode 100644 plugins/host-allocators/random/src/main/resources/META-INF/cloudstack/host-allocator-random/spring-host-allocator-random-context.xml
 delete mode 100644 plugins/host-allocators/random/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
 create mode 100644 server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java
 create mode 100644 server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
 create mode 100644 server/src/test/java/com/cloud/agent/manager/allocator/impl/BaseAllocatorTest.java
 create mode 100644 server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java

diff --git a/api/src/main/java/com/cloud/agent/manager/allocator/HostAllocator.java b/api/src/main/java/com/cloud/agent/manager/allocator/HostAllocator.java
index 604720aaa290..5d028d31d5b6 100644
--- a/api/src/main/java/com/cloud/agent/manager/allocator/HostAllocator.java
+++ b/api/src/main/java/com/cloud/agent/manager/allocator/HostAllocator.java
@@ -22,19 +22,11 @@
 import com.cloud.deploy.DeploymentPlanner.ExcludeList;
 import com.cloud.host.Host;
 import com.cloud.host.Host.Type;
-import com.cloud.offering.ServiceOffering;
 import com.cloud.utils.component.Adapter;
-import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineProfile;
 
 public interface HostAllocator extends Adapter {
 
-    /**
-     * @param UserVm vm
-     * @param ServiceOffering offering
-     **/
-    boolean isVirtualMachineUpgradable(final VirtualMachine vm, final ServiceOffering offering);
-
     /**
     * Determines which physical hosts are suitable to
     * allocate the guest virtual machines on
@@ -49,31 +41,6 @@ public interface HostAllocator extends Adapter {
 
     public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, int returnUpTo);
 
-    /**
-     * Determines which physical hosts are suitable to allocate the guest
-     * virtual machines on
-     *
-     * Allocators must set any other hosts not considered for allocation in the
-     * ExcludeList avoid. Thus the avoid set and the list of hosts suitable,
-     * together must cover the entire host set in the cluster.
-     *
-     * @param VirtualMachineProfile
-     *            vmProfile
-     * @param DeploymentPlan
-     *            plan
-     * @param GuestType
-     *            type
-     * @param ExcludeList
-     *            avoid
-     * @param int returnUpTo (use -1 to return all possible hosts)
-     * @param boolean considerReservedCapacity (default should be true, set to
-     *        false if host capacity calculation should not look at reserved
-     *        capacity)
-     * @return List<Host> List of hosts that are suitable for VM allocation
-     **/
-
-    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, int returnUpTo, boolean considerReservedCapacity);
-
     /**
      * Determines which physical hosts are suitable to allocate the guest
      * virtual machines on
diff --git a/api/src/main/java/com/cloud/deploy/DeploymentPlanner.java b/api/src/main/java/com/cloud/deploy/DeploymentPlanner.java
index 8f7e773070f0..22d796d4a775 100644
--- a/api/src/main/java/com/cloud/deploy/DeploymentPlanner.java
+++ b/api/src/main/java/com/cloud/deploy/DeploymentPlanner.java
@@ -70,7 +70,7 @@ public interface DeploymentPlanner extends Adapter {
     boolean canHandle(VirtualMachineProfile vm, DeploymentPlan plan, ExcludeList avoid);
 
     public enum AllocationAlgorithm {
-        random, firstfit, userdispersing;
+        random, firstfit, userdispersing, firstfitleastconsumed;
     }
 
     public enum PlannerResourceUsage {
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/FindHostsForMigrationCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/FindHostsForMigrationCmd.java
index abca619f82a7..4d6ef7419616 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/FindHostsForMigrationCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/FindHostsForMigrationCmd.java
@@ -78,7 +78,7 @@ public void execute() {
         for (Host host : result.first()) {
             HostForMigrationResponse hostResponse = _responseGenerator.createHostForMigrationResponse(host);
             Boolean suitableForMigration = false;
-            if (hostsWithCapacity.contains(host)) {
+            if (hostsWithCapacity != null && hostsWithCapacity.contains(host)) {
                 suitableForMigration = true;
             }
             hostResponse.setSuitableForMigration(suitableForMigration);
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/ListHostsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/ListHostsCmd.java
index e202dfad77ba..8f5e6c784d6e 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/ListHostsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/ListHostsCmd.java
@@ -252,7 +252,7 @@ protected ListResponse<HostResponse> getHostResponses() {
             for (Host host : result.first()) {
                 HostResponse hostResponse = _responseGenerator.createHostResponse(host, getDetails());
                 Boolean suitableForMigration = false;
-                if (hostsWithCapacity.contains(host)) {
+                if (hostsWithCapacity != null && hostsWithCapacity.contains(host)) {
                     suitableForMigration = true;
                 }
                 hostResponse.setSuitableForMigration(suitableForMigration);
diff --git a/client/pom.xml b/client/pom.xml
index 7118f455ab5f..55123de0f98e 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -377,11 +377,6 @@
             <artifactId>cloud-plugin-explicit-dedication</artifactId>
             <version>${project.version}</version>
         </dependency>
-        <dependency>
-            <groupId>org.apache.cloudstack</groupId>
-            <artifactId>cloud-plugin-host-allocator-random</artifactId>
-            <version>${project.version}</version>
-        </dependency>
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-plugin-outofbandmanagement-driver-ipmitool</artifactId>
diff --git a/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java b/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java
index 57dc1b7bf728..e871bd8672ff 100644
--- a/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java
+++ b/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java
@@ -181,15 +181,6 @@ void orchestrateStart(String vmUuid, Map<VirtualMachineProfile.Param, Object> pa
     void advanceReboot(String vmUuid, Map<VirtualMachineProfile.Param, Object> params) throws InsufficientCapacityException, ResourceUnavailableException,
         ConcurrentOperationException, OperationTimedoutException;
 
-    /**
-     * Check to see if a virtual machine can be upgraded to the given service offering
-     *
-     * @param vm
-     * @param offering
-     * @return true if the host can handle the upgrade, false otherwise
-     */
-    boolean isVirtualMachineUpgradable(final VirtualMachine vm, final ServiceOffering offering);
-
     VirtualMachine findById(long vmId);
 
     void storageMigration(String vmUuid, Map<Long, Long> volumeToPool);
diff --git a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
index 71ecc73f325f..17ddf8706702 100755
--- a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
+++ b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
@@ -4017,19 +4017,6 @@ protected void runInContext() {
         }
     }
 
-    @Override
-    public boolean isVirtualMachineUpgradable(final VirtualMachine vm, final ServiceOffering offering) {
-        boolean isMachineUpgradable = true;
-        for (final HostAllocator allocator : hostAllocators) {
-            isMachineUpgradable = allocator.isVirtualMachineUpgradable(vm, offering);
-            if (!isMachineUpgradable) {
-                break;
-            }
-        }
-
-        return isMachineUpgradable;
-    }
-
     @Override
     public void reboot(final String vmUuid, final Map<VirtualMachineProfile.Param, Object> params) throws InsufficientCapacityException, ResourceUnavailableException {
         try {
@@ -4469,11 +4456,6 @@ public void checkIfCanUpgrade(final VirtualMachine vmInstance, final ServiceOffe
             throw new InvalidParameterValueException("isSystem property is different for current service offering and new service offering");
         }
 
-        if (!isVirtualMachineUpgradable(vmInstance, newServiceOffering)) {
-            throw new InvalidParameterValueException("Unable to upgrade virtual machine, not enough resources available " + "for an offering of " +
-                    newServiceOffering.getCpu() + " cpu(s) at " + newServiceOffering.getSpeed() + " Mhz, and " + newServiceOffering.getRamSize() + " MB of memory");
-        }
-
         final List<String> currentTags = StringUtils.csvTagsToList(currentDiskOffering.getTags());
         final List<String> newTags = StringUtils.csvTagsToList(newDiskOffering.getTags());
         if (VolumeApiServiceImpl.MatchStoragePoolTagsWithDiskOffering.valueIn(vmInstance.getDataCenterId())) {
diff --git a/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java b/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
index 090b019334f4..5f5b2affee08 100644
--- a/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
+++ b/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
@@ -218,7 +218,7 @@ int countHostsByMsResourceStateTypeAndHypervisorType(long msId, List<ResourceSta
      */
     List<String> listOrderedHostsHypervisorVersionsInDatacenter(long datacenterId, HypervisorType hypervisorType);
 
-    List<HostVO> findHostsWithTagRuleThatMatchComputeOferringTags(String computeOfferingTags);
+    List<HostVO> findHostsWithTagRuleThatMatchComputeOfferingTags(String computeOfferingTags);
 
     List<Long> findClustersThatMatchHostTagRule(String computeOfferingTags);
 
diff --git a/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java b/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
index 2d8fcca6cdb7..99c9a979c3bf 100644
--- a/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
@@ -1520,7 +1520,7 @@ private List<Long> findHostIdsByHostTags(String hostTags){
         }
     }
 
-    public List<HostVO> findHostsWithTagRuleThatMatchComputeOferringTags(String computeOfferingTags) {
+    public List<HostVO> findHostsWithTagRuleThatMatchComputeOfferingTags(String computeOfferingTags) {
         List<HostTagVO> hostTagVOList = _hostTagsDao.findHostRuleTags();
         List<HostVO> result = new ArrayList<>();
         for (HostTagVO rule: hostTagVOList) {
@@ -1534,7 +1534,7 @@ public List<HostVO> findHostsWithTagRuleThatMatchComputeOferringTags(String comp
 
     public List<Long> findClustersThatMatchHostTagRule(String computeOfferingTags) {
         Set<Long> result = new HashSet<>();
-        List<HostVO> hosts = findHostsWithTagRuleThatMatchComputeOferringTags(computeOfferingTags);
+        List<HostVO> hosts = findHostsWithTagRuleThatMatchComputeOfferingTags(computeOfferingTags);
         for (HostVO host: hosts) {
             result.add(host.getClusterId());
         }
diff --git a/plugins/host-allocators/random/pom.xml b/plugins/host-allocators/random/pom.xml
deleted file mode 100644
index 061caf1573ff..000000000000
--- a/plugins/host-allocators/random/pom.xml
+++ /dev/null
@@ -1,30 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one
-  or more contributor license agreements.  See the NOTICE file
-  distributed with this work for additional information
-  regarding copyright ownership.  The ASF licenses this file
-  to you under the Apache License, Version 2.0 (the
-  "License"); you may not use this file except in compliance
-  with the License.  You may obtain a copy of the License at
-
-    http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing,
-  software distributed under the License is distributed on an
-  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-  KIND, either express or implied.  See the License for the
-  specific language governing permissions and limitations
-  under the License.
--->
-<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-    xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-    <modelVersion>4.0.0</modelVersion>
-    <artifactId>cloud-plugin-host-allocator-random</artifactId>
-    <name>Apache CloudStack Plugin - Host Allocator Random</name>
-    <parent>
-        <groupId>org.apache.cloudstack</groupId>
-        <artifactId>cloudstack-plugins</artifactId>
-        <version>4.23.0.0-SNAPSHOT</version>
-        <relativePath>../../pom.xml</relativePath>
-    </parent>
-</project>
diff --git a/plugins/host-allocators/random/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java b/plugins/host-allocators/random/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
deleted file mode 100644
index 42129944a194..000000000000
--- a/plugins/host-allocators/random/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
+++ /dev/null
@@ -1,196 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements.  See the NOTICE file
-// distributed with this work for additional information
-// regarding copyright ownership.  The ASF licenses this file
-// to you under the Apache License, Version 2.0 (the
-// "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-package com.cloud.agent.manager.allocator.impl;
-
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.List;
-
-import javax.inject.Inject;
-
-import org.apache.commons.collections.CollectionUtils;
-import org.apache.commons.collections.ListUtils;
-import org.apache.commons.lang3.ObjectUtils;
-import org.apache.commons.lang3.StringUtils;
-import org.springframework.stereotype.Component;
-
-import com.cloud.agent.manager.allocator.HostAllocator;
-import com.cloud.capacity.CapacityManager;
-import com.cloud.dc.ClusterDetailsDao;
-import com.cloud.dc.dao.ClusterDao;
-import com.cloud.deploy.DeploymentPlan;
-import com.cloud.deploy.DeploymentPlanner.ExcludeList;
-import com.cloud.host.Host;
-import com.cloud.host.Host.Type;
-import com.cloud.host.HostVO;
-import com.cloud.host.dao.HostDao;
-import com.cloud.offering.ServiceOffering;
-import com.cloud.resource.ResourceManager;
-import com.cloud.storage.VMTemplateVO;
-import com.cloud.utils.Pair;
-import com.cloud.utils.component.AdapterBase;
-import com.cloud.vm.VirtualMachine;
-import com.cloud.vm.VirtualMachineProfile;
-
-@Component
-public class RandomAllocator extends AdapterBase implements HostAllocator {
-    @Inject
-    private HostDao _hostDao;
-    @Inject
-    private ResourceManager _resourceMgr;
-    @Inject
-    private ClusterDao clusterDao;
-    @Inject
-    private ClusterDetailsDao clusterDetailsDao;
-    @Inject
-    private CapacityManager capacityManager;
-
-    protected List<HostVO> listHostsByTags(Host.Type type, long dcId, Long podId, Long clusterId, String offeringHostTag, String templateTag) {
-        List<HostVO> taggedHosts = new ArrayList<>();
-        if (offeringHostTag != null) {
-            taggedHosts.addAll(_hostDao.listByHostTag(type, clusterId, podId, dcId, offeringHostTag));
-        }
-        if (templateTag != null) {
-            List<HostVO> templateTaggedHosts = _hostDao.listByHostTag(type, clusterId, podId, dcId, templateTag);
-            if (taggedHosts.isEmpty()) {
-                taggedHosts = templateTaggedHosts;
-            } else {
-                taggedHosts.retainAll(templateTaggedHosts);
-            }
-        }
-        if (logger.isDebugEnabled()) {
-            logger.debug(String.format("Found %d hosts %s with type: %s, zone ID: %d, pod ID: %d, cluster ID: %s, offering host tag(s): %s, template tag: %s",
-                    taggedHosts.size(),
-                    (taggedHosts.isEmpty() ? "" : String.format("(%s)", StringUtils.join(taggedHosts.stream().map(HostVO::toString).toArray(), ","))),
-                    type.name(), dcId, podId, clusterId, offeringHostTag, templateTag));
-        }
-        return taggedHosts;
-    }
-    private List<Host> findSuitableHosts(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type,
-                                         ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
-                                         boolean considerReservedCapacity) {
-        long dcId = plan.getDataCenterId();
-        Long podId = plan.getPodId();
-        Long clusterId = plan.getClusterId();
-        ServiceOffering offering = vmProfile.getServiceOffering();
-        List<? extends Host> hostsCopy = null;
-        List<Host> suitableHosts = new ArrayList<>();
-
-        if (type == Host.Type.Storage) {
-            return suitableHosts;
-        }
-        String offeringHostTag = offering.getHostTag();
-
-        VMTemplateVO template = (VMTemplateVO)vmProfile.getTemplate();
-        String templateTag = template.getTemplateTag();
-        String hostTag = null;
-        if (ObjectUtils.anyNotNull(offeringHostTag, templateTag)) {
-            hostTag = ObjectUtils.allNotNull(offeringHostTag, templateTag) ?
-                    String.format("%s, %s", offeringHostTag, templateTag) :
-                    ObjectUtils.firstNonNull(offeringHostTag, templateTag);
-            logger.debug("Looking for hosts in dc [{}], pod [{}], cluster [{}] and complying with host tag(s): [{}]", dcId, podId, clusterId, hostTag);
-        } else {
-            logger.debug("Looking for hosts in dc: {} pod: {} cluster: {}", dcId , podId, clusterId);
-        }
-        if (hosts != null) {
-            // retain all computing hosts, regardless of whether they support routing...it's random after all
-            hostsCopy = new ArrayList<>(hosts);
-            if (ObjectUtils.anyNotNull(offeringHostTag, templateTag)) {
-                hostsCopy.retainAll(listHostsByTags(type, dcId, podId, clusterId, offeringHostTag, templateTag));
-            } else {
-                hostsCopy.retainAll(_hostDao.listAllHostsThatHaveNoRuleTag(type, clusterId, podId, dcId));
-            }
-        } else {
-            // list all computing hosts, regardless of whether they support routing...it's random after all
-            if (offeringHostTag != null) {
-                hostsCopy = listHostsByTags(type, dcId, podId, clusterId, offeringHostTag, templateTag);
-            } else {
-                hostsCopy = _hostDao.listAllHostsThatHaveNoRuleTag(type, clusterId, podId, dcId);
-            }
-        }
-        hostsCopy = ListUtils.union(hostsCopy, _hostDao.findHostsWithTagRuleThatMatchComputeOferringTags(offeringHostTag));
-
-        if (hostsCopy.isEmpty()) {
-            logger.info("No suitable host found for VM [{}] in {}.", vmProfile, hostTag);
-            return null;
-        }
-
-        logger.debug("Random Allocator found {} hosts", hostsCopy.size());
-        if (hostsCopy.isEmpty()) {
-            return suitableHosts;
-        }
-
-        Collections.shuffle(hostsCopy);
-        for (Host host : hostsCopy) {
-            if (suitableHosts.size() == returnUpTo) {
-                break;
-            }
-            if (avoid.shouldAvoid(host)) {
-                if (logger.isDebugEnabled()) {
-                    logger.debug(String.format("Host %s is in avoid set, skipping this and trying other available hosts", host));
-                }
-                continue;
-            }
-            Pair<Boolean, Boolean> cpuCapabilityAndCapacity = capacityManager.checkIfHostHasCpuCapabilityAndCapacity(host, offering, considerReservedCapacity);
-            if (!cpuCapabilityAndCapacity.first() || !cpuCapabilityAndCapacity.second()) {
-                if (logger.isDebugEnabled()) {
-                    logger.debug(String.format("Not using host %s; host has cpu capability? %s, host has capacity? %s", host, cpuCapabilityAndCapacity.first(), cpuCapabilityAndCapacity.second()));
-                }
-                continue;
-            }
-            if (logger.isDebugEnabled()) {
-                logger.debug(String.format("Found a suitable host, adding to list: %s", host));
-            }
-            suitableHosts.add(host);
-        }
-        if (logger.isDebugEnabled()) {
-            logger.debug("Random Host Allocator returning " + suitableHosts.size() + " suitable hosts");
-        }
-        return suitableHosts;
-    }
-
-    @Override
-    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, int returnUpTo) {
-        return allocateTo(vmProfile, plan, type, avoid, returnUpTo, true);
-    }
-
-    @Override
-    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type,
-                                 ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
-                                 boolean considerReservedCapacity) {
-        if (CollectionUtils.isEmpty(hosts)) {
-            if (logger.isDebugEnabled()) {
-                logger.debug("Random Allocator found 0 hosts as given host list is empty");
-            }
-            return new ArrayList<>();
-        }
-        return findSuitableHosts(vmProfile, plan, type, avoid, hosts, returnUpTo, considerReservedCapacity);
-    }
-
-    @Override
-    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan,
-                                 Type type, ExcludeList avoid, int returnUpTo, boolean considerReservedCapacity) {
-        return findSuitableHosts(vmProfile, plan, type, avoid, null, returnUpTo, considerReservedCapacity);
-    }
-
-    @Override
-    public boolean isVirtualMachineUpgradable(VirtualMachine vm, ServiceOffering offering) {
-        // currently we do no special checks to rule out a VM being upgradable to an offering, so
-        // return true
-        return true;
-    }
-}
diff --git a/plugins/host-allocators/random/src/main/resources/META-INF/cloudstack/host-allocator-random/module.properties b/plugins/host-allocators/random/src/main/resources/META-INF/cloudstack/host-allocator-random/module.properties
deleted file mode 100644
index dcfe8d3537ff..000000000000
--- a/plugins/host-allocators/random/src/main/resources/META-INF/cloudstack/host-allocator-random/module.properties
+++ /dev/null
@@ -1,18 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-name=host-allocator-random
-parent=allocator
diff --git a/plugins/host-allocators/random/src/main/resources/META-INF/cloudstack/host-allocator-random/spring-host-allocator-random-context.xml b/plugins/host-allocators/random/src/main/resources/META-INF/cloudstack/host-allocator-random/spring-host-allocator-random-context.xml
deleted file mode 100644
index d84eaafaa5a7..000000000000
--- a/plugins/host-allocators/random/src/main/resources/META-INF/cloudstack/host-allocator-random/spring-host-allocator-random-context.xml
+++ /dev/null
@@ -1,34 +0,0 @@
-<!--
-  Licensed to the Apache Software Foundation (ASF) under one
-  or more contributor license agreements. See the NOTICE file
-  distributed with this work for additional information
-  regarding copyright ownership. The ASF licenses this file
-  to you under the Apache License, Version 2.0 (the
-  "License"); you may not use this file except in compliance
-  with the License. You may obtain a copy of the License at
-
-  http://www.apache.org/licenses/LICENSE-2.0
-
-  Unless required by applicable law or agreed to in writing,
-  software distributed under the License is distributed on an
-  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-  KIND, either express or implied. See the License for the
-  specific language governing permissions and limitations
-  under the License.
--->
-<beans xmlns="http://www.springframework.org/schema/beans"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xmlns:context="http://www.springframework.org/schema/context"
-       xmlns:aop="http://www.springframework.org/schema/aop"
-       xsi:schemaLocation="http://www.springframework.org/schema/beans
-                      http://www.springframework.org/schema/beans/spring-beans.xsd
-                      http://www.springframework.org/schema/aop http://www.springframework.org/schema/aop/spring-aop.xsd
-                      http://www.springframework.org/schema/context
-                      http://www.springframework.org/schema/context/spring-context.xsd"
-                      >
-
-    <bean id="randomAllocator"
-        class="com.cloud.agent.manager.allocator.impl.RandomAllocator" />
-
-
-</beans>
diff --git a/plugins/host-allocators/random/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java b/plugins/host-allocators/random/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
deleted file mode 100644
index 538d7157184a..000000000000
--- a/plugins/host-allocators/random/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
+++ /dev/null
@@ -1,80 +0,0 @@
-// Licensed to the Apache Software Foundation (ASF) under one
-// or more contributor license agreements.  See the NOTICE file
-// distributed with this work for additional information
-// regarding copyright ownership.  The ASF licenses this file
-// to you under the Apache License, Version 2.0 (the
-// "License"); you may not use this file except in compliance
-// with the License.  You may obtain a copy of the License at
-//
-//   http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing,
-// software distributed under the License is distributed on an
-// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-// KIND, either express or implied.  See the License for the
-// specific language governing permissions and limitations
-// under the License.
-package com.cloud.agent.manager.allocator.impl;
-
-import java.util.ArrayList;
-import java.util.List;
-
-import org.apache.commons.collections.CollectionUtils;
-import org.junit.Assert;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.Mockito;
-import org.mockito.junit.MockitoJUnitRunner;
-
-import com.cloud.host.Host;
-import com.cloud.host.HostVO;
-import com.cloud.host.dao.HostDao;
-
-@RunWith(MockitoJUnitRunner.class)
-public class RandomAllocatorTest {
-
-    @Mock
-    HostDao hostDao;
-    @InjectMocks
-    RandomAllocator randomAllocator;
-
-    @Test
-    public void testListHostsByTags() {
-        Host.Type type = Host.Type.Routing;
-        Long id = 1L;
-        String templateTag = "tag1";
-        String offeringTag = "tag2";
-        HostVO host1 = Mockito.mock(HostVO.class);
-        HostVO host2 = Mockito.mock(HostVO.class);
-        Mockito.when(hostDao.listByHostTag(type, id, id, id, offeringTag)).thenReturn(List.of(host1, host2));
-
-        // No template tagged host
-        Mockito.when(hostDao.listByHostTag(type, id, id, id, templateTag)).thenReturn(new ArrayList<>());
-        List<HostVO> result = randomAllocator.listHostsByTags(type, id, id, id, offeringTag, templateTag);
-        Assert.assertTrue(CollectionUtils.isEmpty(result));
-
-        // Different template tagged host
-        HostVO host3 = Mockito.mock(HostVO.class);
-        Mockito.when(hostDao.listByHostTag(type, id, id, id, templateTag)).thenReturn(List.of(host3));
-        result = randomAllocator.listHostsByTags(type, id, id, id, offeringTag, templateTag);
-        Assert.assertTrue(CollectionUtils.isEmpty(result));
-
-        // Matching template tagged host
-        Mockito.when(hostDao.listByHostTag(type, id, id, id, templateTag)).thenReturn(List.of(host1));
-        result = randomAllocator.listHostsByTags(type, id, id, id, offeringTag, templateTag);
-        Assert.assertFalse(CollectionUtils.isEmpty(result));
-        Assert.assertEquals(1, result.size());
-
-        // No template tag
-        result = randomAllocator.listHostsByTags(type, id, id, id, offeringTag, null);
-        Assert.assertFalse(CollectionUtils.isEmpty(result));
-        Assert.assertEquals(2, result.size());
-
-        // No offering tag
-        result = randomAllocator.listHostsByTags(type, id, id, id, null, templateTag);
-        Assert.assertFalse(CollectionUtils.isEmpty(result));
-        Assert.assertEquals(1, result.size());
-    }
-}
diff --git a/plugins/pom.xml b/plugins/pom.xml
index e4904ccdf40b..3262404032fa 100755
--- a/plugins/pom.xml
+++ b/plugins/pom.xml
@@ -84,8 +84,6 @@
 
         <module>ha-planners/skip-heurestics</module>
 
-        <module>host-allocators/random</module>
-
         <module>hypervisors/baremetal</module>
         <module>hypervisors/external</module>
         <module>hypervisors/hyperv</module>
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java
new file mode 100644
index 000000000000..58fcc62cdc31
--- /dev/null
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java
@@ -0,0 +1,90 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.manager.allocator.impl;
+
+import com.cloud.agent.manager.allocator.HostAllocator;
+import com.cloud.capacity.CapacityManager;
+import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
+import com.cloud.offering.ServiceOffering;
+import com.cloud.utils.Pair;
+import com.cloud.utils.component.AdapterBase;
+import org.apache.commons.collections.CollectionUtils;
+
+import javax.inject.Inject;
+import java.util.List;
+
+public abstract class BaseAllocator extends AdapterBase implements HostAllocator {
+
+    @Inject
+    protected HostDao hostDao;
+
+    @Inject
+    protected CapacityManager capacityManager;
+
+    protected void retainHostsMatchingServiceOfferingAndTemplateTags(List<HostVO> availableHosts, Host.Type type, long dcId, Long podId, Long clusterId, String offeringHostTag, String templateTag) {
+        logger.debug("Hosts {} will be checked for template and host tags compatibility.", availableHosts);
+
+        if (offeringHostTag != null) {
+            logger.debug("Looking for hosts having the tag [{}] specified in the Service Offering.", offeringHostTag);
+            List<HostVO> hostsWithHostTag = hostDao.listByHostTag(type, clusterId, podId, dcId, offeringHostTag);
+            logger.debug("Retaining hosts {} because they match the offering host tag {}.", hostsWithHostTag, offeringHostTag);
+            availableHosts.retainAll(hostsWithHostTag);
+        }
+
+        if (templateTag != null) {
+            logger.debug("Looking for hosts having the tag [{}] specified in the Template.", templateTag);
+            List<HostVO> hostsWithTemplateTag = hostDao.listByHostTag(type, clusterId, podId, dcId, templateTag);
+            logger.debug("Retaining hosts {} because they match the template tag {}.", hostsWithTemplateTag, templateTag);
+            availableHosts.retainAll(hostsWithTemplateTag);
+        }
+
+        logger.debug("Remaining hosts after template tag and host tags validations are {}.", availableHosts);
+    }
+
+    protected void addHostsBasedOnTagRules(String hostTagOnOffering, List<HostVO> clusterHosts) {
+        List<HostVO> hostsWithTagRules = hostDao.findHostsWithTagRuleThatMatchComputeOfferingTags(hostTagOnOffering);
+
+        if (CollectionUtils.isEmpty(hostsWithTagRules)) {
+            logger.info("No hosts found with tag rules matching the compute offering tag [{}].", hostTagOnOffering);
+            return;
+        }
+
+        logger.info("Found hosts {} with tag rules matching the compute offering tag [{}].", hostsWithTagRules, hostTagOnOffering);
+        clusterHosts.addAll(hostsWithTagRules);
+    }
+
+    /**
+     * Adds hosts with enough CPU capability and enough CPU capacity to the suitable hosts list.
+     */
+    protected boolean hostHasCpuCapabilityAndCapacity(boolean considerReservedCapacity, ServiceOffering offering, Host host) {
+        logger.debug("Looking for CPU frequency {} MHz and RAM {} MB.", () -> offering.getCpu() * offering.getSpeed(), offering::getRamSize);
+        Pair<Boolean, Boolean> cpuCapabilityAndCapacity = capacityManager.checkIfHostHasCpuCapabilityAndCapacity(host, offering, considerReservedCapacity);
+        Boolean hasCpuCapability = cpuCapabilityAndCapacity.first();
+        Boolean hasCpuCapacity = cpuCapabilityAndCapacity.second();
+
+        if (hasCpuCapability && hasCpuCapacity) {
+            logger.debug("Host {} is a suitable host as it has enough CPU capability and CPU capacity.", () -> host);
+            return true;
+        }
+
+        logger.debug("Cannot use host {}. Does the host have CPU capability? {}. Does the host have CPU capacity? {}..", () -> host, () -> hasCpuCapability, () -> hasCpuCapacity);
+        return false;
+    }
+
+}
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java
index 1110804959ea..8b4ca318bf78 100644
--- a/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java
@@ -16,36 +16,17 @@
 // under the License.
 package com.cloud.agent.manager.allocator.impl;
 
-import java.text.DecimalFormat;
-import java.util.ArrayList;
-import java.util.Collections;
-import java.util.Comparator;
-import java.util.HashMap;
-import java.util.LinkedHashMap;
-import java.util.List;
-import java.util.Map;
-import java.util.stream.Collectors;
+import static com.cloud.deploy.DeploymentPlanner.AllocationAlgorithm.firstfitleastconsumed;
+import static com.cloud.deploy.DeploymentPlanner.AllocationAlgorithm.random;
+import static com.cloud.deploy.DeploymentPlanner.AllocationAlgorithm.userdispersing;
 
-import javax.inject.Inject;
-import javax.naming.ConfigurationException;
-
-import com.cloud.gpu.dao.VgpuProfileDao;
-
-import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
-import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
-import org.springframework.stereotype.Component;
-
-import com.cloud.agent.manager.allocator.HostAllocator;
 import com.cloud.capacity.Capacity;
-import com.cloud.capacity.CapacityManager;
 import com.cloud.capacity.CapacityVO;
 import com.cloud.capacity.dao.CapacityDao;
 import com.cloud.configuration.Config;
 import com.cloud.configuration.ConfigurationManager;
-import com.cloud.dc.ClusterDetailsDao;
-import com.cloud.dc.dao.ClusterDao;
-import com.cloud.deploy.DeploymentPlan;
 import com.cloud.deploy.DeploymentClusterPlanner;
+import com.cloud.deploy.DeploymentPlan;
 import com.cloud.deploy.DeploymentPlanner.ExcludeList;
 import com.cloud.deploy.FirstFitPlanner;
 import com.cloud.gpu.GPU;
@@ -53,11 +34,9 @@
 import com.cloud.host.Host;
 import com.cloud.host.Host.Type;
 import com.cloud.host.HostVO;
-import com.cloud.host.dao.HostDao;
 import com.cloud.host.dao.HostDetailsDao;
 import com.cloud.offering.ServiceOffering;
 import com.cloud.resource.ResourceManager;
-import com.cloud.service.ServiceOfferingDetailsVO;
 import com.cloud.service.dao.ServiceOfferingDetailsDao;
 import com.cloud.storage.GuestOSCategoryVO;
 import com.cloud.storage.GuestOSVO;
@@ -66,22 +45,38 @@
 import com.cloud.storage.dao.GuestOSDao;
 import com.cloud.user.Account;
 import com.cloud.utils.Pair;
-import com.cloud.utils.component.AdapterBase;
+import com.cloud.utils.StringUtils;
 import com.cloud.vm.VMInstanceDetailVO;
-import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineProfile;
-import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
 
+import java.text.DecimalFormat;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Comparator;
+import java.util.HashMap;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+import javax.naming.ConfigurationException;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
+import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.commons.lang3.ObjectUtils;
 import org.jetbrains.annotations.NotNull;
+import org.springframework.stereotype.Component;
 
 /**
  * An allocator that tries to find a fit on a computing host.  This allocator does not care whether or not the host supports routing.
  */
 @Component
-public class FirstFitAllocator extends AdapterBase implements HostAllocator {
-    @Inject
-    protected HostDao _hostDao = null;
+public class FirstFitAllocator extends BaseAllocator {
     @Inject
     HostDetailsDao _hostDetailsDao = null;
     @Inject
@@ -95,289 +90,183 @@ public class FirstFitAllocator extends AdapterBase implements HostAllocator {
     @Inject
     protected ResourceManager _resourceMgr;
     @Inject
-    ClusterDao _clusterDao;
-    @Inject
-    ClusterDetailsDao _clusterDetailsDao;
-    @Inject
     ServiceOfferingDetailsDao _serviceOfferingDetailsDao;
     @Inject
-    CapacityManager _capacityMgr;
-    @Inject
     CapacityDao _capacityDao;
     @Inject
-    VMInstanceDetailsDao _vmInstanceDetailsDao;
-    @Inject
-    private VgpuProfileDao vgpuProfileDao;
+    VMInstanceDetailsDao vmInstanceDetailsDao;
 
     boolean _checkHvm = true;
+
     static DecimalFormat decimalFormat = new DecimalFormat("#.##");
 
     @Override
     public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, int returnUpTo) {
-        return allocateTo(vmProfile, plan, type, avoid, returnUpTo, true);
+        return allocateTo(vmProfile, plan, type, avoid, null, returnUpTo, true);
     }
 
     @Override
-    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, int returnUpTo, boolean considerReservedCapacity) {
+    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
+                                 boolean considerReservedCapacity) {
+        if (type == Host.Type.Storage) {
+            return null;
+        }
 
         long dcId = plan.getDataCenterId();
         Long podId = plan.getPodId();
         Long clusterId = plan.getClusterId();
         ServiceOffering offering = vmProfile.getServiceOffering();
-        VMTemplateVO template = (VMTemplateVO)vmProfile.getTemplate();
+        VMTemplateVO template = (VMTemplateVO) vmProfile.getTemplate();
         Account account = vmProfile.getOwner();
 
-        boolean isVMDeployedWithUefi = false;
-        VMInstanceDetailVO vmInstanceDetailVO = _vmInstanceDetailsDao.findDetail(vmProfile.getId(), "UEFI");
-        if(vmInstanceDetailVO != null){
-            if ("secure".equalsIgnoreCase(vmInstanceDetailVO.getValue()) || "legacy".equalsIgnoreCase(vmInstanceDetailVO.getValue())) {
-                isVMDeployedWithUefi = true;
-            }
-        }
-        logger.info(" Guest VM is requested with Custom[UEFI] Boot Type "+ isVMDeployedWithUefi);
+        String hostTagOnOffering = offering.getHostTag();
+        String hostTagOnTemplate = template.getTemplateTag();
+        String paramAsStringToLog = String.format("zone [%s], pod [%s], cluster [%s]", dcId, podId, clusterId);
 
+        List<HostVO> suitableHosts = retrieveHosts(vmProfile, type, (List<HostVO>) hosts, clusterId, podId, dcId, hostTagOnOffering, hostTagOnTemplate);
 
-        if (type == Host.Type.Storage) {
-            // FirstFitAllocator should be used for user VMs only since it won't care whether the host is capable of routing or not
-            return new ArrayList<>();
+        if (suitableHosts.isEmpty()) {
+            logger.info("No suitable host found for VM [{}] in {}.", vmProfile, paramAsStringToLog);
+            return null;
         }
-        String paramAsStringToLog = String.format("zone [%s], pod [%s], cluster [%s]", dcId, podId, clusterId);
-        logger.debug("Looking for hosts in {}", paramAsStringToLog);
 
-        String hostTagOnOffering = offering.getHostTag();
-        String hostTagOnTemplate = template.getTemplateTag();
-        String hostTagUefi = "UEFI";
+        if (CollectionUtils.isEmpty(hosts)) {
+            addHostsToAvoidSet(type, avoid, clusterId, podId, dcId, suitableHosts);
+        }
 
-        boolean hasSvcOfferingTag = hostTagOnOffering != null ? true : false;
-        boolean hasTemplateTag = hostTagOnTemplate != null ? true : false;
+        return allocateTo(vmProfile, plan, offering, template, avoid, suitableHosts, returnUpTo, considerReservedCapacity, account);
+    }
 
-        List<HostVO> clusterHosts = new ArrayList<>();
-        List<HostVO> hostsMatchingUefiTag = new ArrayList<>();
-        if(isVMDeployedWithUefi){
-            hostsMatchingUefiTag = _hostDao.listByHostCapability(type, clusterId, podId, dcId, Host.HOST_UEFI_ENABLE);
-            if (logger.isDebugEnabled()) {
-                logger.debug("Hosts with tag '" + hostTagUefi + "' are:" + hostsMatchingUefiTag);
-            }
-        }
+    protected List<HostVO> retrieveHosts(VirtualMachineProfile vmProfile, Type type, List<HostVO> hostsToFilter, Long clusterId, Long podId, long dcId, String hostTagOnOffering,
+                                         String hostTagOnTemplate) {
+        String haVmTag = (String) vmProfile.getParameter(VirtualMachineProfile.Param.HaTag);
+        List<HostVO> clusterHosts;
 
+        if (CollectionUtils.isNotEmpty(hostsToFilter)) {
+            clusterHosts = new ArrayList<>(hostsToFilter);
+        } else {
+            clusterHosts = _resourceMgr.listAllUpAndEnabledHosts(type, clusterId, podId, dcId);
+        }
 
-        String haVmTag = (String)vmProfile.getParameter(VirtualMachineProfile.Param.HaTag);
         if (haVmTag != null) {
-            clusterHosts = _hostDao.listByHostTag(type, clusterId, podId, dcId, haVmTag);
+            clusterHosts.retainAll(hostDao.listByHostTag(type, clusterId, podId, dcId, haVmTag));
+        } else if (ObjectUtils.allNull(hostTagOnOffering, hostTagOnTemplate)) {
+            clusterHosts.retainAll(_resourceMgr.listAllUpAndEnabledNonHAHosts(type, clusterId, podId, dcId));
         } else {
-            if (hostTagOnOffering == null && hostTagOnTemplate == null) {
-                clusterHosts = _resourceMgr.listAllUpAndEnabledNonHAHosts(type, clusterId, podId, dcId);
-            } else {
-                List<HostVO> hostsMatchingOfferingTag = new ArrayList<>();
-                List<HostVO> hostsMatchingTemplateTag = new ArrayList<>();
-                if (hasSvcOfferingTag) {
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Looking for hosts having tag specified on SvcOffering:" + hostTagOnOffering);
-                    }
-                    hostsMatchingOfferingTag = _hostDao.listByHostTag(type, clusterId, podId, dcId, hostTagOnOffering);
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Hosts with tag '" + hostTagOnOffering + "' are:" + hostsMatchingOfferingTag);
-                    }
-                }
-                if (hasTemplateTag) {
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Looking for hosts having tag specified on Template:" + hostTagOnTemplate);
-                    }
-                    hostsMatchingTemplateTag = _hostDao.listByHostTag(type, clusterId, podId, dcId, hostTagOnTemplate);
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Hosts with tag '" + hostTagOnTemplate + "' are:" + hostsMatchingTemplateTag);
-                    }
-                }
-
-                if (hasSvcOfferingTag && hasTemplateTag) {
-                    hostsMatchingOfferingTag.retainAll(hostsMatchingTemplateTag);
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Found " + hostsMatchingOfferingTag.size() + " Hosts satisfying both tags, host ids are:" + hostsMatchingOfferingTag);
-                    }
-
-                    clusterHosts = hostsMatchingOfferingTag;
-                } else {
-                    if (hasSvcOfferingTag) {
-                        clusterHosts = hostsMatchingOfferingTag;
-                    } else {
-                        clusterHosts = hostsMatchingTemplateTag;
-                    }
-                }
-            }
+            retainHostsMatchingServiceOfferingAndTemplateTags(clusterHosts, type, dcId, podId, clusterId, hostTagOnOffering, hostTagOnTemplate);
         }
 
-        if (isVMDeployedWithUefi) {
-            clusterHosts.retainAll(hostsMatchingUefiTag);
-        }
+        filterHostsWithUefiEnabled(type, vmProfile, clusterId, podId, dcId, clusterHosts);
 
-        clusterHosts.addAll(_hostDao.findHostsWithTagRuleThatMatchComputeOferringTags(hostTagOnOffering));
+        addHostsBasedOnTagRules(hostTagOnOffering, clusterHosts);
 
+        return clusterHosts;
 
-        if (clusterHosts.isEmpty()) {
-            logger.warn("No suitable host found for VM [{}] with tags {} in {}.", vmProfile, hostTagOnOffering, paramAsStringToLog);
-            return null;
-        }
-        // add all hosts that we are not considering to the avoid list
-        List<HostVO> allhostsInCluster = _hostDao.listAllUpAndEnabledNonHAHosts(type, clusterId, podId, dcId, null);
-        allhostsInCluster.removeAll(clusterHosts);
+    }
 
-        logger.debug(() -> String.format("Adding hosts [%s] to the avoid set because these hosts do not support HA.",
-                ReflectionToStringBuilderUtils.reflectOnlySelectedFields(allhostsInCluster, "uuid", "name")));
+    /**
+     * Add all hosts to the avoid set that were not considered during the allocation
+     */
+    protected void addHostsToAvoidSet(Type type, ExcludeList avoid, Long clusterId, Long podId, long dcId, List<HostVO> suitableHosts) {
+        List<HostVO> allHostsInCluster = hostDao.listAllUpAndEnabledNonHAHosts(type, clusterId, podId, dcId, null);
 
-        for (HostVO host : allhostsInCluster) {
+        allHostsInCluster.removeAll(suitableHosts);
+
+        logger.debug("Adding hosts [{}] to the avoid set because these hosts were not considered for allocation.",
+                () -> ReflectionToStringBuilderUtils.reflectOnlySelectedFields(allHostsInCluster, "uuid", "name"));
+
+        for (HostVO host : allHostsInCluster) {
             avoid.addHost(host.getId());
         }
-
-        return allocateTo(vmProfile, plan, offering, template, avoid, clusterHosts, returnUpTo, considerReservedCapacity, account);
     }
 
-    @Override
-    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
-        boolean considerReservedCapacity) {
-        long dcId = plan.getDataCenterId();
-        Long podId = plan.getPodId();
-        Long clusterId = plan.getClusterId();
-        ServiceOffering offering = vmProfile.getServiceOffering();
-        VMTemplateVO template = (VMTemplateVO)vmProfile.getTemplate();
-        Account account = vmProfile.getOwner();
-        List<Host> suitableHosts = new ArrayList<>();
-        List<Host> hostsCopy = new ArrayList<>(hosts);
+    protected void filterHostsWithUefiEnabled(Type type, VirtualMachineProfile vmProfile, Long clusterId, Long podId, long dcId, List<HostVO> clusterHosts) {
+        VMInstanceDetailVO vmInstanceDetailVO = vmInstanceDetailsDao.findDetail(vmProfile.getId(), "UEFI");
 
-        if (type == Host.Type.Storage) {
-            // FirstFitAllocator should be used for user VMs only since it won't care whether the host is capable of
-            // routing or not.
-            return suitableHosts;
+        if (vmInstanceDetailVO == null) {
+            return;
         }
 
-        String hostTagOnOffering = offering.getHostTag();
-        String hostTagOnTemplate = template.getTemplateTag();
-        boolean hasSvcOfferingTag = hostTagOnOffering != null ? true : false;
-        boolean hasTemplateTag = hostTagOnTemplate != null ? true : false;
-
-        String haVmTag = (String)vmProfile.getParameter(VirtualMachineProfile.Param.HaTag);
-        if (haVmTag != null) {
-            hostsCopy.retainAll(_hostDao.listByHostTag(type, clusterId, podId, dcId, haVmTag));
-        } else {
-            if (hostTagOnOffering == null && hostTagOnTemplate == null) {
-                hostsCopy.retainAll(_resourceMgr.listAllUpAndEnabledNonHAHosts(type, clusterId, podId, dcId));
-            } else {
-                if (hasSvcOfferingTag) {
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Looking for hosts having tag specified on SvcOffering:" + hostTagOnOffering);
-                    }
-                    hostsCopy.retainAll(_hostDao.listByHostTag(type, clusterId, podId, dcId, hostTagOnOffering));
-
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Hosts with tag '" + hostTagOnOffering + "' are:" + hostsCopy);
-                    }
-                }
-
-                if (hasTemplateTag) {
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Looking for hosts having tag specified on Template:" + hostTagOnTemplate);
-                    }
-
-                    hostsCopy.retainAll(_hostDao.listByHostTag(type, clusterId, podId, dcId, hostTagOnTemplate));
-
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("Hosts with tag '" + hostTagOnTemplate + "' are:" + hostsCopy);
-                    }
-                }
-            }
+        if (!StringUtils.equalsAnyIgnoreCase(vmInstanceDetailVO.getValue(), ApiConstants.BootMode.SECURE.toString(), ApiConstants.BootMode.LEGACY.toString())) {
+            return;
         }
 
-        hostsCopy.addAll(_hostDao.findHostsWithTagRuleThatMatchComputeOferringTags(hostTagOnOffering));
+        logger.info("Guest VM is requested with Custom[UEFI] Boot Type enabled.");
 
-        if (!hostsCopy.isEmpty()) {
-            suitableHosts = allocateTo(vmProfile, plan, offering, template, avoid, hostsCopy, returnUpTo, considerReservedCapacity, account);
-        }
+        List<HostVO> hostsMatchingUefiTag = hostDao.listByHostCapability(type, clusterId, podId, dcId, Host.HOST_UEFI_ENABLE);
 
-        return suitableHosts;
+        logger.debug("Hosts with UEFI enabled are {}.", hostsMatchingUefiTag);
+        clusterHosts.retainAll(hostsMatchingUefiTag);
     }
 
     protected List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, ServiceOffering offering, VMTemplateVO template, ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
-        boolean considerReservedCapacity, Account account) {
+                                    boolean considerReservedCapacity, Account account) {
         String vmAllocationAlgorithm = DeploymentClusterPlanner.VmAllocationAlgorithm.value();
-        if (vmAllocationAlgorithm.equals("random")) {
-            // Shuffle this so that we don't check the hosts in the same order.
+        if (random.toString().equals(vmAllocationAlgorithm)) {
             Collections.shuffle(hosts);
-        } else if (vmAllocationAlgorithm.equals("userdispersing")) {
+        } else if (userdispersing.toString().equals(vmAllocationAlgorithm)) {
             hosts = reorderHostsByNumberOfVms(plan, hosts, account);
-        } else if(vmAllocationAlgorithm.equals("firstfitleastconsumed")){
+        } else if (firstfitleastconsumed.toString().equals(vmAllocationAlgorithm)) {
             hosts = reorderHostsByCapacity(plan, hosts);
         }
 
-        if (logger.isDebugEnabled()) {
-            logger.debug("FirstFitAllocator has " + hosts.size() + " hosts to check for allocation: " + hosts);
-        }
-
-        // We will try to reorder the host lists such that we give priority to hosts that have
-        // the minimums to support a VM's requirements
+        logger.debug("FirstFitAllocator has {} hosts to check for allocation {}.", hosts.size(), hosts);
         hosts = prioritizeHosts(template, offering, hosts);
+        logger.debug("Found {} hosts for allocation after prioritization: {}.", hosts.size(), hosts);
 
-        if (logger.isDebugEnabled()) {
-            logger.debug("Found " + hosts.size() + " hosts for allocation after prioritization: " + hosts);
-        }
+        List<Host> suitableHosts = checkHostsCompatibilities(offering, vmProfile, avoid, hosts, returnUpTo, considerReservedCapacity);
+        logger.debug("Host Allocator returning {} suitable hosts.", suitableHosts.size());
 
-        if (logger.isDebugEnabled()) {
-            logger.debug("Looking for speed=" + (offering.getCpu() * offering.getSpeed()) + "Mhz, Ram=" + offering.getRamSize() + " MB");
-        }
+        return suitableHosts;
+    }
 
-        long serviceOfferingId = offering.getId();
+    protected List<Host> checkHostsCompatibilities(ServiceOffering offering, VirtualMachineProfile vmProfile, ExcludeList avoid, List<? extends Host> hosts, int returnUpTo, boolean considerReservedCapacity) {
         List<Host> suitableHosts = new ArrayList<>();
-        ServiceOfferingDetailsVO offeringDetails = null;
+        logger.debug("Checking compatibility for the following hosts {}.", suitableHosts);
 
         for (Host host : hosts) {
             if (suitableHosts.size() == returnUpTo) {
                 break;
             }
+
             if (avoid.shouldAvoid(host)) {
-                if (logger.isDebugEnabled()) {
-                    logger.debug("Host: {} is in avoid set, skipping this and trying other available hosts", host);
-                }
+                logger.debug("Host [{}] is in avoid set, skipping this and trying other available hosts", host);
                 continue;
             }
 
-            //find number of guest VMs occupying capacity on this host.
-            if (_capacityMgr.checkIfHostReachMaxGuestLimit(host)) {
+            if (capacityManager.checkIfHostReachMaxGuestLimit(host)) {
                 logger.debug("Adding host [{}] to the avoid set because this host already has the max number of running (user and/or system) VMs.", host);
                 avoid.addHost(host.getId());
                 continue;
             }
 
-            // Check if GPU device is required by offering and host has the availability
-            if (_resourceMgr.isGPUDeviceAvailable(offering, host, vmProfile.getId())) {
-                logger.debug("Host [{}] has required GPU devices available.", host);
-            } else {
-                // If GPU is not available, skip this host
-                logger.debug("Adding host [{}] to avoid set, because this host does not have required GPU devices available.", host);
-                avoid.addHost(host.getId());
+            if (offeringRequestedVGpuAndHostDoesNotHaveIt(offering, vmProfile, avoid, host)) {
                 continue;
             }
 
-            Pair<Boolean, Boolean> cpuCapabilityAndCapacity = _capacityMgr.checkIfHostHasCpuCapabilityAndCapacity(host, offering, considerReservedCapacity);
-            if (cpuCapabilityAndCapacity.first() && cpuCapabilityAndCapacity.second()) {
-                if (logger.isDebugEnabled()) {
-                    logger.debug("Found a suitable host, adding to list: {}", host);
-                }
+            if (hostHasCpuCapabilityAndCapacity(considerReservedCapacity, offering, host)) {
                 suitableHosts.add(host);
-            } else {
-                if (logger.isDebugEnabled()) {
-                    logger.debug("Not using host {}; host has cpu capability? {}, host has capacity?{}",
-                            host, cpuCapabilityAndCapacity.first(), cpuCapabilityAndCapacity.second());
-                }
-                avoid.addHost(host.getId());
+                continue;
             }
+            avoid.addHost(host.getId());
         }
+        return suitableHosts;
+    }
 
-        if (logger.isDebugEnabled()) {
-            logger.debug("Host Allocator returning " + suitableHosts.size() + " suitable hosts");
-        }
+    protected boolean offeringRequestedVGpuAndHostDoesNotHaveIt(ServiceOffering offering, VirtualMachineProfile vmProfile, ExcludeList avoid, Host host) {
+      if (_resourceMgr.isGPUDeviceAvailable(offering, host, vmProfile.getId())) {
+        logger.debug("Host [{}] has required GPU devices available.", () -> host);
+        return false;
+      }
 
-        return suitableHosts;
+      logger.debug("Adding host [{}] to avoid set, because this host does not have required GPU devices available.", () -> host);
+      avoid.addHost(host.getId());
+      return true;
     }
 
-    // Reorder hosts in the decreasing order of free capacity.
+    /**
+     * Reorder hosts in the decreasing order of free capacity.
+     */
     private List<? extends Host> reorderHostsByCapacity(DeploymentPlan plan, List<? extends Host> hosts) {
         Long zoneId = plan.getDataCenterId();
         Long clusterId = plan.getClusterId();
@@ -388,26 +277,10 @@ private List<? extends Host> reorderHostsByCapacity(DeploymentPlan plan, List<?
                 .sorted(Map.Entry.comparingByValue(Comparator.reverseOrder()))
                 .collect(Collectors.toMap(Map.Entry::getKey, entry -> decimalFormat.format(entry.getValue() * 100) + "%",
                         (e1, e2) -> e1, LinkedHashMap::new));
-        if (logger.isDebugEnabled()) {
-            logger.debug("List of hosts: [{}] in descending order of free capacity (percentage) in the cluster: {}",
-                    hostIdsByFreeCapacity, sortedHostByCapacity);
-        }
-
-        //now filter the given list of Hosts by this ordered list
-        Map<Long, Host> hostMap = new HashMap<>();
-        for (Host host : hosts) {
-            hostMap.put(host.getId(), host);
-        }
-        List<Long> matchingHostIds = new ArrayList<>(hostMap.keySet());
-
-        hostIdsByFreeCapacity.retainAll(matchingHostIds);
-
-        List<Host> reorderedHosts = new ArrayList<>();
-        for(Long id: hostIdsByFreeCapacity){
-            reorderedHosts.add(hostMap.get(id));
-        }
+        logger.debug("List of hosts: [{}] in descending order of free capacity (percentage) in the cluster: {}.",
+                hostIdsByFreeCapacity, sortedHostByCapacity);
 
-        return reorderedHosts;
+        return filterHosts(hosts, hostIdsByFreeCapacity);
     }
 
     private Pair<List<Long>, Map<Long, Double>> getOrderedHostsByCapacity(Long zoneId, Long clusterId) {
@@ -450,116 +323,154 @@ private List<? extends Host> reorderHostsByNumberOfVms(DeploymentPlan plan, List
         Long clusterId = plan.getClusterId();
 
         List<Long> hostIdsByVmCount = _vmInstanceDao.listHostIdsByVmCount(dcId, podId, clusterId, account.getAccountId());
-        if (logger.isDebugEnabled()) {
-            logger.debug("List of hosts in ascending order of number of VMs: " + hostIdsByVmCount);
-        }
+        logger.debug("List of hosts in ascending order of number of VMs: {}.", hostIdsByVmCount);
 
-        //now filter the given list of Hosts by this ordered list
+        return filterHosts(hosts, hostIdsByVmCount);
+    }
+
+    /**
+     * Filter the given list of Hosts considering the ordered list
+     */
+    private List<? extends Host> filterHosts(List<? extends Host> hosts, List<Long> orderedHostIdsList) {
         Map<Long, Host> hostMap = new HashMap<>();
+
         for (Host host : hosts) {
             hostMap.put(host.getId(), host);
         }
         List<Long> matchingHostIds = new ArrayList<>(hostMap.keySet());
-
-        hostIdsByVmCount.retainAll(matchingHostIds);
+        orderedHostIdsList.retainAll(matchingHostIds);
 
         List<Host> reorderedHosts = new ArrayList<>();
-        for (Long id : hostIdsByVmCount) {
+        for(Long id: orderedHostIdsList){
             reorderedHosts.add(hostMap.get(id));
         }
 
         return reorderedHosts;
     }
 
-    @Override
-    public boolean isVirtualMachineUpgradable(VirtualMachine vm, ServiceOffering offering) {
-        // currently we do no special checks to rule out a VM being upgradable to an offering, so
-        // return true
-        return true;
-    }
-
+    /**
+     * Reorder the host list giving priority to hosts that have the minimum to support the VM's requirements.
+     */
     protected List<? extends Host> prioritizeHosts(VMTemplateVO template, ServiceOffering offering, List<? extends Host> hosts) {
         if (template == null) {
             return hosts;
         }
 
-        // Determine the guest OS category of the template
-        String templateGuestOSCategory = getTemplateGuestOSCategory(template);
+        List<Host> hostsToCheck = filterHostWithNoHvmIfTemplateRequested(template, hosts);
 
         List<Host> prioritizedHosts = new ArrayList<>();
-        List<Host> noHvmHosts = new ArrayList<>();
+        List<Host> highPriorityHosts = new ArrayList<>();
+        List<Host> lowPriorityHosts = new ArrayList<>();
+
+        prioritizeHostsWithMatchingGuestOs(template, hostsToCheck, highPriorityHosts, lowPriorityHosts);
+        hostsToCheck.removeAll(highPriorityHosts);
+        hostsToCheck.removeAll(lowPriorityHosts);
+
+        prioritizeHostsByHvmCapability(template, hostsToCheck, prioritizedHosts);
+        prioritizedHosts.addAll(0, highPriorityHosts);
+        prioritizedHosts.addAll(lowPriorityHosts);
+
+        prioritizeHostsByGpuEnabled(offering, prioritizedHosts);
+
+        return prioritizedHosts;
+    }
+
 
-        // If a template requires HVM and a host doesn't support HVM, remove it from consideration
+    /**
+     * If a template requires HVM and a host doesn't support HVM, remove it from consideration.
+     */
+    protected List<Host> filterHostWithNoHvmIfTemplateRequested(VMTemplateVO template, List<? extends Host> hosts) {
         List<Host> hostsToCheck = new ArrayList<>();
-        if (template.isRequiresHvm()) {
-            for (Host host : hosts) {
-                if (hostSupportsHVM(host)) {
-                    hostsToCheck.add(host);
-                } else {
-                    noHvmHosts.add(host);
-                }
-            }
-        } else {
+
+        if (!template.isRequiresHvm()) {
+            logger.debug("Template [{}] does not require HVM, therefore, the hosts {} will not be checked for HVM compatibility.", template, hostsToCheck);
             hostsToCheck.addAll(hosts);
+            return hostsToCheck;
         }
 
-        if (logger.isDebugEnabled()) {
-            if (noHvmHosts.size() > 0) {
-                logger.debug("Not considering hosts: " + noHvmHosts + "  to deploy template: " + template + " as they are not HVM enabled");
+        List<Host> noHvmHosts = new ArrayList<>();
+        logger.debug("Template [{}] requires HVM, therefore, the hosts %s will be checked for HVM compatibility.", template, hostsToCheck);
+
+        for (Host host : hosts) {
+            if (hostSupportsHVM(host)) {
+                hostsToCheck.add(host);
+            } else {
+                noHvmHosts.add(host);
             }
         }
-        // If a host is tagged with the same guest OS category as the template, move it to a high priority list
-        // If a host is tagged with a different guest OS category than the template, move it to a low priority list
-        List<Host> highPriorityHosts = new ArrayList<>();
-        List<Host> lowPriorityHosts = new ArrayList<>();
-        for (Host host : hostsToCheck) {
-            String hostGuestOSCategory = getHostGuestOSCategory(host);
-            if (hostGuestOSCategory == null) {
-                continue;
-            } else if (templateGuestOSCategory != null && templateGuestOSCategory.equals(hostGuestOSCategory)) {
-                highPriorityHosts.add(host);
-            } else {
-                lowPriorityHosts.add(host);
+
+        if (!noHvmHosts.isEmpty()) {
+            logger.debug("Not considering hosts {} to deploy VM using template {} as they are not HVM enabled.", noHvmHosts, template);
+        }
+
+        return hostsToCheck;
+    }
+
+
+    /**
+     * If service offering did not request for vGPU, then move all host with GPU to the end of the host priority list.
+     */
+    protected void prioritizeHostsByGpuEnabled(ServiceOffering offering, List<Host> prioritizedHosts) {
+        boolean serviceOfferingRequestedVGpu = _serviceOfferingDetailsDao.findDetail(offering.getId(), GPU.Keys.vgpuType.toString()) != null || offering.getVgpuProfileId() != null;
+
+        if (serviceOfferingRequestedVGpu) {
+            return;
+        }
+
+        List<Host> gpuEnabledHosts = new ArrayList<>();
+
+        for (Host host : prioritizedHosts) {
+            if (_resourceMgr.isHostGpuEnabled(host.getId())) {
+                gpuEnabledHosts.add(host);
             }
         }
 
-        hostsToCheck.removeAll(highPriorityHosts);
-        hostsToCheck.removeAll(lowPriorityHosts);
+        if (!gpuEnabledHosts.isEmpty()) {
+            prioritizedHosts.removeAll(gpuEnabledHosts);
+            prioritizedHosts.addAll(gpuEnabledHosts);
+        }
+    }
 
-        // Prioritize the remaining hosts by HVM capability
+    /**
+     * Prioritize remaining host by HVM capability.
+     *
+     * <ul>
+     *     <li>If host and template both do not support HVM, put it at the start of the list.</li>
+     *     <li>If the template doesn't require HVM, but the machine supports it, append it to the list.</li>
+     * </ul>
+     */
+    protected void prioritizeHostsByHvmCapability(VMTemplateVO template, List<Host> hostsToCheck, List<Host> prioritizedHosts) {
         for (Host host : hostsToCheck) {
             if (!template.isRequiresHvm() && !hostSupportsHVM(host)) {
-                // Host and template both do not support hvm, put it as first consideration
                 prioritizedHosts.add(0, host);
             } else {
-                // Template doesn't require hvm, but the machine supports it, make it last for consideration
                 prioritizedHosts.add(host);
             }
         }
+    }
 
-        // Merge the lists
-        prioritizedHosts.addAll(0, highPriorityHosts);
-        prioritizedHosts.addAll(lowPriorityHosts);
 
-        // if service offering is not GPU enabled then move all the GPU enabled hosts to the end of priority list.
-        if (_serviceOfferingDetailsDao.findDetail(offering.getId(), GPU.Keys.vgpuType.toString()) == null && offering.getVgpuProfileId() == null) {
+    /**
+     * <ul>
+     *     <li>If a host is tagged with the same guest OS category as the template, move it to a high priority list.</li>
+     *     <li>If a host is tagged with a different guest OS category than the template, move it to a low priority list.</li>
+     * </ul>
+     */
+    protected void prioritizeHostsWithMatchingGuestOs(VMTemplateVO template, List<Host> hostsToCheck, List<Host> highPriorityHosts, List<Host> lowPriorityHosts) {
+        String templateGuestOSCategory = getTemplateGuestOSCategory(template);
 
-            List<Host> gpuEnabledHosts = new ArrayList<>();
-            // Check for GPU enabled hosts.
-            for (Host host : prioritizedHosts) {
-                if (_resourceMgr.isHostGpuEnabled(host.getId())) {
-                    gpuEnabledHosts.add(host);
-                }
-            }
-            // Move GPU enabled hosts to the end of list
-            if(!gpuEnabledHosts.isEmpty()) {
-                prioritizedHosts.removeAll(gpuEnabledHosts);
-                prioritizedHosts.addAll(gpuEnabledHosts);
+        for (Host host : hostsToCheck) {
+            String hostGuestOSCategory = getHostGuestOSCategory(host);
+
+            if (StringUtils.equals(templateGuestOSCategory, hostGuestOSCategory)) {
+                highPriorityHosts.add(host);
+            } else if (hostGuestOSCategory != null) {
+                lowPriorityHosts.add(host);
             }
         }
-        return prioritizedHosts;
     }
 
+
     protected boolean hostSupportsHVM(Host host) {
         if (!_checkHvm) {
             return true;
@@ -621,19 +532,8 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
         if (_configDao != null) {
             Map<String, String> configs = _configDao.getConfiguration(params);
             String value = configs.get("xenserver.check.hvm");
-            _checkHvm = value == null ? true : Boolean.parseBoolean(value);
+            _checkHvm = value == null || Boolean.parseBoolean(value);
         }
         return true;
     }
-
-    @Override
-    public boolean start() {
-        return true;
-    }
-
-    @Override
-    public boolean stop() {
-        return true;
-    }
-
 }
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
new file mode 100644
index 000000000000..96b4255b876d
--- /dev/null
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
@@ -0,0 +1,132 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.manager.allocator.impl;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import javax.inject.Inject;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.ObjectUtils;
+import org.springframework.stereotype.Component;
+
+import com.cloud.deploy.DeploymentPlan;
+import com.cloud.deploy.DeploymentPlanner.ExcludeList;
+import com.cloud.host.Host;
+import com.cloud.host.Host.Type;
+import com.cloud.host.HostVO;
+import com.cloud.offering.ServiceOffering;
+import com.cloud.resource.ResourceManager;
+import com.cloud.storage.VMTemplateVO;
+import com.cloud.vm.VirtualMachineProfile;
+
+@Component
+public class RandomAllocator extends BaseAllocator {
+    @Inject
+    private ResourceManager _resourceMgr;
+
+    protected List<Host> findSuitableHosts(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
+                                         boolean considerReservedCapacity) {
+        if (type == Host.Type.Storage) {
+            return null;
+        }
+
+        long dcId = plan.getDataCenterId();
+        Long podId = plan.getPodId();
+        Long clusterId = plan.getClusterId();
+        ServiceOffering offering = vmProfile.getServiceOffering();
+
+        String offeringHostTag = offering.getHostTag();
+        VMTemplateVO template = (VMTemplateVO) vmProfile.getTemplate();
+        logger.debug("Looking for hosts in zone [{}], pod [{}], cluster [{}].", dcId, podId, clusterId);
+
+        List<? extends Host> availableHosts = retrieveHosts(type, (List<HostVO>) hosts, template, offeringHostTag, clusterId, podId, dcId);
+
+        if (availableHosts.isEmpty()) {
+            logger.info("No suitable host found for VM [{}] in zone [{}], pod [{}], cluster [{}].", vmProfile, dcId, podId, clusterId);
+            return null;
+        }
+
+        return filterAvailableHosts(avoid, returnUpTo, considerReservedCapacity, availableHosts, offering);
+    }
+
+    protected List<Host> filterAvailableHosts(ExcludeList avoid, int returnUpTo, boolean considerReservedCapacity, List<? extends Host> availableHosts, ServiceOffering offering) {
+        logger.debug("Random Allocator found [{}] available hosts. They will be checked if they are in the avoid set and for CPU capability and capacity.", availableHosts::size);
+        List<Host> suitableHosts = new ArrayList<>();
+
+        Collections.shuffle(availableHosts);
+        for (Host host : availableHosts) {
+            if (suitableHosts.size() == returnUpTo) {
+                break;
+            }
+
+            if (avoid.shouldAvoid(host)) {
+                logger.debug("Host [{}] is in the avoid set, skipping it and trying other available hosts.", () -> host);
+                continue;
+            }
+
+            if (!hostHasCpuCapabilityAndCapacity(considerReservedCapacity, offering, host)) {
+                continue;
+            }
+
+            logger.debug("Found the suitable host [{}], adding to list.", () -> host);
+            suitableHosts.add(host);
+        }
+
+        logger.debug("Random Host Allocator returning {} suitable hosts.", suitableHosts::size);
+        return suitableHosts;
+    }
+
+    /**
+     * @return all computing hosts, regardless of whether they support routing.
+     */
+    protected List<HostVO> retrieveHosts(Type type, List<HostVO> hosts, VMTemplateVO template, String offeringHostTag, Long clusterId, Long podId, long dcId) {
+        List<HostVO> availableHosts;
+        String templateTag = template.getTemplateTag();
+
+        if (CollectionUtils.isNotEmpty(hosts)) {
+            availableHosts = new ArrayList<>(hosts);
+        } else {
+            availableHosts = _resourceMgr.listAllUpAndEnabledHosts(type, clusterId, podId, dcId);
+        }
+
+        if (ObjectUtils.anyNotNull(offeringHostTag, templateTag)) {
+            retainHostsMatchingServiceOfferingAndTemplateTags(availableHosts, type, dcId, podId, clusterId, offeringHostTag, templateTag);
+        } else {
+            List<HostVO> hostsWithNoRuleTag = hostDao.listAllHostsThatHaveNoRuleTag(type, clusterId, podId, dcId);
+            logger.debug("Retaining hosts {} because they do not have rule tags.", hostsWithNoRuleTag);
+            availableHosts.retainAll(hostsWithNoRuleTag);
+        }
+
+        addHostsBasedOnTagRules(offeringHostTag, availableHosts);
+
+        return availableHosts;
+    }
+
+    @Override
+    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, int returnUpTo) {
+        return allocateTo(vmProfile, plan, type, avoid, null, returnUpTo, true);
+    }
+
+    @Override
+    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
+                                 boolean considerReservedCapacity) {
+        return findSuitableHosts(vmProfile, plan, type, avoid, hosts, returnUpTo, considerReservedCapacity);
+    }
+}
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/TestingAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/TestingAllocator.java
index fd8e65e24761..04a0b182b7b1 100644
--- a/server/src/main/java/com/cloud/agent/manager/allocator/impl/TestingAllocator.java
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/TestingAllocator.java
@@ -28,32 +28,24 @@
 import com.cloud.host.Host;
 import com.cloud.host.Host.Type;
 import com.cloud.host.dao.HostDao;
-import com.cloud.offering.ServiceOffering;
 import com.cloud.utils.component.AdapterBase;
-import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineProfile;
 
 public class TestingAllocator extends AdapterBase implements HostAllocator {
     @Inject
     HostDao _hostDao;
-    Long _computingHost;
     Long _storageHost;
     Long _routingHost;
 
     @Override
     public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, int returnUpTo) {
-        return allocateTo(vmProfile, plan, type, avoid, returnUpTo, true);
+        return allocateTo(vmProfile, plan, type, avoid, null, returnUpTo, true);
     }
 
     @Override
     public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
-        boolean considerReservedCapacity) {
-        return allocateTo(vmProfile, plan, type, avoid, returnUpTo, considerReservedCapacity);
-    }
-
-    @Override
-    public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, int returnUpTo, boolean considerReservedCapacity) {
-        List<Host> availableHosts = new ArrayList<Host>();
+                                 boolean considerReservedCapacity) {
+        List<Host> availableHosts = new ArrayList<>();
         Host host = null;
         if (type == Host.Type.Routing && _routingHost != null) {
             host = _hostDao.findById(_routingHost);
@@ -66,13 +58,6 @@ public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan pla
         return availableHosts;
     }
 
-    @Override
-    public boolean isVirtualMachineUpgradable(VirtualMachine vm, ServiceOffering offering) {
-        // currently we do no special checks to rule out a VM being upgradable to an offering, so
-        // return true
-        return true;
-    }
-
     @Override
     public boolean configure(String name, Map<String, Object> params) {
         String value = (String)params.get(Host.Type.Routing.toString());
diff --git a/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java b/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
index f163a3d52a5a..7fb4a97e149b 100644
--- a/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
+++ b/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
@@ -20,7 +20,6 @@
 
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collections;
 import java.util.Comparator;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -1714,20 +1713,19 @@ protected List<Host> findSuitableHosts(VirtualMachineProfile vmProfile, Deployme
 
     @Override
     public void reorderHostsByPriority(Map<Long, Integer> priorities, List<Host> hosts) {
-        logger.debug("Re-ordering hosts {} by priorities {}", hosts, priorities);
+        if (CollectionUtils.isEmpty(hosts)){
+            logger.debug("Hosts list is empty; therefore, there is nothing to reorder.");
+            return;
+        }
 
+        logger.info("Re-ordering hosts [{}] by priorities [{}].", hosts, priorities);
         hosts.removeIf(host -> DataCenterDeployment.PROHIBITED_HOST_PRIORITY.equals(getHostPriority(priorities, host.getId())));
+        hosts.sort((host1, host2) -> {
+            int res = getHostPriority(priorities, host1.getId()).compareTo(getHostPriority(priorities, host2.getId()));
+            return -res;
+        });
 
-        Collections.sort(hosts, new Comparator<>() {
-                    @Override
-                    public int compare(Host host1, Host host2) {
-                        int res = getHostPriority(priorities, host1.getId()).compareTo(getHostPriority(priorities, host2.getId()));
-                        return -res;
-                    }
-                }
-        );
-
-        logger.debug("Hosts after re-ordering are: {}", hosts);
+        logger.info("Hosts after re-ordering are: [{}].", hosts);
     }
 
     private Integer getHostPriority(Map<Long, Integer> priorities, Long hostId) {
diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index d4266496e982..337bdbbbc639 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -1696,11 +1696,7 @@ protected List<Host> getCapableSuitableHosts(
         List<Host> suitableHosts = new ArrayList<>();
 
         for (final HostAllocator allocator : hostAllocators) {
-            if (CollectionUtils.isNotEmpty(compatibleHosts)) {
-                suitableHosts = allocator.allocateTo(vmProfile, plan, Host.Type.Routing, excludes, compatibleHosts, HostAllocator.RETURN_UPTO_ALL, false);
-            } else {
-                suitableHosts = allocator.allocateTo(vmProfile, plan, Host.Type.Routing, excludes, HostAllocator.RETURN_UPTO_ALL, false);
-            }
+            suitableHosts = allocator.allocateTo(vmProfile, plan, Host.Type.Routing, excludes, compatibleHosts, HostAllocator.RETURN_UPTO_ALL, false);
 
             if (CollectionUtils.isNotEmpty(suitableHosts)) {
                 break;
@@ -1709,10 +1705,10 @@ protected List<Host> getCapableSuitableHosts(
 
         _dpMgr.reorderHostsByPriority(plan.getHostPriorities(), suitableHosts);
 
-        if (suitableHosts.isEmpty()) {
+        if (CollectionUtils.isEmpty(suitableHosts)) {
             logger.warn("No suitable hosts found.");
         } else {
-            logger.debug("Hosts having capacity and suitable for migration: {}", suitableHosts);
+            logger.debug("Hosts having capacity and are suitable for migration: {}", suitableHosts);
         }
 
         // Only list hosts of the same architecture as the source Host in a multi-arch zone
diff --git a/server/src/main/resources/META-INF/cloudstack/server-allocator/spring-server-allocator-context.xml b/server/src/main/resources/META-INF/cloudstack/server-allocator/spring-server-allocator-context.xml
index d3781649845b..28b96b8d194b 100644
--- a/server/src/main/resources/META-INF/cloudstack/server-allocator/spring-server-allocator-context.xml
+++ b/server/src/main/resources/META-INF/cloudstack/server-allocator/spring-server-allocator-context.xml
@@ -34,6 +34,9 @@
     <bean id="firstFitAllocator"
         class="com.cloud.agent.manager.allocator.impl.FirstFitAllocator" />
 
+    <bean id="randomAllocator"
+          class="com.cloud.agent.manager.allocator.impl.RandomAllocator" />
+
     <bean id="FirstFitRouting"
         class="com.cloud.agent.manager.allocator.impl.FirstFitRoutingAllocator">
         <property name="name" value="FirstFitRouting" />
diff --git a/server/src/test/java/com/cloud/agent/manager/allocator/impl/BaseAllocatorTest.java b/server/src/test/java/com/cloud/agent/manager/allocator/impl/BaseAllocatorTest.java
new file mode 100644
index 000000000000..ddd1e3959d51
--- /dev/null
+++ b/server/src/test/java/com/cloud/agent/manager/allocator/impl/BaseAllocatorTest.java
@@ -0,0 +1,219 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.manager.allocator.impl;
+
+import com.cloud.capacity.CapacityManager;
+import com.cloud.deploy.DeploymentPlan;
+import com.cloud.deploy.DeploymentPlanner;
+import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
+import com.cloud.offering.ServiceOffering;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.utils.Pair;
+import com.cloud.vm.VirtualMachineProfile;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+@RunWith(MockitoJUnitRunner.class)
+public class BaseAllocatorTest {
+    @Mock
+    HostDao hostDaoMock;
+
+    @Mock
+    CapacityManager capacityManagerMock;
+
+    @InjectMocks
+    @Spy
+    BaseAllocator baseAllocator = new MockBaseAllocator();
+
+    private final Host.Type type = Host.Type.Routing;
+
+    private final Long clusterId = 1L;
+
+    private final Long podId = 2L;
+
+    private final Long dcId = 3L;
+
+    private final HostVO host1 = Mockito.mock(HostVO.class);
+
+    private final HostVO host2 = Mockito.mock(HostVO.class);
+
+    private final HostVO host3 = Mockito.mock(HostVO.class);
+
+    private final ServiceOfferingVO serviceOffering = Mockito.mock(ServiceOfferingVO.class);
+
+    private final String hostTag = "hostTag";
+
+    @Test
+    public void retainHostsMatchingServiceOfferingAndTemplateTagsTestHasServiceOfferingTagShouldRetainHostsWithServiceOfferingTag() {
+        List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+        List<HostVO> hostsWithMathingTags = new ArrayList<>(Arrays.asList(host1, host3));
+        String hostTagOnTemplate = "hostTagOnTemplate";
+        String hostTagOnOffering = null;
+
+        Mockito.doReturn(hostsWithMathingTags).when(hostDaoMock).listByHostTag(type, clusterId, podId, dcId, hostTagOnTemplate);
+        baseAllocator.retainHostsMatchingServiceOfferingAndTemplateTags(suitableHosts, type, dcId, podId, clusterId, hostTagOnOffering, hostTagOnTemplate);
+
+        Assert.assertEquals(2, suitableHosts.size());
+        Assert.assertEquals(host1, suitableHosts.get(0));
+        Assert.assertEquals(host3, suitableHosts.get(1));
+    }
+
+    @Test
+    public void retainHostsMatchingServiceOfferingAndTemplateTagsTestHasServiceOfferingTagAndHasHostTagOnTemplateShouldRetainHostsWithServiceOfferingTagAndTemplateTag() {
+        List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+        List<HostVO> hostsWithMathingServiceTags = new ArrayList<>(Arrays.asList(host1, host3));
+        List<HostVO> hostsWithMathingTemplateTags = new ArrayList<>(Arrays.asList(host1, host2));
+        String hostTagOnTemplate = "hostTagOnTemplate";
+        String hostTagOnOffering = "hostTagOnOffering";
+
+        Mockito.doReturn(hostsWithMathingTemplateTags).when(hostDaoMock).listByHostTag(type, clusterId, podId, dcId, hostTagOnTemplate);
+        Mockito.doReturn(hostsWithMathingServiceTags).when(hostDaoMock).listByHostTag(type, clusterId, podId, dcId, hostTagOnOffering);
+        baseAllocator.retainHostsMatchingServiceOfferingAndTemplateTags(suitableHosts, type, dcId, podId, clusterId, hostTagOnOffering, hostTagOnTemplate);
+
+        Assert.assertEquals(1, suitableHosts.size());
+        Assert.assertEquals(host1, suitableHosts.get(0));
+    }
+
+    @Test
+    public void retainHostsMatchingServiceOfferingAndTemplateTagsTestHasHostTagOnTemplateShouldRetainHostsWithTemplateTag() {
+        List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+        List<HostVO> hostsWithMathingServiceTags = new ArrayList<>(Arrays.asList(host1, host3));
+        String hostTagOnTemplate = null;
+        String hostTagOnOffering = "hostTagOnOffering";
+
+        Mockito.doReturn(hostsWithMathingServiceTags).when(hostDaoMock).listByHostTag(type, clusterId, podId, dcId, hostTagOnOffering);
+        baseAllocator.retainHostsMatchingServiceOfferingAndTemplateTags(suitableHosts, type, dcId, podId, clusterId, hostTagOnOffering, hostTagOnTemplate);
+
+        Assert.assertEquals(2, suitableHosts.size());
+        Assert.assertEquals(host1, suitableHosts.get(0));
+        Assert.assertEquals(host3, suitableHosts.get(1));
+    }
+
+    @Test
+    public void retainHostsMatchingServiceOfferingAndTemplateTagsTestNoServiceTagAndNoTemplateTagShouldHaveAllSuitableHosts() {
+        List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+        String hostTagOnTemplate = null;
+        String hostTagOnOffering = null;
+
+        baseAllocator.retainHostsMatchingServiceOfferingAndTemplateTags(suitableHosts, type, dcId, podId, clusterId, hostTagOnOffering, hostTagOnTemplate);
+
+        Assert.assertEquals(3, suitableHosts.size());
+        Assert.assertEquals(host1, suitableHosts.get(0));
+        Assert.assertEquals(host2, suitableHosts.get(1));
+        Assert.assertEquals(host3, suitableHosts.get(2));
+    }
+
+    @Test
+    public void addHostsBasedOnTagRulesTestHostsWithTagRuleIsEmptyShouldNotAddToSuitableHosts() {
+        List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> emptyList = new ArrayList<>();
+
+        Mockito.doReturn(emptyList).when(hostDaoMock).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.anyString());
+        baseAllocator.addHostsBasedOnTagRules(hostTag, suitableHosts);
+
+        Assert.assertEquals(2, suitableHosts.size());
+        Assert.assertEquals(host1, suitableHosts.get(0));
+        Assert.assertEquals(host2, suitableHosts.get(1));
+    }
+
+    @Test
+    public void addHostsBasedOnTagRulesTestHostsWithTagRuleIsNotEmptyShouldAddToSuitableHosts() {
+        List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> hostsMatchingRuleTag = new ArrayList<>(Arrays.asList(host3));
+
+        Mockito.doReturn(hostsMatchingRuleTag).when(hostDaoMock).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.anyString());
+        baseAllocator.addHostsBasedOnTagRules(hostTag, suitableHosts);
+
+        Assert.assertEquals(3, suitableHosts.size());
+        Assert.assertEquals(host1, suitableHosts.get(0));
+        Assert.assertEquals(host2, suitableHosts.get(1));
+        Assert.assertEquals(host3, suitableHosts.get(2));
+    }
+
+    @Test
+    public void hostHasCpuCapabilityAndCapacityTestHostHasCpuCapabilityAndCpuCapacityShouldReturnTrue() {
+        Boolean hasCpuCapability = true;
+        Boolean hasCpuCapacity = true;
+        Pair<Boolean, Boolean> pair = new Pair<>(hasCpuCapability, hasCpuCapacity);
+
+        Mockito.doReturn(pair).when(capacityManagerMock).checkIfHostHasCpuCapabilityAndCapacity(Mockito.any(Host.class), Mockito.any(ServiceOffering.class), Mockito.anyBoolean());
+        boolean result = baseAllocator.hostHasCpuCapabilityAndCapacity(true, serviceOffering, host1);
+
+        Assert.assertTrue(result);
+    }
+
+    @Test
+    public void hostHasCpuCapabilityAndCapacityTestHostHasCpuCapabilityButNoCpuCapacityShouldReturnFalse() {
+        Boolean hasCpuCapability = true;
+        Boolean hasCpuCapacity = false;
+        Pair<Boolean, Boolean> pair = new Pair<>(hasCpuCapability, hasCpuCapacity);
+
+        Mockito.doReturn(pair).when(capacityManagerMock).checkIfHostHasCpuCapabilityAndCapacity(Mockito.any(Host.class), Mockito.any(ServiceOffering.class), Mockito.anyBoolean());
+        boolean result = baseAllocator.hostHasCpuCapabilityAndCapacity(true, serviceOffering, host1);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void hostHasCpuCapabilityAndCapacityTestHostDoesNotHaveCpuCapabilityButHasCpuCapacityShouldReturnFalse() {
+        Boolean hasCpuCapability = false;
+        Boolean hasCpuCapacity = true;
+        Pair<Boolean, Boolean> pair = new Pair<>(hasCpuCapability, hasCpuCapacity);
+
+        Mockito.doReturn(pair).when(capacityManagerMock).checkIfHostHasCpuCapabilityAndCapacity(Mockito.any(Host.class), Mockito.any(ServiceOffering.class), Mockito.anyBoolean());
+        boolean result = baseAllocator.hostHasCpuCapabilityAndCapacity(true, serviceOffering, host1);
+
+        Assert.assertFalse(result);
+    }
+
+    @Test
+    public void hostHasCpuCapabilityAndCapacityTestHostDoesNotHaveCpuCapabilityAndCpuCapacityShouldReturnFalse() {
+        Boolean hasCpuCapability = false;
+        Boolean hasCpuCapacity = false;
+        Pair<Boolean, Boolean> pair = new Pair<>(hasCpuCapability, hasCpuCapacity);
+
+        Mockito.doReturn(pair).when(capacityManagerMock).checkIfHostHasCpuCapabilityAndCapacity(Mockito.any(Host.class), Mockito.any(ServiceOffering.class), Mockito.anyBoolean());
+        boolean result = baseAllocator.hostHasCpuCapabilityAndCapacity(true, serviceOffering, host1);
+
+        Assert.assertFalse(result);
+    }
+
+    class MockBaseAllocator extends BaseAllocator {
+
+        @Override
+        public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Host.Type type, DeploymentPlanner.ExcludeList avoid, int returnUpTo) {
+            return null;
+        }
+
+        @Override
+        public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan plan, Host.Type type, DeploymentPlanner.ExcludeList avoid, List<? extends Host> hosts, int returnUpTo, boolean considerReservedCapacity) {
+            return null;
+        }
+    }
+}
diff --git a/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java b/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java
index 0d6a6fa8ff92..00cac5bbd52c 100644
--- a/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java
+++ b/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java
@@ -18,214 +18,596 @@
 
 package com.cloud.agent.manager.allocator.impl;
 
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import com.cloud.agent.manager.allocator.HostAllocator;
 import com.cloud.capacity.CapacityManager;
 import com.cloud.capacity.CapacityVO;
 import com.cloud.deploy.DeploymentPlan;
 import com.cloud.deploy.DeploymentPlanner;
 import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
 import com.cloud.offering.ServiceOffering;
 import com.cloud.resource.ResourceManager;
+import com.cloud.service.ServiceOfferingDetailsVO;
+import com.cloud.service.ServiceOfferingVO;
 import com.cloud.service.dao.ServiceOfferingDetailsDao;
+import com.cloud.storage.VMTemplateVO;
 import com.cloud.user.Account;
 import com.cloud.utils.Pair;
+import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.VirtualMachineProfile;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.junit.Assert;
-import org.junit.Before;
 import org.junit.Test;
-
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
 
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
-import static org.mockito.ArgumentMatchers.any;
-import static org.mockito.ArgumentMatchers.anyMap;
-import static org.mockito.ArgumentMatchers.anyString;
-import static org.mockito.ArgumentMatchers.eq;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
+@RunWith(MockitoJUnitRunner.class)
+public class FirstFitAllocatorTest {
+  private static final double TOLERANCE = 0.0001;
 
+  @Mock
+  HostDao hostDaoMock;
 
-public class FirstFitAllocatorTest {
-    private static final double TOLERANCE = 0.0001;
-    private FirstFitAllocator allocator;
-    private CapacityManager capacityMgr;
-    private ServiceOfferingDetailsDao offeringDetailsDao;
-    private ResourceManager resourceMgr;
-
-    private DeploymentPlan plan;
-    private ServiceOffering offering;
-    private DeploymentPlanner.ExcludeList avoid;
-    private Account account;
-
-    private Host host1;
-    private Host host2;
-    private VirtualMachineProfile vmProfile;
-    ConfigurationDao configDao;
-
-    @Before
-    public void setUp() {
-        allocator = new FirstFitAllocator();
-        capacityMgr = mock(CapacityManager.class);
-        offeringDetailsDao = mock(ServiceOfferingDetailsDao.class);
-        resourceMgr = mock(ResourceManager.class);
-        configDao = mock(ConfigurationDao.class);
-
-        allocator._capacityMgr = capacityMgr;
-        allocator._serviceOfferingDetailsDao = offeringDetailsDao;
-        allocator._resourceMgr = resourceMgr;
-        allocator._configDao = configDao;
-
-        plan = mock(DeploymentPlan.class);
-        offering = mock(ServiceOffering.class);
-        avoid = mock(DeploymentPlanner.ExcludeList.class);
-        account = mock(Account.class);
-
-        host1 = mock(Host.class);
-        host2 = mock(Host.class);
-
-        vmProfile = mock(VirtualMachineProfile.class);
-        when(vmProfile.getId()).thenReturn(1L);
-
-        when(plan.getDataCenterId()).thenReturn(1L);
-        when(offering.getCpu()).thenReturn(2);
-        when(offering.getSpeed()).thenReturn(1000);
-        when(offering.getRamSize()).thenReturn(2048);
-        when(offering.getId()).thenReturn(123L);
-        when(offering.getHostTag()).thenReturn(null);
-        when(offering.getVgpuProfileId()).thenReturn(null);
-    }
-
-    @Test
-    public void testConfigure() throws Exception {
-        when(configDao.getConfiguration(anyMap())).thenReturn(new HashMap<>());
-        assertTrue(allocator._checkHvm);
-        assertTrue(allocator.configure("test", new HashMap<>()));
-    }
-
-    @Test
-    public void testAllocateTo_SuccessfulMatch() {
-        List<Host> inputHosts = Arrays.asList(host1, host2);
-
-        // All hosts are allowed
-        when(avoid.shouldAvoid(host1)).thenReturn(false);
-        when(avoid.shouldAvoid(host2)).thenReturn(false);
-
-        // No GPU requirement
-        when(offeringDetailsDao.findDetail(eq(123L), anyString())).thenReturn(null);
-
-        // CPU capability and capacity is met
-        when(capacityMgr.checkIfHostReachMaxGuestLimit(any())).thenReturn(false);
-        when(capacityMgr.checkIfHostHasCpuCapabilityAndCapacity(eq(host1), eq(offering), eq(true)))
-                .thenReturn(new Pair<>(true, true));
-        when(capacityMgr.checkIfHostHasCpuCapabilityAndCapacity(eq(host2), eq(offering), eq(true)))
-                .thenReturn(new Pair<>(true, false));
-
-
-        when(resourceMgr.isGPUDeviceAvailable(offering, host1, vmProfile.getId())).thenReturn(true);
-        when(resourceMgr.isGPUDeviceAvailable(offering, host2, vmProfile.getId())).thenReturn(true);
-
-        List<Host> result = allocator.allocateTo(vmProfile, plan, offering, null, avoid, inputHosts, 2, true, account);
-
-        // Only host1 should be returned
-        assertEquals(1, result.size());
-        assertTrue(result.contains(host1));
-        assertFalse(result.contains(host2));
-    }
-
-    @Test
-    public void testAllocateTo_AvoidSetAndGuestLimit() {
-        List<Host> inputHosts = Arrays.asList(host1, host2);
-
-        when(avoid.shouldAvoid(host1)).thenReturn(true); // Avoided
-        when(avoid.shouldAvoid(host2)).thenReturn(false);
-
-        when(capacityMgr.checkIfHostReachMaxGuestLimit(host2)).thenReturn(true); // Reached limit
-
-        List<Host> result = allocator.allocateTo(vmProfile, plan, offering, null, avoid, inputHosts, 2, true, account);
-
-        assertTrue(result.isEmpty());
-    }
-
-    @Test
-    public void testAllocateTo_GPUNotAvailable() {
-        List<Host> inputHosts = Arrays.asList(host1);
-        when(avoid.shouldAvoid(host1)).thenReturn(false);
-
-        // GPU required but not available
-        var vgpuDetail = mock(com.cloud.service.ServiceOfferingDetailsVO.class);
-        var pciDetail = mock(com.cloud.service.ServiceOfferingDetailsVO.class);
-        when(offeringDetailsDao.findDetail(eq(123L), eq("vgpuType"))).thenReturn(vgpuDetail);
-        when(offeringDetailsDao.findDetail(eq(123L), eq("pciDevice"))).thenReturn(pciDetail);
-        when(pciDetail.getValue()).thenReturn("NVIDIA");
-        when(vgpuDetail.getValue()).thenReturn("GRID");
-
-        when(resourceMgr.isGPUDeviceAvailable(offering, host1, vmProfile.getId())).thenReturn(false);
-
-        List<Host> result = allocator.allocateTo(vmProfile, plan, offering, null, avoid, inputHosts, 1, true, account);
-
-        assertTrue(result.isEmpty());
-    }
-
-    @Test
-    public void testHostByCombinedCapacityOrder() {
-        // Test scenario 1: Default capacity usage (0.5 weight)
-        List<CapacityVO> mockCapacity = getHostCapacities();
-        Map<Long, Double> hostByCombinedCapacity = FirstFitAllocator.getHostByCombinedCapacities(mockCapacity, 0.5);
-
-        // Verify host ordering and capacity values
-        Long firstHostId = hostByCombinedCapacity.keySet().iterator().next();
-        Assert.assertEquals("Host with ID 1 should be first in ordering", Long.valueOf(1L), firstHostId);
-        Assert.assertEquals("Host 1 combined capacity should match expected value",
-                0.9609375, hostByCombinedCapacity.get(1L), TOLERANCE);
-        Assert.assertEquals("Host 2 combined capacity should match expected value",
-                0.9296875, hostByCombinedCapacity.get(2L), TOLERANCE);
-
-        // Test scenario 2: Modified capacity usage (0.7 weight)
-        when(mockCapacity.get(0).getUsedCapacity()).thenReturn(1500L);
-        hostByCombinedCapacity = FirstFitAllocator.getHostByCombinedCapacities(mockCapacity, 0.7);
-
-        // Verify new ordering after capacity change
-        firstHostId = hostByCombinedCapacity.keySet().iterator().next();
-        Assert.assertEquals("Host with ID 2 should be first after capacity change", Long.valueOf(2L), firstHostId);
-        Assert.assertEquals("Host 2 combined capacity should match expected value after change",
-                0.9515625, hostByCombinedCapacity.get(2L), TOLERANCE);
-        Assert.assertEquals("Host 1 combined capacity should match expected value after change",
-                0.9484375, hostByCombinedCapacity.get(1L), TOLERANCE);
-    }
-
-    List<CapacityVO> getHostCapacities() {
-        CapacityVO cpuCapacity1 = mock(CapacityVO.class);
-        when(cpuCapacity1.getHostOrPoolId()).thenReturn(1L);
-        when(cpuCapacity1.getTotalCapacity()).thenReturn(32000L);
-        when(cpuCapacity1.getReservedCapacity()).thenReturn(0L);
-        when(cpuCapacity1.getUsedCapacity()).thenReturn(500L);
-        when(cpuCapacity1.getCapacityType()).thenReturn(CapacityVO.CAPACITY_TYPE_CPU);
-
-        CapacityVO cpuCapacity2 = mock(CapacityVO.class);
-        when(cpuCapacity2.getHostOrPoolId()).thenReturn(2L);
-        when(cpuCapacity2.getTotalCapacity()).thenReturn(32000L);
-        when(cpuCapacity2.getReservedCapacity()).thenReturn(0L);
-        when(cpuCapacity2.getUsedCapacity()).thenReturn(500L);
-        when(cpuCapacity2.getCapacityType()).thenReturn(CapacityVO.CAPACITY_TYPE_CPU);
-
-        CapacityVO memCapacity1 = mock(CapacityVO.class);
-        when(memCapacity1.getHostOrPoolId()).thenReturn(1L);
-        when(memCapacity1.getTotalCapacity()).thenReturn(8589934592L);
-        when(memCapacity1.getReservedCapacity()).thenReturn(0L);
-        when(memCapacity1.getUsedCapacity()).thenReturn(536870912L);
-        when(memCapacity1.getCapacityType()).thenReturn(CapacityVO.CAPACITY_TYPE_MEMORY);
-
-        CapacityVO memCapacity2 = mock(CapacityVO.class);
-        when(memCapacity2.getHostOrPoolId()).thenReturn(2L);
-        when(memCapacity2.getTotalCapacity()).thenReturn(8589934592L);
-        when(memCapacity2.getReservedCapacity()).thenReturn(0L);
-        when(memCapacity2.getUsedCapacity()).thenReturn(1073741824L);
-        when(memCapacity1.getCapacityType()).thenReturn(CapacityVO.CAPACITY_TYPE_MEMORY);
-        return Arrays.asList(cpuCapacity1, memCapacity1, cpuCapacity2, memCapacity2);
-    }
+  @Mock
+  ResourceManager resourceManagerMock;
+
+  @Mock
+  VMInstanceDetailsDao userVmDetailsDaoMock;
+
+  @Mock
+  ServiceOfferingDetailsDao serviceOfferingDetailsDao;
+
+  @Mock
+  CapacityManager capacityMgr;
+
+  @Mock
+  ConfigurationDao configDao;
+
+  @Spy
+  @InjectMocks
+  FirstFitAllocator firstFitAllocatorSpy;
+
+  private final Host.Type type = Host.Type.Routing;
+
+  private final Long clusterId = 1L;
+
+  private final Long podId = 2L;
+
+  private final Long dcId = 3L;
+
+  private final List<HostVO> emptyList = new ArrayList<>();
+
+  private final String hostTag = "hostTag";
+
+  private final String templateTag = "templateTag";
+
+  private final HostVO host1 = mock(HostVO.class);
+
+  private final HostVO host2 = mock(HostVO.class);
+
+  private final HostVO host3 = mock(HostVO.class);
+
+  private final ServiceOfferingVO serviceOffering = mock(ServiceOfferingVO.class);
+
+  private final DeploymentPlanner.ExcludeList excludeList = mock(DeploymentPlanner.ExcludeList.class);
+
+  private final VirtualMachineProfile virtualMachineProfile = mock(VirtualMachineProfile.class);
+
+  private final VMTemplateVO vmTemplateVO = mock(VMTemplateVO.class);
+
+  private final Account account = mock(Account.class);
+
+  private final DeploymentPlan deploymentPlan = mock(DeploymentPlan.class);
+
+  private final DeploymentPlanner.ExcludeList avoid = mock(DeploymentPlanner.ExcludeList.class);
+
+  private final ServiceOffering offering = mock(ServiceOffering.class);
+
+  private final boolean considerReservedCapacity = true;
+
+  @Test
+  public void testConfigure() throws Exception {
+    when(configDao.getConfiguration(Mockito.anyMap())).thenReturn(new HashMap<>());
+    Assert.assertTrue(firstFitAllocatorSpy._checkHvm);
+    Assert.assertTrue(firstFitAllocatorSpy.configure("test", new HashMap<>()));
+  }
+
+  @Test
+  public void testAllocateTo_SuccessfulMatch() {
+    List<Host> inputHosts = Arrays.asList(host1, host2);
+
+    // All hosts are allowed
+    when(avoid.shouldAvoid(host1)).thenReturn(false);
+    when(avoid.shouldAvoid(host2)).thenReturn(false);
+
+    // CPU capability and capacity is met
+    when(capacityMgr.checkIfHostReachMaxGuestLimit(Mockito.any(Host.class))).thenReturn(false);
+    when(capacityMgr.checkIfHostHasCpuCapabilityAndCapacity(host1, offering, true))
+        .thenReturn(new Pair<>(true, true));
+    when(capacityMgr.checkIfHostHasCpuCapabilityAndCapacity(host2, offering,true))
+        .thenReturn(new Pair<>(true, false));
+
+    when(resourceManagerMock.isGPUDeviceAvailable(offering, host1, virtualMachineProfile.getId())).thenReturn(true);
+    when(resourceManagerMock.isGPUDeviceAvailable(offering, host2, virtualMachineProfile.getId())).thenReturn(true);
+
+    List<Host> result = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, offering, null, avoid, inputHosts, 2, true, account);
+
+    // Only host1 should be returned
+    Assert.assertEquals(1, result.size());
+    Assert.assertTrue(result.contains(host1));
+    Assert.assertFalse(result.contains(host2));
+  }
+
+  @Test
+  public void testAllocateTo_AvoidSetAndGuestLimit() {
+    List<Host> inputHosts = Arrays.asList(host1, host2);
+
+    when(avoid.shouldAvoid(host1)).thenReturn(true); // Avoided
+    when(avoid.shouldAvoid(host2)).thenReturn(false);
+
+    when(capacityMgr.checkIfHostReachMaxGuestLimit(host2)).thenReturn(true); // Reached limit
+
+    List<Host> result = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, offering, null, avoid, inputHosts, 2, true, account);
+
+    Assert.assertTrue(result.isEmpty());
+  }
+
+  @Test
+  public void testAllocateTo_GPUNotAvailable() {
+    List<Host> inputHosts = Arrays.asList(host1);
+    when(avoid.shouldAvoid(host1)).thenReturn(false);
+    when(resourceManagerMock.isGPUDeviceAvailable(offering, host1, virtualMachineProfile.getId())).thenReturn(false);
+
+    List<Host> result = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, offering, null, avoid, inputHosts, 1, true, account);
+
+    Assert.assertTrue(result.isEmpty());
+  }
+
+  @Test
+  public void allocateToTestHostTypeStorageShouldReturnNull() {
+    List<Host> suitableHosts = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, Host.Type.Storage, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
+
+    Assert.assertNull(suitableHosts);
+  }
+
+  @Test
+  public void allocateToTestSuitableHostsEmptyShouldReturnNull() {
+    Mockito.doReturn(serviceOffering).when(virtualMachineProfile).getServiceOffering();
+    Mockito.doReturn(vmTemplateVO).when(virtualMachineProfile).getTemplate();
+    Mockito.doReturn(account).when(virtualMachineProfile).getOwner();
+    Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
+    Mockito.doReturn(templateTag).when(vmTemplateVO).getTemplateTag();
+    Mockito.doReturn(emptyList).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    List<Host> suitableHosts = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
+
+    Assert.assertNull(suitableHosts);
+  }
+
+  @Test
+  public void allocateToTestSuitableHostsNotEmptyShouldCallAllocateToMethod() {
+    List<HostVO> hosts = new ArrayList<>(Arrays.asList(host1, host2));
+
+    Mockito.doReturn(serviceOffering).when(virtualMachineProfile).getServiceOffering();
+    Mockito.doReturn(vmTemplateVO).when(virtualMachineProfile).getTemplate();
+    Mockito.doReturn(account).when(virtualMachineProfile).getOwner();
+    Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
+    Mockito.doReturn(templateTag).when(vmTemplateVO).getTemplateTag();
+    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).allocateTo(Mockito.any(VirtualMachineProfile.class), Mockito.any(DeploymentPlan.class), Mockito.any(ServiceOffering.class), Mockito.any(VMTemplateVO.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean(), Mockito.any(Account.class));
+    Mockito.doNothing().when(firstFitAllocatorSpy).addHostsToAvoidSet(Mockito.any(Host.Type.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
+    List<Host> suitableHosts = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
+
+    Mockito.verify(firstFitAllocatorSpy, Mockito.times(1)).allocateTo(virtualMachineProfile, deploymentPlan, serviceOffering, vmTemplateVO, excludeList, hosts, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity, account);
+    Assert.assertEquals(2, suitableHosts.size());
+  }
+
+  @Test
+  public void allocateToTestProvidedHostsNotNullShouldCallAddHostsToAvoidSetMethod() {
+    List<HostVO> hosts = new ArrayList<>(Arrays.asList(host1, host2));
+
+    Mockito.doReturn(serviceOffering).when(virtualMachineProfile).getServiceOffering();
+    Mockito.doReturn(vmTemplateVO).when(virtualMachineProfile).getTemplate();
+    Mockito.doReturn(account).when(virtualMachineProfile).getOwner();
+    Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
+    Mockito.doReturn(templateTag).when(vmTemplateVO).getTemplateTag();
+    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).allocateTo(Mockito.any(VirtualMachineProfile.class), Mockito.any(DeploymentPlan.class), Mockito.any(ServiceOffering.class), Mockito.any(VMTemplateVO.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean(), Mockito.any(Account.class));
+    Mockito.doNothing().when(firstFitAllocatorSpy).addHostsToAvoidSet(Mockito.any(Host.Type.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
+    firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
+
+    Mockito.verify(firstFitAllocatorSpy, Mockito.times(1)).addHostsToAvoidSet(Mockito.any(Host.Type.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
+  }
+
+  @Test
+  public void retrieveHostsTestHostsToFilterIsNullAndHaTagNotNullShouldReturnOnlyHostsWithHaTag() {
+    List<HostVO> allUpAndEnabledHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    List<HostVO> hostsWithHaTag = new ArrayList<>(Arrays.asList(host1, host2));
+    String hostVmTag = "haVmTag";
+
+    Mockito.doReturn(hostVmTag).when(virtualMachineProfile).getParameter(Mockito.any(VirtualMachineProfile.Param.class));
+    Mockito.doReturn(allUpAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+    Mockito.doReturn(hostsWithHaTag).when(hostDaoMock).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
+    Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.anyString(), Mockito.anyList());
+    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, clusterId, podId, dcId, hostTag, templateTag);
+
+    Assert.assertEquals(2, resultHosts.size());
+    Assert.assertEquals(host1, resultHosts.get(0));
+    Assert.assertEquals(host2, resultHosts.get(1));
+  }
+
+  @Test
+  public void retrieveHostsTestHostsToFilterIsNotNullAndHaTagNotNullShouldReturnOnlyHostsToFilterWithHaTag() {
+    List<HostVO> hostsToFilter = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    List<HostVO> hostsWithHaTag = new ArrayList<>(Arrays.asList(host1, host2));
+    String hostVmTag = "haVmTag";
+
+    Mockito.doReturn(hostVmTag).when(virtualMachineProfile).getParameter(Mockito.any(VirtualMachineProfile.Param.class));
+    Mockito.doReturn(hostsWithHaTag).when(hostDaoMock).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
+    Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.anyString(), Mockito.anyList());
+    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, hostsToFilter, clusterId, podId, dcId, hostTag, templateTag);
+
+    Assert.assertEquals(2, resultHosts.size());
+    Assert.assertEquals(host1, resultHosts.get(0));
+    Assert.assertEquals(host2, resultHosts.get(1));
+  }
+
+  @Test
+  public void retrieveHostsTestHostsToFilterIsNullAndNoHaTagAndNoHostTagShouldReturnOnlyAllUpAndEnabledNonHaHosts() {
+    List<HostVO> allUpAndEnabledHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    List<HostVO> upAndEnabledHostsWithNoHa = new ArrayList<>(Arrays.asList(host1, host2));
+
+    Mockito.doReturn(allUpAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+    Mockito.doReturn(upAndEnabledHostsWithNoHa).when(resourceManagerMock).listAllUpAndEnabledNonHAHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
+    Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.nullable(String.class), Mockito.anyList());
+    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, clusterId, podId, dcId, null, null);
+
+    Assert.assertEquals(2, resultHosts.size());
+    Assert.assertEquals(host1, resultHosts.get(0));
+    Assert.assertEquals(host2, resultHosts.get(1));
+  }
+
+  @Test
+  public void retrieveHostsTestHostsToFilterIsNullAndNoHaTagWithHostTagShouldCallRetainHostsMatchingServiceOfferingAndTemplateTags() {
+    List<HostVO> allUpAndEnabledHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+
+    Mockito.doReturn(allUpAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+    Mockito.doNothing().when(firstFitAllocatorSpy).retainHostsMatchingServiceOfferingAndTemplateTags(Mockito.anyList(), Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
+    Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.anyString(), Mockito.anyList());
+    firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, clusterId, podId, dcId, hostTag, templateTag);
+
+    Mockito.verify(firstFitAllocatorSpy, Mockito.times(1)).retainHostsMatchingServiceOfferingAndTemplateTags(Mockito.anyList(), Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+  }
+
+  @Test
+  public void addHostsToAvoidSetTestAllHostsWereConsideredForAllocationShouldNotAddAnyHostToTheAvoidSet() {
+    List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+
+    Mockito.doReturn(suitableHosts).when(hostDaoMock).listAllUpAndEnabledNonHAHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.nullable(String.class));
+    firstFitAllocatorSpy.addHostsToAvoidSet(type, excludeList, clusterId, podId, dcId, suitableHosts);
+
+    Assert.assertTrue(excludeList.getHostsToAvoid().isEmpty());
+  }
+
+  @Test
+  public void addHostsToAvoidSetTestNotAllHostsWereConsideredForAllocationShouldAddHostToTheAvoidSet() {
+    List<HostVO> allUpAndEnabledNonHAHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    List<HostVO> consideredHosts = new ArrayList<>(Arrays.asList(host2, host3));
+
+    Mockito.doReturn(1L).when(host1).getId();
+    Mockito.doCallRealMethod().when(excludeList).addHost(Mockito.anyLong());
+    Mockito.doCallRealMethod().when(excludeList).getHostsToAvoid();
+    Mockito.doReturn(allUpAndEnabledNonHAHosts).when(hostDaoMock).listAllUpAndEnabledNonHAHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.nullable(String.class));
+    firstFitAllocatorSpy.addHostsToAvoidSet(type, excludeList, clusterId, podId, dcId, consideredHosts);
+
+    Assert.assertEquals(1, excludeList.getHostsToAvoid().size());
+    Assert.assertTrue(excludeList.getHostsToAvoid().contains(1L));
+  }
+
+  @Test
+  public void filterHostsWithUefiEnabledTestNoDetailWithUefiShouldNotFilterAnyHost() {
+    List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    VMInstanceDetailVO userVmDetailVO = null;
+
+    Mockito.doReturn(userVmDetailVO).when(userVmDetailsDaoMock).findDetail(Mockito.anyLong(), Mockito.anyString());
+    firstFitAllocatorSpy.filterHostsWithUefiEnabled(type, virtualMachineProfile, clusterId, podId, dcId, suitableHosts);
+
+    Assert.assertEquals(3, suitableHosts.size());
+    Assert.assertEquals(host1, suitableHosts.get(0));
+    Assert.assertEquals(host2, suitableHosts.get(1));
+    Assert.assertEquals(host3, suitableHosts.get(2));
+  }
+
+  @Test
+  public void filterHostsWithUefiEnabledTestDetailWithUefiWithInvalidModeShouldNotFilterAnyHost() {
+    List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    VMInstanceDetailVO userVmDetailVO = mock(VMInstanceDetailVO.class);
+    String bootMode = "Invalid mode";
+
+    Mockito.doReturn(bootMode).when(userVmDetailVO).getValue();
+    Mockito.doReturn(userVmDetailVO).when(userVmDetailsDaoMock).findDetail(Mockito.anyLong(), Mockito.anyString());
+    firstFitAllocatorSpy.filterHostsWithUefiEnabled(type, virtualMachineProfile, clusterId, podId, dcId, suitableHosts);
+
+    Assert.assertEquals(3, suitableHosts.size());
+    Assert.assertEquals(host1, suitableHosts.get(0));
+    Assert.assertEquals(host2, suitableHosts.get(1));
+    Assert.assertEquals(host3, suitableHosts.get(2));
+  }
+
+  @Test
+  public void filterHostsWithUefiEnabledTestDetailWithUefiWithLegacyModeShouldFilterHost() {
+    List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    List<HostVO> uefiHosts = new ArrayList<>(Arrays.asList(host2, host3));
+    VMInstanceDetailVO userVmDetailVO = mock(VMInstanceDetailVO.class);
+    String bootMode = ApiConstants.BootMode.LEGACY.toString();
+
+    Mockito.doReturn(bootMode).when(userVmDetailVO).getValue();
+    Mockito.doReturn(userVmDetailVO).when(userVmDetailsDaoMock).findDetail(Mockito.anyLong(), Mockito.anyString());
+    Mockito.doReturn(uefiHosts).when(hostDaoMock).listByHostCapability(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
+    firstFitAllocatorSpy.filterHostsWithUefiEnabled(type, virtualMachineProfile, clusterId, podId, dcId, suitableHosts);
+
+    Assert.assertEquals(2, suitableHosts.size());
+    Assert.assertEquals(host2, suitableHosts.get(0));
+    Assert.assertEquals(host3, suitableHosts.get(1));
+  }
+
+  @Test
+  public void filterHostsWithUefiEnabledTestDetailWithUefiWithSecureModeShouldFilterHost() {
+    List<HostVO> suitableHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    List<HostVO> uefiHosts = new ArrayList<>(Arrays.asList(host2, host3));
+    VMInstanceDetailVO userVmDetailVO = mock(VMInstanceDetailVO.class);
+    String bootMode = ApiConstants.BootMode.SECURE.toString();
+
+    Mockito.doReturn(bootMode).when(userVmDetailVO).getValue();
+    Mockito.doReturn(userVmDetailVO).when(userVmDetailsDaoMock).findDetail(Mockito.anyLong(), Mockito.anyString());
+    Mockito.doReturn(uefiHosts).when(hostDaoMock).listByHostCapability(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
+    firstFitAllocatorSpy.filterHostsWithUefiEnabled(type, virtualMachineProfile, clusterId, podId, dcId, suitableHosts);
+
+    Assert.assertEquals(2, suitableHosts.size());
+    Assert.assertEquals(host2, suitableHosts.get(0));
+    Assert.assertEquals(host3, suitableHosts.get(1));
+  }
+
+  @Test
+  public void offeringRequestedVGpuAndHostDoesNotHaveItTestVGpuRequestedButHostDoesNotHaveItShouldReturnTrue() {
+    Mockito.doReturn(1L).when(host1).getId();
+    Mockito.doCallRealMethod().when(excludeList).addHost(Mockito.anyLong());
+    Mockito.doCallRealMethod().when(excludeList).getHostsToAvoid();
+    Mockito.doReturn(false).when(resourceManagerMock).isGPUDeviceAvailable(Mockito.any(ServiceOffering.class), Mockito.any(Host.class),  Mockito.any(Long.class));
+    boolean result = firstFitAllocatorSpy.offeringRequestedVGpuAndHostDoesNotHaveIt(serviceOffering, virtualMachineProfile, excludeList, host1);
+
+    Assert.assertTrue(result);
+    Assert.assertEquals(1, excludeList.getHostsToAvoid().size());
+    Assert.assertTrue(excludeList.getHostsToAvoid().contains(1L));
+  }
+
+  @Test
+  public void offeringRequestedVGpuAndHostDoesNotHaveItTestVGpuRequestedAndHostDoesHaveItShouldReturnFalse() {
+    Mockito.doReturn(true).when(resourceManagerMock).isGPUDeviceAvailable(Mockito.any(ServiceOffering.class), Mockito.any(Host.class),  Mockito.any(Long.class));
+    boolean result = firstFitAllocatorSpy.offeringRequestedVGpuAndHostDoesNotHaveIt(serviceOffering, virtualMachineProfile, excludeList, host1);
+
+    Assert.assertFalse(result);
+    Mockito.verify(excludeList, Mockito.never()).addHost(Mockito.anyLong());
+  }
+
+  @Test
+  public void filterHostWithNoHvmIfTemplateRequestedTestTemplateDoesNotRequireHvm() {
+    List<HostVO> hosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+
+    Mockito.doReturn(false).when(vmTemplateVO).isRequiresHvm();
+    List<Host> suitableHosts = firstFitAllocatorSpy.filterHostWithNoHvmIfTemplateRequested(vmTemplateVO, hosts);
+
+    Assert.assertEquals(3, suitableHosts.size());
+    Assert.assertEquals(host1, suitableHosts.get(0));
+    Assert.assertEquals(host2, suitableHosts.get(1));
+    Assert.assertEquals(host3, suitableHosts.get(2));
+  }
+
+  @Test
+  public void filterHostWithNoHvmIfTemplateRequestedTestTemplateRequiresHvmShouldReturnOnlyHvmHosts() {
+    List<HostVO> hosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+
+    Mockito.doReturn(true).when(vmTemplateVO).isRequiresHvm();
+    Mockito.doReturn(true).when(firstFitAllocatorSpy).hostSupportsHVM(host1);
+    Mockito.doReturn(false).when(firstFitAllocatorSpy).hostSupportsHVM(host2);
+    Mockito.doReturn(true).when(firstFitAllocatorSpy).hostSupportsHVM(host3);
+    List<Host> suitableHosts = firstFitAllocatorSpy.filterHostWithNoHvmIfTemplateRequested(vmTemplateVO, hosts);
+
+    Assert.assertEquals(2, suitableHosts.size());
+    Assert.assertEquals(host1, suitableHosts.get(0));
+    Assert.assertEquals(host3, suitableHosts.get(1));
+  }
+
+  @Test
+  public void prioritizeHostsByGpuEnabledTestServiceOfferingRequestedVGpuViaDetailShouldDoNothing() {
+    List<Host> hosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    ServiceOfferingDetailsVO requestedVGpuType = mock(ServiceOfferingDetailsVO.class);
+
+    Mockito.doReturn(requestedVGpuType).when(serviceOfferingDetailsDao).findDetail(Mockito.anyLong(), Mockito.anyString());
+    firstFitAllocatorSpy.prioritizeHostsByGpuEnabled(serviceOffering, hosts);
+
+    Assert.assertEquals(3, hosts.size());
+    Assert.assertEquals(host1, hosts.get(0));
+    Assert.assertEquals(host2, hosts.get(1));
+    Assert.assertEquals(host3, hosts.get(2));
+  }
+
+  @Test
+  public void prioritizeHostsByGpuEnabledTestServiceOfferingRequestedVGpuViaProfileIdShouldDoNothing() {
+    List<Host> hosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+
+    Mockito.doReturn(1L).when(serviceOffering).getVgpuProfileId();
+    firstFitAllocatorSpy.prioritizeHostsByGpuEnabled(serviceOffering, hosts);
+
+    Assert.assertEquals(3, hosts.size());
+    Assert.assertEquals(host1, hosts.get(0));
+    Assert.assertEquals(host2, hosts.get(1));
+    Assert.assertEquals(host3, hosts.get(2));
+  }
+
+  @Test
+  public void prioritizeHostsByGpuEnabledTestServiceOfferingDidNotRequestVGpuShouldReorderList() {
+    List<Host> allHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+
+    Mockito.doReturn(null).when(serviceOfferingDetailsDao).findDetail(Mockito.anyLong(), Mockito.anyString());
+    Mockito.doReturn(null).when(serviceOffering).getVgpuProfileId();
+    Mockito.doReturn(1L).when(host1).getId();
+    Mockito.doReturn(2L).when(host2).getId();
+    Mockito.doReturn(3L).when(host3).getId();
+    Mockito.doReturn(true).when(resourceManagerMock).isHostGpuEnabled(1L);
+    Mockito.doReturn(false).when(resourceManagerMock).isHostGpuEnabled(2L);
+    Mockito.doReturn(false).when(resourceManagerMock).isHostGpuEnabled(3L);
+    firstFitAllocatorSpy.prioritizeHostsByGpuEnabled(serviceOffering, allHosts);
+
+    Assert.assertEquals(3, allHosts.size());
+    Assert.assertEquals(host2, allHosts.get(0));
+    Assert.assertEquals(host3, allHosts.get(1));
+    Assert.assertEquals(host1, allHosts.get(2));
+  }
+
+  @Test
+  public void prioritizeHostsByGpuEnabledTestServiceOfferingDidNotRequestVGpuShouldNotReorderListIfThereIsNoHostWithVGpu() {
+    List<Host> allHosts = new ArrayList<>(Arrays.asList(host1, host2, host3));
+
+    Mockito.doReturn(null).when(serviceOfferingDetailsDao).findDetail(Mockito.anyLong(), Mockito.anyString());
+    Mockito.doReturn(null).when(serviceOffering).getVgpuProfileId();
+    Mockito.doReturn(1L).when(host1).getId();
+    Mockito.doReturn(2L).when(host2).getId();
+    Mockito.doReturn(3L).when(host3).getId();
+    Mockito.doReturn(false).when(resourceManagerMock).isHostGpuEnabled(Mockito.anyLong());
+    firstFitAllocatorSpy.prioritizeHostsByGpuEnabled(serviceOffering, allHosts);
+
+    Assert.assertEquals(3, allHosts.size());
+    Assert.assertEquals(host1, allHosts.get(0));
+    Assert.assertEquals(host2, allHosts.get(1));
+    Assert.assertEquals(host3, allHosts.get(2));
+  }
+
+  @Test
+  public void prioritizeHostsByHvmCapabilityTestTemplateDidNotRequestedHvmShouldPutHostThatDoesNotSupportHvmInStartOfThePriorityList() {
+    List<Host> hostsToCheck = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    List<Host> prioritizedHosts = new ArrayList<>();
+
+    Mockito.doReturn(false).when(vmTemplateVO).isRequiresHvm();
+    Mockito.doReturn(true).when(firstFitAllocatorSpy).hostSupportsHVM(host1);
+    Mockito.doReturn(false).when(firstFitAllocatorSpy).hostSupportsHVM(host2);
+    Mockito.doReturn(true).when(firstFitAllocatorSpy).hostSupportsHVM(host3);
+    firstFitAllocatorSpy.prioritizeHostsByHvmCapability(vmTemplateVO, hostsToCheck, prioritizedHosts);
+
+    Assert.assertEquals(3, prioritizedHosts.size());
+    Assert.assertEquals(host2, prioritizedHosts.get(0));
+    Assert.assertEquals(host1, prioritizedHosts.get(1));
+    Assert.assertEquals(host3, prioritizedHosts.get(2));
+  }
+
+  @Test
+  public void prioritizeHostsByHvmCapabilityTestTemplateRequiresHvmShouldNotReorderList() {
+    List<Host> hostsToCheck = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    List<Host> prioritizedHosts = new ArrayList<>();
+
+    Mockito.doReturn(true).when(vmTemplateVO).isRequiresHvm();
+    firstFitAllocatorSpy.prioritizeHostsByHvmCapability(vmTemplateVO, hostsToCheck, prioritizedHosts);
+
+    Assert.assertEquals(3, prioritizedHosts.size());
+    Assert.assertEquals(host1, prioritizedHosts.get(0));
+    Assert.assertEquals(host2, prioritizedHosts.get(1));
+    Assert.assertEquals(host3, prioritizedHosts.get(2));
+  }
+
+  @Test
+  public void prioritizeHostsWithMatchingGuestOsTestShouldPutMatchingHostInHighPriorityAndHostsThatDoesNotMatchInLowPriorityList() {
+    List<Host> hostsToCheck = new ArrayList<>(Arrays.asList(host1, host2, host3));
+    List<Host> highPriorityHosts = new ArrayList<>();
+    List<Host> lowPriorityHosts = new ArrayList<>();
+    String guestOsCategory1 = "guestOsCategory1";
+    String guestOsCategory2 = "guestOsCategory2";
+
+    Mockito.doReturn(guestOsCategory1).when(firstFitAllocatorSpy).getTemplateGuestOSCategory(vmTemplateVO);
+    Mockito.doReturn(guestOsCategory1).when(firstFitAllocatorSpy).getHostGuestOSCategory(host1);
+    Mockito.doReturn(guestOsCategory2).when(firstFitAllocatorSpy).getHostGuestOSCategory(host2);
+    Mockito.doReturn(null).when(firstFitAllocatorSpy).getHostGuestOSCategory(host3);
+    firstFitAllocatorSpy.prioritizeHostsWithMatchingGuestOs(vmTemplateVO,hostsToCheck, highPriorityHosts, lowPriorityHosts);
+
+    Assert.assertEquals(1, highPriorityHosts.size());
+    Assert.assertEquals(host1, highPriorityHosts.get(0));
+    Assert.assertEquals(1, lowPriorityHosts.size());
+    Assert.assertEquals(host2, lowPriorityHosts.get(0));
+  }
+
+  @Test
+  public void testHostByCombinedCapacityOrder() {
+    // Test scenario 1: Default capacity usage (0.5 weight)
+    List<CapacityVO> mockCapacity = getHostCapacities();
+    Map<Long, Double> hostByCombinedCapacity = FirstFitAllocator.getHostByCombinedCapacities(mockCapacity, 0.5);
+
+    // Verify host ordering and capacity values
+    Long firstHostId = hostByCombinedCapacity.keySet().iterator().next();
+    Assert.assertEquals("Host with ID 1 should be first in ordering", Long.valueOf(1L), firstHostId);
+    Assert.assertEquals("Host 1 combined capacity should match expected value",
+        0.9609375, hostByCombinedCapacity.get(1L), TOLERANCE);
+    Assert.assertEquals("Host 2 combined capacity should match expected value",
+        0.9296875, hostByCombinedCapacity.get(2L), TOLERANCE);
+
+    // Test scenario 2: Modified capacity usage (0.7 weight)
+    when(mockCapacity.get(0).getUsedCapacity()).thenReturn(1500L);
+    hostByCombinedCapacity = FirstFitAllocator.getHostByCombinedCapacities(mockCapacity, 0.7);
+
+    // Verify new ordering after capacity change
+    firstHostId = hostByCombinedCapacity.keySet().iterator().next();
+    Assert.assertEquals("Host with ID 2 should be first after capacity change", Long.valueOf(2L), firstHostId);
+    Assert.assertEquals("Host 2 combined capacity should match expected value after change",
+        0.9515625, hostByCombinedCapacity.get(2L), TOLERANCE);
+    Assert.assertEquals("Host 1 combined capacity should match expected value after change",
+        0.9484375, hostByCombinedCapacity.get(1L), TOLERANCE);
+  }
+
+  List<CapacityVO> getHostCapacities() {
+    CapacityVO cpuCapacity1 = mock(CapacityVO.class);
+    when(cpuCapacity1.getHostOrPoolId()).thenReturn(1L);
+    when(cpuCapacity1.getTotalCapacity()).thenReturn(32000L);
+    when(cpuCapacity1.getReservedCapacity()).thenReturn(0L);
+    when(cpuCapacity1.getUsedCapacity()).thenReturn(500L);
+    when(cpuCapacity1.getCapacityType()).thenReturn(CapacityVO.CAPACITY_TYPE_CPU);
+
+    CapacityVO cpuCapacity2 = mock(CapacityVO.class);
+    when(cpuCapacity2.getHostOrPoolId()).thenReturn(2L);
+    when(cpuCapacity2.getTotalCapacity()).thenReturn(32000L);
+    when(cpuCapacity2.getReservedCapacity()).thenReturn(0L);
+    when(cpuCapacity2.getUsedCapacity()).thenReturn(500L);
+    when(cpuCapacity2.getCapacityType()).thenReturn(CapacityVO.CAPACITY_TYPE_CPU);
+
+    CapacityVO memCapacity1 = mock(CapacityVO.class);
+    when(memCapacity1.getHostOrPoolId()).thenReturn(1L);
+    when(memCapacity1.getTotalCapacity()).thenReturn(8589934592L);
+    when(memCapacity1.getReservedCapacity()).thenReturn(0L);
+    when(memCapacity1.getUsedCapacity()).thenReturn(536870912L);
+    when(memCapacity1.getCapacityType()).thenReturn(CapacityVO.CAPACITY_TYPE_MEMORY);
+
+    CapacityVO memCapacity2 = mock(CapacityVO.class);
+    when(memCapacity2.getHostOrPoolId()).thenReturn(2L);
+    when(memCapacity2.getTotalCapacity()).thenReturn(8589934592L);
+    when(memCapacity2.getReservedCapacity()).thenReturn(0L);
+    when(memCapacity2.getUsedCapacity()).thenReturn(1073741824L);
+    when(memCapacity1.getCapacityType()).thenReturn(CapacityVO.CAPACITY_TYPE_MEMORY);
+    return Arrays.asList(cpuCapacity1, memCapacity1, cpuCapacity2, memCapacity2);
+  }
 }
diff --git a/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java b/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
new file mode 100644
index 000000000000..ab9b322eb843
--- /dev/null
+++ b/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
@@ -0,0 +1,332 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.agent.manager.allocator.impl;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import com.cloud.agent.manager.allocator.HostAllocator;
+import com.cloud.deploy.DeploymentPlan;
+import com.cloud.deploy.DeploymentPlanner;
+import com.cloud.offering.ServiceOffering;
+import com.cloud.resource.ResourceManager;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.storage.VMTemplateVO;
+import com.cloud.vm.VirtualMachineProfile;
+import org.apache.commons.collections.CollectionUtils;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class RandomAllocatorTest {
+
+    @Mock
+    HostDao hostDao;
+
+    @Spy
+    @InjectMocks
+    RandomAllocator randomAllocator;
+
+    @Mock
+    ResourceManager resourceManagerMock;
+
+    private final Host.Type type = Host.Type.Routing;
+
+    private final Long clusterId = 1L;
+
+    private final Long podId = 2L;
+
+    private final Long zoneId = 3L;
+
+    private final List<HostVO> emptyList = new ArrayList<>();
+
+    private final String hostTag = "hostTag";
+
+    private final HostVO host1 = Mockito.mock(HostVO.class);
+
+    private final HostVO host2 = Mockito.mock(HostVO.class);
+
+    private final HostVO host3 = Mockito.mock(HostVO.class);
+
+    private final VMTemplateVO vmTemplateVO = Mockito.mock(VMTemplateVO.class);
+
+    private final ServiceOfferingVO serviceOffering = Mockito.mock(ServiceOfferingVO.class);
+
+    private final DeploymentPlanner.ExcludeList excludeList = Mockito.mock(DeploymentPlanner.ExcludeList.class);
+
+    private final VirtualMachineProfile virtualMachineProfile = Mockito.mock(VirtualMachineProfile.class);
+
+    private final DeploymentPlan deploymentPlan = Mockito.mock(DeploymentPlan.class);
+
+    private final boolean considerReservedCapacity = true;
+
+
+    @Test
+    public void testListHostsByTags() {
+        Host.Type type = Host.Type.Routing;
+        Long id = 1L;
+        String templateTag = "tag1";
+        String offeringTag = "tag2";
+        HostVO host1 = Mockito.mock(HostVO.class);
+        HostVO host2 = Mockito.mock(HostVO.class);
+        Mockito.when(hostDao.listByHostTag(type, clusterId, podId, zoneId, offeringTag)).thenReturn(List.of(host1, host2));
+
+        // No template tagged host
+        ArrayList<HostVO> noTemplateTaggedHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        Mockito.when(hostDao.listByHostTag(type, clusterId, podId, zoneId, templateTag)).thenReturn(new ArrayList<>());
+        randomAllocator.retainHostsMatchingServiceOfferingAndTemplateTags(noTemplateTaggedHosts, type, zoneId, podId, clusterId, offeringTag, templateTag);
+        Assert.assertTrue(CollectionUtils.isEmpty(noTemplateTaggedHosts));
+
+        // Different template tagged host
+        ArrayList<HostVO> differentTemplateTaggedHost = new ArrayList<>(Arrays.asList(host1, host2));
+        HostVO host3 = Mockito.mock(HostVO.class);
+        Mockito.when(hostDao.listByHostTag(type, clusterId, podId, zoneId, templateTag)).thenReturn(List.of(host3));
+        randomAllocator.retainHostsMatchingServiceOfferingAndTemplateTags(differentTemplateTaggedHost, type, zoneId, podId, clusterId, offeringTag, templateTag);
+        Assert.assertTrue(CollectionUtils.isEmpty(differentTemplateTaggedHost));
+
+        // Matching template tagged host
+        ArrayList<HostVO> matchingTemplateTaggedHost = new ArrayList<>(Arrays.asList(host1, host2));
+        Mockito.when(hostDao.listByHostTag(type, clusterId, podId, zoneId, templateTag)).thenReturn(List.of(host1));
+        randomAllocator.retainHostsMatchingServiceOfferingAndTemplateTags(matchingTemplateTaggedHost, type, zoneId, podId, clusterId, offeringTag, templateTag);
+        Assert.assertFalse(CollectionUtils.isEmpty(matchingTemplateTaggedHost));
+        Assert.assertEquals(1, matchingTemplateTaggedHost.size());
+
+        // No template tag
+        ArrayList<HostVO> noTemplateTag = new ArrayList<>(Arrays.asList(host1, host2));
+        randomAllocator.retainHostsMatchingServiceOfferingAndTemplateTags(noTemplateTag, type, zoneId, podId, clusterId, offeringTag, null);
+        Assert.assertFalse(CollectionUtils.isEmpty(noTemplateTag));
+        Assert.assertEquals(2, noTemplateTag.size());
+
+        // No offering tag
+        ArrayList<HostVO> noOfferingTag = new ArrayList<>(Arrays.asList(host1, host2));
+        randomAllocator.retainHostsMatchingServiceOfferingAndTemplateTags(noOfferingTag, type, zoneId, podId, clusterId, null, templateTag);
+        Assert.assertFalse(CollectionUtils.isEmpty(noOfferingTag));
+        Assert.assertEquals(1, noOfferingTag.size());
+    }
+
+    @Test
+    public void findSuitableHostsTestHostTypeStorageShouldReturnNull() {
+        List<Host> suitableHosts = randomAllocator.findSuitableHosts(virtualMachineProfile, deploymentPlan, Host.Type.Storage, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
+
+        Assert.assertNull(suitableHosts);
+    }
+
+    @Test
+    public void findSuitableHostsTestNoAvailableHostsShouldReturnNull() {
+        Mockito.doReturn(serviceOffering).when(virtualMachineProfile).getServiceOffering();
+        Mockito.doReturn(vmTemplateVO).when(virtualMachineProfile).getTemplate();
+        Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
+        Mockito.doReturn(emptyList).when(randomAllocator).retrieveHosts(Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.any(VMTemplateVO.class), Mockito.anyString(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        List<Host> suitableHosts = randomAllocator.findSuitableHosts(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
+
+        Assert.assertNull(suitableHosts);
+    }
+
+    @Test
+    public void findSuitableHostsTestAvailableHostsShouldCallFilterAvailableHostsOnce() {
+        List<HostVO> hosts = new ArrayList<>(Arrays.asList(host1, host2));
+
+        Mockito.doReturn(serviceOffering).when(virtualMachineProfile).getServiceOffering();
+        Mockito.doReturn(vmTemplateVO).when(virtualMachineProfile).getTemplate();
+        Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
+        Mockito.doReturn(hosts).when(randomAllocator).retrieveHosts(Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.any(VMTemplateVO.class), Mockito.anyString(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.doReturn(hosts).when(randomAllocator).filterAvailableHosts(Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyInt(), Mockito.anyBoolean(), Mockito.anyList(), Mockito.any(ServiceOffering.class));
+        List<Host> suitableHosts = randomAllocator.findSuitableHosts(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
+
+        Mockito.verify(randomAllocator, Mockito.times(1)).filterAvailableHosts(Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyInt(), Mockito.anyBoolean(), Mockito.anyList(), Mockito.any(ServiceOffering.class));
+        Assert.assertEquals(2, suitableHosts.size());
+    }
+
+    @Test
+    public void filterAvailableHostsTestAvailableHostsReachedReturnUpToLimitShouldReturnOnlyHostsWithinLimit() {
+        List<HostVO> hosts = new ArrayList<>(Arrays.asList(host1, host2));
+        int returnUpTo = 1;
+
+        Mockito.doReturn(false).when(excludeList).shouldAvoid(Mockito.any(Host.class));
+        Mockito.doReturn(true).when(randomAllocator).hostHasCpuCapabilityAndCapacity(Mockito.anyBoolean(), Mockito.any(ServiceOffering.class), Mockito.any(Host.class));
+        List<Host> suitableHosts = randomAllocator.filterAvailableHosts(excludeList, returnUpTo, considerReservedCapacity, hosts, serviceOffering);
+
+        Assert.assertEquals(1, suitableHosts.size());
+    }
+
+    @Test
+    public void filterAvailableHostsTestReturnUpToAllShouldReturnAllAvailableHosts() {
+        List<HostVO> hosts = new ArrayList<>(Arrays.asList(host1, host2));
+        int returnUpTo = HostAllocator.RETURN_UPTO_ALL;
+
+        Mockito.doReturn(false).when(excludeList).shouldAvoid(Mockito.any(Host.class));
+        Mockito.doReturn(true).when(randomAllocator).hostHasCpuCapabilityAndCapacity(Mockito.anyBoolean(), Mockito.any(ServiceOffering.class), Mockito.any(Host.class));
+        List<Host> suitableHosts = randomAllocator.filterAvailableHosts(excludeList, returnUpTo, considerReservedCapacity, hosts, serviceOffering);
+
+        Assert.assertEquals(2, suitableHosts.size());
+    }
+
+    @Test
+    public void filterAvailableHostsTestHost1InAvoidShouldOnlyReturnHost2() {
+        List<HostVO> hosts = new ArrayList<>(Arrays.asList(host1, host2));
+        int returnUpTo = HostAllocator.RETURN_UPTO_ALL;
+
+        Mockito.doReturn(true).when(excludeList).shouldAvoid(host1);
+        Mockito.doReturn(false).when(excludeList).shouldAvoid(host2);
+        Mockito.doReturn(true).when(randomAllocator).hostHasCpuCapabilityAndCapacity(Mockito.anyBoolean(), Mockito.any(ServiceOffering.class), Mockito.any(Host.class));
+        List<Host> suitableHosts = randomAllocator.filterAvailableHosts(excludeList, returnUpTo, considerReservedCapacity, hosts, serviceOffering);
+
+        Assert.assertEquals(1, suitableHosts.size());
+        Assert.assertEquals(host2, suitableHosts.get(0));
+    }
+
+    @Test
+    public void filterAvailableHostsTestOnlyHost2HasCpuCapacityAndCapabilityShouldReturnOnlyHost2() {
+        List<HostVO> hosts = new ArrayList<>(Arrays.asList(host1, host2));
+        int returnUpTo = HostAllocator.RETURN_UPTO_ALL;
+
+        Mockito.doReturn(false).when(excludeList).shouldAvoid(Mockito.any(Host.class));
+        Mockito.doReturn(false).when(randomAllocator).hostHasCpuCapabilityAndCapacity(considerReservedCapacity, serviceOffering, host1);
+        Mockito.doReturn(true).when(randomAllocator).hostHasCpuCapabilityAndCapacity(considerReservedCapacity, serviceOffering, host2);
+        List<Host> suitableHosts = randomAllocator.filterAvailableHosts(excludeList, returnUpTo, considerReservedCapacity, hosts, serviceOffering);
+
+        Assert.assertEquals(1, suitableHosts.size());
+        Assert.assertEquals(host2, suitableHosts.get(0));
+    }
+
+    @Test
+    public void retrieveHostsTestProvidedHostsNullAndNoHostTagAndNoTagRuleShouldOnlyReturnHostsWithNoTags() {
+        List<HostVO> upAndEnabledHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> hostsWithNoRuleTagsAndHostTags = new ArrayList<>(Arrays.asList(host1));
+
+        Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, null, clusterId, podId, zoneId);
+
+        Assert.assertEquals(1, availableHosts.size());
+        Assert.assertEquals(host1, availableHosts.get(0));
+    }
+
+    @Test
+    public void retrieveHostsTestProvidedHostsNullAndOnlyHostTagsRulesShouldReturnHostsThatMatchRuleTagsAndHostsWithNoTags() {
+        List<HostVO> upAndEnabledHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> hostsWithNoRuleTagsAndHostTags = new ArrayList<>(Arrays.asList(host1));
+        List<HostVO> hostsMatchingRuleTags = new ArrayList<>(Arrays.asList(host2));
+
+        Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, null, clusterId, podId, zoneId);
+
+        Assert.assertEquals(2, availableHosts.size());
+        Assert.assertEquals(host1, availableHosts.get(0));
+        Assert.assertEquals(host2, availableHosts.get(1));
+    }
+
+    @Test
+    public void retrieveHostsTestProvidedHostsNullProvidedHostTagsNotNullAndNoHostWithMatchingRuleTagsShouldReturnHostWithMatchingTags() {
+        List<HostVO> upAndEnabledHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> hostsWithMatchingTags = new ArrayList<>(Arrays.asList(host1));
+
+        Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
+        Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, hostTag, clusterId, podId, zoneId);
+
+        Assert.assertEquals(1, availableHosts.size());
+        Assert.assertEquals(host1, availableHosts.get(0));
+    }
+
+    @Test
+    public void retrieveHostsTestProvidedHostsNullProvidedHostTagsNotNullAndHostWithMatchingRuleTagsShouldReturnHostWithHostMatchingTagsAndRuleTags() {
+        List<HostVO> upAndEnabledHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> hostsWithMatchingTags = new ArrayList<>(Arrays.asList(host1));
+        List<HostVO> hostsMatchingRuleTags = new ArrayList<>(Arrays.asList(host3));
+
+        Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
+        Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, hostTag, clusterId, podId, zoneId);
+
+        Assert.assertEquals(2, availableHosts.size());
+        Assert.assertEquals(host1, availableHosts.get(0));
+        Assert.assertEquals(host3, availableHosts.get(1));
+    }
+
+    @Test
+    public void retrieveHostsTestProvidedHostsNotNullAndNoHostTagAndNoTagRuleShouldOnlyReturnHostsWithNoTags() {
+        List<HostVO> providedHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> hostsWithNoRuleTagsAndHostTags = new ArrayList<>(Arrays.asList(host1));
+
+        Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, null, clusterId, podId, zoneId);
+
+        Assert.assertEquals(1, availableHosts.size());
+        Assert.assertEquals(host1, availableHosts.get(0));
+    }
+
+    @Test
+    public void retrieveHostsTestProvidedHostsNotNullAndOnlyHostTagsRulesShouldReturnHostsThatMatchRuleTagsAndHostsWithNoTags() {
+        List<HostVO> providedHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> hostsWithNoRuleTagsAndHostTags = new ArrayList<>(Arrays.asList(host1));
+        List<HostVO> hostsMatchingRuleTags = new ArrayList<>(Arrays.asList(host2));
+
+        Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, null, clusterId, podId, zoneId);
+
+        Assert.assertEquals(2, availableHosts.size());
+        Assert.assertEquals(host1, availableHosts.get(0));
+        Assert.assertEquals(host2, availableHosts.get(1));
+    }
+
+    @Test
+    public void retrieveHostsTestProvidedHostsNotNullProvidedHostTagsNotNullAndNoHostWithMatchingRuleTagsShouldReturnHostWithMatchingTags() {
+        List<HostVO> providedHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> hostsWithMatchingTags = new ArrayList<>(Arrays.asList(host1));
+
+        Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
+        Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, hostTag, clusterId, podId, zoneId);
+
+        Assert.assertEquals(1, availableHosts.size());
+        Assert.assertEquals(host1, availableHosts.get(0));
+    }
+
+    @Test
+    public void retrieveHostsTestProvidedHostsNullNotProvidedHostTagsNotNullAndHostWithMatchingRuleTagsShouldReturnHostWithHostMatchingTagsAndRuleTags() {
+        List<HostVO> providedHosts = new ArrayList<>(Arrays.asList(host1, host2));
+        List<HostVO> hostsWithMatchingTags = new ArrayList<>(Arrays.asList(host1));
+        List<HostVO> hostsMatchingRuleTags = new ArrayList<>(Arrays.asList(host3));
+
+        Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
+        Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, hostTag, clusterId, podId, zoneId);
+
+        Assert.assertEquals(2, availableHosts.size());
+        Assert.assertEquals(host1, availableHosts.get(0));
+        Assert.assertEquals(host3, availableHosts.get(1));
+    }
+}
diff --git a/test/integration/smoke/test_vm_strict_host_tags.py b/test/integration/smoke/test_vm_strict_host_tags.py
index 2377e9a76185..aac3e1ea65f2 100644
--- a/test/integration/smoke/test_vm_strict_host_tags.py
+++ b/test/integration/smoke/test_vm_strict_host_tags.py
@@ -423,7 +423,7 @@ def test_02_restore_vm_strict_tags_failure(self):
             vm.restore(self.apiclient, templateid=self.template_t2.id, expunge=True)
             self.fail("VM should not be restored")
         except Exception as e:
-            self.assertTrue("Unable to start VM with specified id" in str(e))
+            self.assertTrue("Unable to create a deployment for " in str(e))
 
 
 class TestMigrateVMStrictTags(cloudstackTestCase):

From 1f5dba9bd2d33e95c63cc04b57df51b5c7921630 Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Thu, 30 Apr 2026 12:22:35 -0300
Subject: [PATCH 09/64] Release reserved storage resources on VM deployment
 failure (#13048)

---
 .../db/schema-42200to42210-cleanup.sql        |  6 +++++
 .../java/com/cloud/vm/UserVmManagerImpl.java  | 24 ++++++-------------
 2 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42200to42210-cleanup.sql b/engine/schema/src/main/resources/META-INF/db/schema-42200to42210-cleanup.sql
index 54baf226ac43..2f104568c140 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42200to42210-cleanup.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42200to42210-cleanup.sql
@@ -18,3 +18,9 @@
 --;
 -- Schema upgrade cleanup from 4.22.0.0 to 4.22.1.0
 --;
+
+-- Entries remaining on `cloud`.`resource_reservation` during the upgrade process are stale, so delete them.
+-- This script was added to normalize volume/primary storage reservations that got stuck due to a bug on VM deployment,
+-- but it is more interesting to introduce a smarter logic to clean these stale reservations in the future without the need
+-- for upgrades (for instance, by having a heartbeat_time column for the reservations and automatically cleaning old entries).
+DELETE FROM `cloud`.`resource_reservation`;
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index fe18263fd3bf..b23291586ef3 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -4301,9 +4301,7 @@ protected List<String> getResourceLimitStorageTags(long diskOfferingId) {
         return resourceLimitService.getResourceLimitStorageTags(diskOfferingVO);
     }
 
-    private List<CheckedReservation> reserveStorageResourcesForVm(Account owner, Long diskOfferingId, Long diskSize, List<VmDiskInfo> dataDiskInfoList, Long rootDiskOfferingId, ServiceOfferingVO offering, Long rootDiskSize) throws ResourceAllocationException {
-        List <CheckedReservation> checkedReservations = new ArrayList<>();
-
+    private void reserveStorageResourcesForVm(List<Reserver> checkedReservations, Account owner, Long diskOfferingId, Long diskSize, List<VmDiskInfo> dataDiskInfoList, Long rootDiskOfferingId, ServiceOfferingVO offering, Long rootDiskSize) throws ResourceAllocationException {
         List<String> rootResourceLimitStorageTags = getResourceLimitStorageTags(rootDiskOfferingId != null ? rootDiskOfferingId : offering.getDiskOfferingId());
         CheckedReservation rootVolumeReservation = new CheckedReservation(owner, ResourceType.volume, rootResourceLimitStorageTags, 1L, reservationDao, resourceLimitService);
         checkedReservations.add(rootVolumeReservation);
@@ -4311,12 +4309,12 @@ private List<CheckedReservation> reserveStorageResourcesForVm(Account owner, Lon
         checkedReservations.add(rootPrimaryStorageReservation);
 
         if (diskOfferingId != null) {
-            List<String> additionalResourceLimitStorageTags = diskOfferingId != null ? getResourceLimitStorageTags(diskOfferingId) : null;
+            List<String> additionalResourceLimitStorageTags = getResourceLimitStorageTags(diskOfferingId);
             DiskOfferingVO diskOffering = _diskOfferingDao.findById(diskOfferingId);
             Long size = verifyAndGetDiskSize(diskOffering, diskSize);
-            CheckedReservation additionalVolumeReservation = diskOfferingId != null ? new CheckedReservation(owner, ResourceType.volume, additionalResourceLimitStorageTags, 1L, reservationDao, resourceLimitService) : null;
+            CheckedReservation additionalVolumeReservation = new CheckedReservation(owner, ResourceType.volume, additionalResourceLimitStorageTags, 1L, reservationDao, resourceLimitService);
             checkedReservations.add(additionalVolumeReservation);
-            CheckedReservation additionalPrimaryStorageReservation = diskOfferingId != null ? new CheckedReservation(owner, ResourceType.primary_storage, additionalResourceLimitStorageTags, size, reservationDao, resourceLimitService) : null;
+            CheckedReservation additionalPrimaryStorageReservation = new CheckedReservation(owner, ResourceType.primary_storage, additionalResourceLimitStorageTags, size, reservationDao, resourceLimitService);
             checkedReservations.add(additionalPrimaryStorageReservation);
 
         }
@@ -4332,7 +4330,6 @@ private List<CheckedReservation> reserveStorageResourcesForVm(Account owner, Lon
                 checkedReservations.add(additionalPrimaryStorageReservation);
             }
         }
-        return checkedReservations;
     }
 
     private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, String displayName, Account owner,
@@ -4344,10 +4341,10 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
         Map<String, String> userVmOVFPropertiesMap, boolean dynamicScalingEnabled, String vmType, VMTemplateVO template,
         HypervisorType hypervisorType, long accountId, ServiceOfferingVO offering, boolean isIso,
         Long rootDiskOfferingId, long volumesSize, Volume volume, Snapshot snapshot) throws ResourceAllocationException {
-        List<CheckedReservation> checkedReservations = new ArrayList<>();
+        List<Reserver> checkedReservations = new ArrayList<>();
 
         try {
-            checkedReservations = reserveStorageResourcesForVm(owner, diskOfferingId, diskSize, dataDiskInfoList, rootDiskOfferingId, offering, volumesSize);
+            reserveStorageResourcesForVm(checkedReservations, owner, diskOfferingId, diskSize, dataDiskInfoList, rootDiskOfferingId, offering, volumesSize);
 
             // verify security group ids
             if (securityGroupIdList != null) {
@@ -4638,14 +4635,7 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
             logger.error("error during resource reservation and allocation", e);
             throw new CloudRuntimeException(e);
         } finally {
-            for (CheckedReservation checkedReservation : checkedReservations) {
-                try {
-                    checkedReservation.close();
-                } catch (Exception e) {
-                    logger.error("error during resource reservation and allocation", e);
-                    throw new CloudRuntimeException(e);
-                }
-            }
+            ReservationHelper.closeAll(checkedReservations);
         }
     }
 

From c07f1fd5d29ab2c6ba3a419dbf6d21b0a4f3900b Mon Sep 17 00:00:00 2001
From: Henrique Sato <henriquesato2003@gmail.com>
Date: Fri, 1 May 2026 06:54:40 -0300
Subject: [PATCH 10/64] Number of running and stopped VMs as preset variables
 for `Network` type Quota tariffs (#11689)

Co-authored-by: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
---
 .../presetvariables/PresetVariableHelper.java | 14 ++++-
 .../presetvariables/ResourceCounting.java     | 52 +++++++++++++++++++
 .../activationrule/presetvariables/Value.java | 11 ++++
 .../PresetVariableHelperTest.java             | 37 +++++++++++--
 .../response/QuotaResponseBuilderImpl.java    |  3 +-
 5 files changed, 112 insertions(+), 5 deletions(-)
 create mode 100644 framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/ResourceCounting.java

diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/PresetVariableHelper.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/PresetVariableHelper.java
index cd87052e878c..23020292027c 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/PresetVariableHelper.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/PresetVariableHelper.java
@@ -35,6 +35,7 @@
 import javax.inject.Inject;
 
 import com.cloud.storage.StoragePoolTagVO;
+import com.cloud.vm.VirtualMachine;
 import org.apache.cloudstack.acl.RoleVO;
 import org.apache.cloudstack.acl.dao.RoleDao;
 import org.apache.cloudstack.backup.BackupOfferingVO;
@@ -783,10 +784,21 @@ protected void loadPresetVariableValueForNetwork(UsageVO usageRecord, Value valu
         value.setId(network.getUuid());
         value.setName(network.getName());
         value.setState(usageRecord.getState());
-
+        value.setResourceCounting(getPresetVariableValueNetworkResourceCounting(networkId));
         value.setNetworkOffering(getPresetVariableValueNetworkOffering(network.getNetworkOfferingId()));
     }
 
+    protected ResourceCounting getPresetVariableValueNetworkResourceCounting(Long networkId) {
+        ResourceCounting resourceCounting = new ResourceCounting();
+        List<VMInstanceVO> vmInstancesVO = vmInstanceDao.listNonRemovedVmsByTypeAndNetwork(networkId, VirtualMachine.Type.User);
+        int runningVms = (int) vmInstancesVO.stream().filter(vm -> vm.getState().equals(VirtualMachine.State.Running)).count();
+        int stoppedVms = (int) vmInstancesVO.stream().filter(vm -> vm.getState().equals(VirtualMachine.State.Stopped)).count();
+
+        resourceCounting.setRunningVms(runningVms);
+        resourceCounting.setStoppedVms(stoppedVms);
+        return resourceCounting;
+    }
+
     protected GenericPresetVariable getPresetVariableValueNetworkOffering(Long networkOfferingId) {
         NetworkOfferingVO networkOfferingVo = networkOfferingDao.findByIdIncludingRemoved(networkOfferingId);
         validateIfObjectIsNull(networkOfferingVo, networkOfferingId, "network offering");
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/ResourceCounting.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/ResourceCounting.java
new file mode 100644
index 000000000000..75049c3486a3
--- /dev/null
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/ResourceCounting.java
@@ -0,0 +1,52 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.quota.activationrule.presetvariables;
+
+
+import org.apache.cloudstack.quota.constant.QuotaTypes;
+import org.apache.commons.lang3.builder.ToStringBuilder;
+import org.apache.commons.lang3.builder.ToStringStyle;
+
+public class ResourceCounting {
+
+    @PresetVariableDefinition(description = "The number of running user instances.", supportedTypes = {QuotaTypes.NETWORK})
+    private int runningVms;
+    @PresetVariableDefinition(description = "The number of stopped user instances.", supportedTypes = {QuotaTypes.NETWORK})
+    private int stoppedVms;
+
+    public int getRunningVms() {
+        return runningVms;
+    }
+
+    public void setRunningVms(int runningVms) {
+        this.runningVms = runningVms;
+    }
+
+    public int getStoppedVms() {
+        return stoppedVms;
+    }
+
+    public void setStoppedVms(int stoppedVms) {
+        this.stoppedVms = stoppedVms;
+    }
+
+    @Override
+    public String toString() {
+        return ToStringBuilder.reflectionToString(this, ToStringStyle.JSON_STYLE);
+    }
+}
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/Value.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/Value.java
index aff2c040e742..286fe5c60fd5 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/Value.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/activationrule/presetvariables/Value.java
@@ -84,6 +84,9 @@ public class Value extends GenericPresetVariable {
     @PresetVariableDefinition(description = "Backup offering of the backup.", supportedTypes = {QuotaTypes.BACKUP})
     private BackupOffering backupOffering;
 
+    @PresetVariableDefinition(description = "The amount of resources of the usage type.")
+    private ResourceCounting resourceCounting;
+
     @PresetVariableDefinition(description = "The hypervisor where the resource was deployed. Values can be: XenServer, KVM, VMware, Hyperv, BareMetal, Ovm, Ovm3 and LXC.",
             supportedTypes = {QuotaTypes.RUNNING_VM, QuotaTypes.ALLOCATED_VM, QuotaTypes.VM_SNAPSHOT, QuotaTypes.SNAPSHOT})
     private String hypervisorType;
@@ -262,6 +265,14 @@ public void setState(String state) {
         this.state = state;
     }
 
+    public ResourceCounting getResourceCounting() {
+        return resourceCounting;
+    }
+
+    public void setResourceCounting(ResourceCounting resourceCounting) {
+        this.resourceCounting = resourceCounting;
+    }
+
     public GenericPresetVariable getNetworkOffering() {
         return networkOffering;
     }
diff --git a/framework/quota/src/test/java/org/apache/cloudstack/quota/activationrule/presetvariables/PresetVariableHelperTest.java b/framework/quota/src/test/java/org/apache/cloudstack/quota/activationrule/presetvariables/PresetVariableHelperTest.java
index fb093a456790..bcdbc3b46cec 100644
--- a/framework/quota/src/test/java/org/apache/cloudstack/quota/activationrule/presetvariables/PresetVariableHelperTest.java
+++ b/framework/quota/src/test/java/org/apache/cloudstack/quota/activationrule/presetvariables/PresetVariableHelperTest.java
@@ -31,11 +31,13 @@
 import com.cloud.dc.ClusterDetailsVO;
 import com.cloud.host.HostTagVO;
 import com.cloud.hypervisor.Hypervisor;
+import com.cloud.network.Network;
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.network.vpc.VpcOfferingVO;
 import com.cloud.network.vpc.VpcVO;
 import com.cloud.network.vpc.dao.VpcOfferingDao;
 import com.cloud.storage.StoragePoolTagVO;
+import com.cloud.vm.VirtualMachine;
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.acl.RoleVO;
 import org.apache.cloudstack.acl.dao.RoleDao;
@@ -238,6 +240,8 @@ private Value getValueForTests() {
         value.setVmSnapshotType(VMSnapshot.Type.Disk.toString());
         value.setComputingResources(getComputingResourcesForTests());
         value.setVolumeType(Volume.Type.DATADISK.toString());
+        value.setState(Network.State.Implemented.toString());
+        value.setResourceCounting(getResourceCountingForTests());
         value.setNetworkOffering(getNetworkOfferingForTests());
         value.setVpcOffering(getVpcOfferingForTests());
         return value;
@@ -276,6 +280,13 @@ private Configuration getConfigurationForTests() {
         return configuration;
     }
 
+    private ResourceCounting getResourceCountingForTests() {
+        ResourceCounting resourceCounting = new ResourceCounting();
+        resourceCounting.setRunningVms(1);
+        resourceCounting.setStoppedVms(1);
+        return resourceCounting;
+    }
+
     private List<HostTagVO> getHostTagsForTests() {
         return Arrays.asList(new HostTagVO(1, "tag1", false), new HostTagVO(1, "tag2", false));
     }
@@ -1343,8 +1354,8 @@ public void loadPresetVariableValueForNetworkTestRecordIsNetworkSetFields() {
         Mockito.doReturn(expected.getId()).when(networkVoMock).getUuid();
         Mockito.doReturn(expected.getName()).when(networkVoMock).getName();
         Mockito.doReturn(expected.getState()).when(usageVoMock).getState();
+        Mockito.doReturn(expected.getResourceCounting()).when(presetVariableHelperSpy).getPresetVariableValueNetworkResourceCounting(Mockito.anyLong());
         Mockito.doReturn(expected.getNetworkOffering()).when(presetVariableHelperSpy).getPresetVariableValueNetworkOffering(Mockito.anyLong());
-
         Mockito.doReturn(UsageTypes.NETWORK).when(usageVoMock).getUsageType();
 
         Value result = new Value();
@@ -1352,7 +1363,27 @@ public void loadPresetVariableValueForNetworkTestRecordIsNetworkSetFields() {
 
         assertPresetVariableIdAndName(expected, result);
         Assert.assertEquals(expected.getState(), result.getState());
-        Assert.assertEquals(expected.getNetworkOffering(), result.getNetworkOffering());
+        Assert.assertEquals(expected.getResourceCounting(), result.getResourceCounting());
+    }
+
+    @Test
+    public void getPresetVariableValueNetworkResourceCountingTestSetValueAndReturnObject() {
+        VMInstanceVO vmInstanceVoMock1 = Mockito.spy(VMInstanceVO.class);
+        vmInstanceVoMock1.setState(VirtualMachine.State.Stopped);
+
+        VMInstanceVO vmInstanceVoMock2 = Mockito.spy(VMInstanceVO.class);
+        vmInstanceVoMock2.setState(VirtualMachine.State.Running);
+
+        Mockito.doReturn(List.of(vmInstanceVoMock1, vmInstanceVoMock2)).when(vmInstanceDaoMock).listNonRemovedVmsByTypeAndNetwork(Mockito.anyLong(), Mockito.any());
+
+        mockMethodValidateIfObjectIsNull();
+
+        ResourceCounting expected = getResourceCountingForTests();
+
+        ResourceCounting result = presetVariableHelperSpy.getPresetVariableValueNetworkResourceCounting(1L);
+
+        Assert.assertEquals(expected.getRunningVms(), result.getRunningVms());
+        Assert.assertEquals(expected.getStoppedVms(), result.getStoppedVms());
     }
 
     @Test
@@ -1362,7 +1393,7 @@ public void loadPresetVariableValueForVpcTestRecordIsNotAVpcDoNothing() {
             presetVariableHelperSpy.loadPresetVariableValueForVpc(usageVoMock, null);
         });
 
-        Mockito.verifyNoInteractions(networkDaoMock);
+        Mockito.verifyNoInteractions(vpcDaoMock);
     }
 
     @Test
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
index 173c0723731b..c919bb5887c1 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
@@ -98,6 +98,7 @@
 import org.apache.cloudstack.quota.activationrule.presetvariables.GenericPresetVariable;
 import org.apache.cloudstack.quota.activationrule.presetvariables.PresetVariableDefinition;
 import org.apache.cloudstack.quota.activationrule.presetvariables.PresetVariables;
+import org.apache.cloudstack.quota.activationrule.presetvariables.ResourceCounting;
 import org.apache.cloudstack.quota.activationrule.presetvariables.Value;
 import org.apache.cloudstack.quota.constant.QuotaConfig;
 import org.apache.cloudstack.quota.constant.QuotaTypes;
@@ -185,7 +186,7 @@ public class QuotaResponseBuilderImpl implements QuotaResponseBuilder {
     private VolumeDao volumeDao;
 
 
-    private final Class<?>[] assignableClasses = {GenericPresetVariable.class, ComputingResources.class};
+    private final Class<?>[] assignableClasses = {GenericPresetVariable.class, ComputingResources.class, ResourceCounting.class};
 
     private Set<Account.Type> accountTypesThatCanListAllQuotaSummaries = Sets.newHashSet(Account.Type.ADMIN, Account.Type.DOMAIN_ADMIN);
 

From 08b1d38755727b615fda6a668ba9ac035f3b8002 Mon Sep 17 00:00:00 2001
From: Eugenio Grosso <eugenio.grosso@gmail.com>
Date: Sat, 2 May 2026 11:21:13 +0100
Subject: [PATCH 11/64] adaptive: honor user-provided capacityBytes when
 provider stats are unavailable (#13059)

Signed-off-by: Eugenio Grosso <eugenio.grosso@gmail.com>
Co-authored-by: Eugenio Grosso <egrosso@purestorage.com>
---
 .../lifecycle/AdaptiveDataStoreLifeCycleImpl.java   | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/plugins/storage/volume/adaptive/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/AdaptiveDataStoreLifeCycleImpl.java b/plugins/storage/volume/adaptive/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/AdaptiveDataStoreLifeCycleImpl.java
index 771f79887e0f..c8efc08c2892 100644
--- a/plugins/storage/volume/adaptive/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/AdaptiveDataStoreLifeCycleImpl.java
+++ b/plugins/storage/volume/adaptive/src/main/java/org/apache/cloudstack/storage/datastore/lifecycle/AdaptiveDataStoreLifeCycleImpl.java
@@ -217,13 +217,14 @@ public DataStore initialize(Map<String, Object> dsInfos) {
             // validate the provided details are correct/valid for the provider
             api.validate();
 
-            // if we have user-provided capacity bytes, validate they do not exceed the manaaged storage capacity bytes
+            // User-provided capacityBytes always wins; validate against storage stats only when
+            // the provider could actually report them. If the provider cannot (empty pod with no
+            // footprint, no quota set, transient probe failure), fall through and use what the
+            // user supplied rather than failing the whole registration.
             ProviderVolumeStorageStats stats = api.getManagedStorageStats();
-            if (capacityBytes != null && capacityBytes != 0 && stats != null) {
-                if (stats.getCapacityInBytes() > 0) {
-                    if (stats.getCapacityInBytes() < capacityBytes) {
-                        throw new InvalidParameterValueException("Capacity bytes provided exceeds the capacity of the storage endpoint: provided by user: " + capacityBytes + ", storage capacity from storage provider: " + stats.getCapacityInBytes());
-                    }
+            if (capacityBytes != null && capacityBytes > 0) {
+                if (stats != null && stats.getCapacityInBytes() > 0 && stats.getCapacityInBytes() < capacityBytes) {
+                    throw new InvalidParameterValueException("Provided capacity bytes exceed the capacity of the storage endpoint: provided by user: " + capacityBytes + ", storage capacity from storage provider: " + stats.getCapacityInBytes());
                 }
                 parameters.setCapacityBytes(capacityBytes);
             }

From a17bff9ba8770349c3b8344cb45778e89d4379f4 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Sun, 3 May 2026 22:09:41 +0530
Subject: [PATCH 12/64] ui: fix webhook filters listing (#13068)

---
 ui/public/locales/en.json                    | 1 +
 ui/src/components/view/ListView.vue          | 2 +-
 ui/src/components/view/WebhookFiltersTab.vue | 3 ++-
 3 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 4a23b454252a..e2045eba8dfe 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -4167,6 +4167,7 @@
 "message.warn.select.template": "Please select a Template for Registration.",
 "message.warn.zone.mtu.update": "Please note that this limit won't affect pre-existing Network's MTU settings",
 "message.webhook.deliveries.time.filter": "Webhook deliveries list can be filtered based on date-time. Select 'Custom' for specifying start and end date range.",
+"message.webhook.filter.add": "Webhook deliveries can be controlled using filters (currently by Event type). Please select the parameters to add to the applied filters list.",
 "message.zone.creation.complete": "Zone creation complete.",
 "message.zone.detail.description": "Populate Zone details.",
 "message.zone.detail.hint": "A Zone is the largest organizational unit in CloudStack, and it typically corresponds to a single datacenter. Zones provide physical isolation and redundancy. A zone consists of one or more Pods (each of which contains hosts and primary storage servers) and a secondary storage server which is shared by all pods in the zone.",
diff --git a/ui/src/components/view/ListView.vue b/ui/src/components/view/ListView.vue
index 66dd6b3db9e6..b03293efacae 100644
--- a/ui/src/components/view/ListView.vue
+++ b/ui/src/components/view/ListView.vue
@@ -949,7 +949,7 @@
             style="margin-left: 5px"
             :actions="actions"
             :resource="record"
-            :enabled="quickViewEnabled() && actions.length > 0"
+            :enabled="quickViewEnabled(actions, columns, column.key)"
             @exec-action="$parent.execAction"
           />
         </template>
diff --git a/ui/src/components/view/WebhookFiltersTab.vue b/ui/src/components/view/WebhookFiltersTab.vue
index 2d276e2a3cf0..513720a86258 100644
--- a/ui/src/components/view/WebhookFiltersTab.vue
+++ b/ui/src/components/view/WebhookFiltersTab.vue
@@ -18,6 +18,7 @@
 <template>
   <div>
     <div class="add-row">
+      <p>{{ $t('message.webhook.filter.add') }}</p>
       <a-form
         :ref="addFormRef"
         :model="addFilterForm"
@@ -90,7 +91,7 @@
       {{ (selectedRowKeys && selectedRowKeys.length > 0) ? $t('label.action.delete.webhook.filters') : $t('label.action.clear.webhook.filters') }}
     </a-button>
     <list-view
-      :tabLoading="tabLoading"
+      :loading="tabLoading"
       :columns="columns"
       :items="filters"
       :actions="actions"

From 1e512ab9c6505641a944db2c878514e189b9f5f6 Mon Sep 17 00:00:00 2001
From: codingkiddo <codingkiddo@gmail.com>
Date: Sun, 3 May 2026 22:15:54 +0530
Subject: [PATCH 13/64] Skip QemuImgTest when libvirt native library cannot
 load (#13086)

Co-authored-by: Vinod Kumar <vinodkumar@192.168.1.3>
---
 .../test/java/org/apache/cloudstack/utils/qemu/QemuImgTest.java | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/hypervisors/kvm/src/test/java/org/apache/cloudstack/utils/qemu/QemuImgTest.java b/plugins/hypervisors/kvm/src/test/java/org/apache/cloudstack/utils/qemu/QemuImgTest.java
index 5a0274257764..140302590ba2 100644
--- a/plugins/hypervisors/kvm/src/test/java/org/apache/cloudstack/utils/qemu/QemuImgTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/org/apache/cloudstack/utils/qemu/QemuImgTest.java
@@ -57,7 +57,7 @@ public static void setUp() {
             Connect conn = new Connect("qemu:///system", false);
             conn.getVersion();
             libVirtAvailable = true;
-        } catch (LibvirtException ignored) {}
+        } catch (LibvirtException | UnsatisfiedLinkError | ExceptionInInitializerError ignored) {}
         Assume.assumeTrue("libvirt not available", libVirtAvailable);
     }
 

From 519715e81a65b9df4fa4ef589b2bfd2cd79f442e Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Mon, 4 May 2026 14:41:35 +0530
Subject: [PATCH 14/64] Fix id in listguestosmapping search (#13082)

---
 .../src/main/java/com/cloud/server/ManagementServerImpl.java  | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index 4875002074c6..470c968d0de9 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -3033,7 +3033,7 @@ public Pair<List<? extends GuestOSHypervisor>, Integer> listGuestOSMappingByCrit
         final String hypervisor = cmd.getHypervisor();
         final String hypervisorVersion = cmd.getHypervisorVersion();
 
-        //throw exception if hypervisor name is not passed, but version is
+        //throw exception if hypervisor name is not passed, but a version is
         if (hypervisorVersion != null && (hypervisor == null || hypervisor.isEmpty())) {
             throw new InvalidParameterValueException("Hypervisor version parameter cannot be used without specifying a hypervisor : XenServer, KVM or VMware");
         }
@@ -3051,7 +3051,7 @@ public Pair<List<? extends GuestOSHypervisor>, Integer> listGuestOSMappingByCrit
         final SearchCriteria<GuestOSHypervisorVO> sc = sb.create();
 
         if (id != null) {
-            sc.setParameters("id", SearchCriteria.Op.EQ, id);
+            sc.setParameters("id", id);
         }
 
         if (osTypeId != null) {

From 5b9a3d7d320e2dd5bf58d517007d80ce347d89a8 Mon Sep 17 00:00:00 2001
From: Rene Peinthor <rene.peinthor@linbit.com>
Date: Mon, 4 May 2026 11:13:06 +0200
Subject: [PATCH 15/64] linstor: Fix a file handle resource leak opening
 template.properties (#13091)

---
 .../cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java   | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
index 2b11c83c8021..77953a32e63a 100644
--- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
+++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
@@ -585,8 +585,8 @@ private static boolean isSystemTemplate(KVMPhysicalDisk disk) {
         Path propFile = diskPath.getParent().resolve("template.properties");
         if (Files.exists(propFile)) {
             java.util.Properties templateProps = new java.util.Properties();
-            try {
-                templateProps.load(new FileInputStream(propFile.toFile()));
+            try (FileInputStream in = new FileInputStream(propFile.toFile())) {
+                templateProps.load(in);
                 String desc = templateProps.getProperty("description");
                 if (desc != null && desc.startsWith("SystemVM Template")) {
                     return true;

From a7c2a059f5d7517db78310bab48dcb2a6acd0924 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Mon, 4 May 2026 14:47:27 +0530
Subject: [PATCH 16/64] Update mysql java connector version to 8.4.0 (matching
 version for MySQL 8.4) (#12640)

* MySQL 8.4 support / update mysql java connector version to 8.4.0

* Remove separate connector version

* Update cloud spec

* Update authentication plugin to caching_sha2_password (mysql_native_password is deprecated)
---
 .github/workflows/ci.yml                             |  2 +-
 engine/storage/snapshot/pom.xml                      |  4 ++--
 framework/db/pom.xml                                 |  4 ++--
 packaging/systemd/cloudstack-management.default      |  2 +-
 packaging/systemd/cloudstack-usage.default           |  2 +-
 plugins/network-elements/globodns/pom.xml            |  4 ++--
 plugins/network-elements/tungsten/pom.xml            |  4 ++--
 pom.xml                                              | 12 +++---------
 setup/db/deploy-db-dev.sh                            |  5 +++--
 tools/docker/Dockerfile                              |  2 +-
 tools/marvin/setup.py                                |  2 +-
 .../java/com/cloud/usage/UsageSanityChecker.java     |  2 +-
 12 files changed, 20 insertions(+), 25 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1c64df86cbaa..efd71b5da5df 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -278,7 +278,7 @@ jobs:
           # https://github.com/actions/runner-images/blob/main/images/linux/Ubuntu2004-Readme.md#mysql
           sudo apt-get install -y mysql-server
           sudo systemctl start mysql
-          sudo mysql -uroot -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password BY ''; FLUSH PRIVILEGES;"
+          sudo mysql -uroot -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY ''; FLUSH PRIVILEGES;"
           sudo systemctl restart mysql
           sudo mysql -uroot -e "SELECT VERSION();"
 
diff --git a/engine/storage/snapshot/pom.xml b/engine/storage/snapshot/pom.xml
index a6db00995c2f..523d82e45651 100644
--- a/engine/storage/snapshot/pom.xml
+++ b/engine/storage/snapshot/pom.xml
@@ -57,8 +57,8 @@
             <scope>compile</scope>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/framework/db/pom.xml b/framework/db/pom.xml
index a71e467a23bd..1e83e2f9b93d 100644
--- a/framework/db/pom.xml
+++ b/framework/db/pom.xml
@@ -53,8 +53,8 @@
             <artifactId>commons-pool2</artifactId>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
         </dependency>
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
diff --git a/packaging/systemd/cloudstack-management.default b/packaging/systemd/cloudstack-management.default
index 994a1ee86997..a41338beda68 100644
--- a/packaging/systemd/cloudstack-management.default
+++ b/packaging/systemd/cloudstack-management.default
@@ -17,7 +17,7 @@
 
 JAVA_OPTS="-Djava.security.properties=/etc/cloudstack/management/java.security.ciphers -Djava.awt.headless=true -Xmx2G -XX:+UseParallelGC -XX:MaxGCPauseMillis=500 -XX:+HeapDumpOnOutOfMemoryError -XX:HeapDumpPath=/var/log/cloudstack/management/ -XX:ErrorFile=/var/log/cloudstack/management/cloudstack-management.err --add-opens=java.base/java.lang=ALL-UNNAMED --add-exports=java.base/sun.security.x509=ALL-UNNAMED"
 
-CLASSPATH="/usr/share/cloudstack-management/lib/*:/etc/cloudstack/management:/usr/share/cloudstack-common:/usr/share/cloudstack-management/setup:/usr/share/cloudstack-management:/usr/share/java/mysql-connector-java.jar:/usr/share/cloudstack-mysql-ha/lib/*"
+CLASSPATH="/usr/share/cloudstack-management/lib/*:/etc/cloudstack/management:/usr/share/cloudstack-common:/usr/share/cloudstack-management/setup:/usr/share/cloudstack-management:/usr/share/cloudstack-mysql-ha/lib/*"
 
 BOOTSTRAP_CLASS=org.apache.cloudstack.ServerDaemon
 
diff --git a/packaging/systemd/cloudstack-usage.default b/packaging/systemd/cloudstack-usage.default
index 493f40c277a2..36b71ac3e0d6 100644
--- a/packaging/systemd/cloudstack-usage.default
+++ b/packaging/systemd/cloudstack-usage.default
@@ -17,7 +17,7 @@
 
 JAVA_OPTS="-Xms256m -Xmx2048m --add-opens=java.base/java.lang=ALL-UNNAMED"
 
-CLASSPATH="/usr/share/cloudstack-usage/*:/usr/share/cloudstack-usage/lib/*:/usr/share/cloudstack-mysql-ha/lib/*:/etc/cloudstack/usage:/usr/share/java/mysql-connector-java.jar"
+CLASSPATH="/usr/share/cloudstack-usage/*:/usr/share/cloudstack-usage/lib/*:/usr/share/cloudstack-mysql-ha/lib/*:/etc/cloudstack/usage"
 
 JAVA_CLASS=com.cloud.usage.UsageServer
 
diff --git a/plugins/network-elements/globodns/pom.xml b/plugins/network-elements/globodns/pom.xml
index 8aeb86bf7ee9..abe8fc0d1868 100644
--- a/plugins/network-elements/globodns/pom.xml
+++ b/plugins/network-elements/globodns/pom.xml
@@ -33,8 +33,8 @@
             <artifactId>globodns-client</artifactId>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/plugins/network-elements/tungsten/pom.xml b/plugins/network-elements/tungsten/pom.xml
index b71609e7a25c..5038d51fa3d4 100644
--- a/plugins/network-elements/tungsten/pom.xml
+++ b/plugins/network-elements/tungsten/pom.xml
@@ -41,8 +41,8 @@
             <artifactId>reload4j</artifactId>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
             <scope>test</scope>
         </dependency>
     </dependencies>
diff --git a/pom.xml b/pom.xml
index 3843dc6817cd..e5d7d3e57753 100644
--- a/pom.xml
+++ b/pom.xml
@@ -170,7 +170,7 @@
         <cs.libvirt-java.version>0.5.3</cs.libvirt-java.version>
         <cs.mail.version>1.5.0-b01</cs.mail.version>
         <cs.mustache.version>0.9.14</cs.mustache.version>
-        <cs.mysql.version>8.0.33</cs.mysql.version>
+        <cs.mysql.version>8.4.0</cs.mysql.version>
         <cs.neethi.version>2.0.4</cs.neethi.version>
         <cs.nitro.version>10.1</cs.nitro.version>
         <cs.opensaml.version>2.6.6</cs.opensaml.version>
@@ -465,8 +465,8 @@
                 <version>${cs.reload4j.version}</version>
             </dependency>
             <dependency>
-                <groupId>mysql</groupId>
-                <artifactId>mysql-connector-java</artifactId>
+                <groupId>com.mysql</groupId>
+                <artifactId>mysql-connector-j</artifactId>
                 <version>${cs.mysql.version}</version>
                 <scope>test</scope>
             </dependency>
@@ -481,12 +481,6 @@
                     </exclusion>
                 </exclusions>
             </dependency>
-            <dependency>
-                <groupId>com.mysql</groupId>
-                <artifactId>mysql-connector-j</artifactId>
-                <version>${cs.mysql.version}</version>
-                <scope>test</scope>
-            </dependency>
             <dependency>
                 <groupId>net.sf.ehcache</groupId>
                 <artifactId>ehcache-core</artifactId>
diff --git a/setup/db/deploy-db-dev.sh b/setup/db/deploy-db-dev.sh
index 7896276f8f97..4e0814e0c3f1 100755
--- a/setup/db/deploy-db-dev.sh
+++ b/setup/db/deploy-db-dev.sh
@@ -104,9 +104,10 @@ CP=./
 
 CP=${CP}$PATHSEP$CATALINA_HOME/conf
 
-# Add mysql jar from mysql-connector-java package to CP
+# Add mysql jar from mysql-connector-j package to CP
 # for Jenkins
-CP=${CP}${PATHSEP}/usr/share/java/mysql-connector-java.jar
+MYSQL_CONNECTOR_VERSION = '8.4.0'
+CP=${CP}${PATHSEP}/usr/share/java/mysql-connector-j-${MYSQL_CONNECTOR_VERSION}.jar
 
 for file in $CATALINA_HOME/webapps/client/WEB-INF/lib/*.jar
 do
diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
index 7b617249baa0..8e7e43b842f0 100644
--- a/tools/docker/Dockerfile
+++ b/tools/docker/Dockerfile
@@ -58,7 +58,7 @@ RUN mvn -Pdeveloper -Dsimulator -DskipTests clean install
 RUN find /var/lib/mysql -type f -exec touch {} \; && \
     (/usr/bin/mysqld_safe &) && \
     sleep 5; \
-    mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH mysql_native_password by ''" --connect-expired-password; \
+    mysql -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password by ''" --connect-expired-password; \
     mvn -Pdeveloper -pl developer -Ddeploydb; \
     mvn -Pdeveloper -pl developer -Ddeploydb-simulator; \
     MARVIN_FILE=`find /root/tools/marvin/dist/ -name "Marvin*.tar.gz"`; \
diff --git a/tools/marvin/setup.py b/tools/marvin/setup.py
index c7f58131f161..919b544d1339 100644
--- a/tools/marvin/setup.py
+++ b/tools/marvin/setup.py
@@ -46,7 +46,7 @@
                 "marvin.sandbox.basic"],
       license="LICENSE.txt",
       install_requires=[
-          "mysql-connector-python <= 8.0.30",
+          "mysql-connector-python <= 8.4.0",
           "requests >= 2.2.1",
           "paramiko >= 1.13.0",
           "nose >= 1.3.3",
diff --git a/usage/src/main/java/com/cloud/usage/UsageSanityChecker.java b/usage/src/main/java/com/cloud/usage/UsageSanityChecker.java
index d5dee9b00bc0..77f626246ccf 100644
--- a/usage/src/main/java/com/cloud/usage/UsageSanityChecker.java
+++ b/usage/src/main/java/com/cloud/usage/UsageSanityChecker.java
@@ -289,7 +289,7 @@ protected Connection getConnection() {
     }
 
     /**
-     * usage something like: /usr/bin/java -Xmx2G -cp /usr/share/cloudstack-usage/*:/usr/share/cloudstack-usage/lib/*:/usr/share/cloudstack-mysql-ha/lib/*:/etc/cloudstack/usage:/usr/share/java/mysql-connector-java.jar:/usr/share/cloudstack-common com.cloud.usage.UsageSanityChecker
+     * usage something like: /usr/bin/java -Xmx2G -cp /usr/share/cloudstack-usage/*:/usr/share/cloudstack-usage/lib/*:/usr/share/cloudstack-mysql-ha/lib/*:/etc/cloudstack/usage:/usr/share/cloudstack-common com.cloud.usage.UsageSanityChecker
      * @param args none
      */
     public static void main(String[] args) {

From 96ca1b2a7c1c80bc5b284e008e9c96d49a276b4a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernardo=20De=20Marco=20Gon=C3=A7alves?=
 <bernardomg2004@gmail.com>
Date: Wed, 6 May 2026 13:41:11 -0300
Subject: [PATCH 17/64] Add option to control MAC address reuse for VR public
 NICs (#13001)

---
 .../main/java/com/cloud/network/Network.java  |   2 +
 .../com/cloud/network/NetworkProfile.java     |   5 +
 .../main/java/com/cloud/network/vpc/Vpc.java  |   2 +
 .../com/cloud/network/vpc/VpcService.java     |   4 +-
 .../apache/cloudstack/api/ApiConstants.java   |   7 +
 .../user/network/CreateNetworkCmd.java        |   9 +
 .../user/network/UpdateNetworkCmd.java        |   9 +
 .../api/command/user/vpc/CreateVPCCmd.java    |   9 +
 .../api/command/user/vpc/UpdateVPCCmd.java    |   9 +
 .../api/response/NetworkResponse.java         |   8 +
 .../cloudstack/api/response/VpcResponse.java  |   8 +
 .../command/user/vpc/UpdateVPCCmdTest.java    |   2 +-
 .../service/NetworkOrchestrationService.java  |   5 +
 .../orchestration/NetworkOrchestrator.java    |  24 +-
 .../java/com/cloud/network/dao/NetworkVO.java |  13 +
 .../java/com/cloud/network/vpc/VpcVO.java     |  12 +
 .../META-INF/db/schema-42210to42300.sql       |   4 +
 .../java/com/cloud/api/ApiResponseHelper.java |   8 +
 .../network/NetworkMigrationManagerImpl.java  |   2 +-
 .../com/cloud/network/NetworkServiceImpl.java |  31 +-
 .../network/router/NetworkHelperImpl.java     | 122 +++++---
 .../com/cloud/network/vpc/VpcManagerImpl.java |  16 +-
 .../RouterDeploymentDefinition.java           |   6 +-
 .../VpcRouterDeploymentDefinition.java        |   7 +-
 .../cloud/network/NetworkServiceImplTest.java |  50 ++-
 .../network/router/NetworkHelperImplTest.java | 288 +++++++++++++++++-
 .../cloud/network/vpc/VpcManagerImplTest.java |  10 +-
 .../com/cloud/vpc/MockNetworkManagerImpl.java |  10 +-
 ui/public/locales/en.json                     |   1 +
 ui/public/locales/pt_BR.json                  |   1 +
 ui/src/config/section/network.js              |  30 +-
 ui/src/views/AutogenView.vue                  |   5 +
 .../network/CreateIsolatedNetworkForm.vue     |  22 +-
 ui/src/views/network/CreateVpc.vue            |  20 +-
 ui/src/views/network/UpdateNetwork.vue        |  28 +-
 35 files changed, 691 insertions(+), 98 deletions(-)

diff --git a/api/src/main/java/com/cloud/network/Network.java b/api/src/main/java/com/cloud/network/Network.java
index 0846306f70f9..e41eb880ffd5 100644
--- a/api/src/main/java/com/cloud/network/Network.java
+++ b/api/src/main/java/com/cloud/network/Network.java
@@ -510,4 +510,6 @@ public void setIp6Address(String ip6Address) {
     Integer getPrivateMtu();
 
     Integer getNetworkCidrSize();
+
+    boolean getKeepMacAddressOnPublicNic();
 }
diff --git a/api/src/main/java/com/cloud/network/NetworkProfile.java b/api/src/main/java/com/cloud/network/NetworkProfile.java
index 2e8efb489308..d690344a0e38 100644
--- a/api/src/main/java/com/cloud/network/NetworkProfile.java
+++ b/api/src/main/java/com/cloud/network/NetworkProfile.java
@@ -385,6 +385,11 @@ public Integer getNetworkCidrSize() {
         return networkCidrSize;
     }
 
+    @Override
+    public boolean getKeepMacAddressOnPublicNic() {
+        return true;
+    }
+
     @Override
     public String toString() {
         return String.format("NetworkProfile %s",
diff --git a/api/src/main/java/com/cloud/network/vpc/Vpc.java b/api/src/main/java/com/cloud/network/vpc/Vpc.java
index b94089d2d433..a0686e2bf7d0 100644
--- a/api/src/main/java/com/cloud/network/vpc/Vpc.java
+++ b/api/src/main/java/com/cloud/network/vpc/Vpc.java
@@ -107,4 +107,6 @@ public enum State {
     String getIp6Dns2();
 
     boolean useRouterIpAsResolver();
+
+    boolean getKeepMacAddressOnPublicNic();
 }
diff --git a/api/src/main/java/com/cloud/network/vpc/VpcService.java b/api/src/main/java/com/cloud/network/vpc/VpcService.java
index c1546609d2b7..3d0ba43263f5 100644
--- a/api/src/main/java/com/cloud/network/vpc/VpcService.java
+++ b/api/src/main/java/com/cloud/network/vpc/VpcService.java
@@ -58,7 +58,7 @@ public interface VpcService {
      */
     Vpc createVpc(long zoneId, long vpcOffId, long vpcOwnerId, String vpcName, String displayText, String cidr, String networkDomain,
                   String ip4Dns1, String ip4Dns2, String ip6Dns1, String ip6Dns2, Boolean displayVpc, Integer publicMtu, Integer cidrSize,
-                  Long asNumber, List<Long> bgpPeerIds, Boolean useVrIpResolver) throws ResourceAllocationException;
+                  Long asNumber, List<Long> bgpPeerIds, Boolean useVrIpResolver, boolean keepMacAddressOnPublicNic) throws ResourceAllocationException;
 
     /**
      * Persists VPC record in the database
@@ -104,7 +104,7 @@ Vpc createVpc(long zoneId, long vpcOffId, long vpcOwnerId, String vpcName, Strin
      * @throws ResourceUnavailableException if during restart some resources may not be available
      * @throws InsufficientCapacityException if for instance no address space, compute or storage is sufficiently available
      */
-    Vpc updateVpc(long vpcId, String vpcName, String displayText, String customId, Boolean displayVpc, Integer mtu, String sourceNatIp) throws ResourceUnavailableException, InsufficientCapacityException;
+    Vpc updateVpc(long vpcId, String vpcName, String displayText, String customId, Boolean displayVpc, Integer mtu, String sourceNatIp, Boolean keepMacAddressOnPublicNic) throws ResourceUnavailableException, InsufficientCapacityException;
 
     /**
      * Lists VPC(s) based on the parameters passed to the API call
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index 6fb7cb0612c0..4d4ead277e5d 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -1356,6 +1356,13 @@ public class ApiConstants {
     public static final String OBJECT_STORAGE_LIMIT = "objectstoragelimit";
     public static final String OBJECT_STORAGE_TOTAL = "objectstoragetotal";
 
+    public static final String KEEP_MAC_ADDRESS_ON_PUBLIC_NIC = "keepmacaddressonpublicnic";
+
+    public static final String PARAMETER_DESCRIPTION_KEEP_MAC_ADDRESS_ON_PUBLIC_NIC =
+            "Indicates whether to use the same MAC address for the public NIC of VRs on the same network. If \"true\", when creating redundant routers or recreating" +
+                    " a VR, CloudStack will use the same MAC address for the public NIC of all VRs. Otherwise, if \"false\", new public NICs will always have " +
+                    " a new MAC address.";
+
     public static final String PARAMETER_DESCRIPTION_ACTIVATION_RULE = "Quota tariff's activation rule. It can receive a JS script that results in either " +
             "a boolean or a numeric value: if it results in a boolean value, the tariff value will be applied according to the result; if it results in a numeric value, the " +
             "numeric value will be applied; if the result is neither a boolean nor a numeric value, the tariff will not be applied. If the rule is not informed, the tariff " +
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java
index cbf6df081b3b..ee5b8568e835 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/network/CreateNetworkCmd.java
@@ -199,6 +199,11 @@ public class CreateNetworkCmd extends BaseCmd implements UserCmd {
     @Parameter(name=ApiConstants.AS_NUMBER, type=CommandType.LONG, since = "4.20.0", description="the AS Number of the network")
     private Long asNumber;
 
+    @Parameter(name = ApiConstants.KEEP_MAC_ADDRESS_ON_PUBLIC_NIC,
+            description = ApiConstants.PARAMETER_DESCRIPTION_KEEP_MAC_ADDRESS_ON_PUBLIC_NIC,
+            type = CommandType.BOOLEAN, since = "4.23.0", authorized = {RoleType.Admin})
+    private Boolean keepMacAddressOnPublicNic;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -286,6 +291,10 @@ public String getSourceNatIP() {
         return sourceNatIP;
     }
 
+    public Boolean getKeepMacAddressOnPublicNic() {
+        return keepMacAddressOnPublicNic;
+    }
+
     @Override
     public boolean isDisplay() {
         if(displayNetwork == null)
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/network/UpdateNetworkCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/network/UpdateNetworkCmd.java
index 2e638f1e2f76..7b6841d60976 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/network/UpdateNetworkCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/network/UpdateNetworkCmd.java
@@ -105,6 +105,11 @@ public class UpdateNetworkCmd extends BaseAsyncCustomIdCmd implements UserCmd {
     @Parameter(name = ApiConstants.SOURCE_NAT_IP, type = CommandType.STRING, description = "IPV4 address to be assigned to the public interface of the network router. This address must already be acquired for this network", since = "4.19")
     private String sourceNatIP;
 
+    @Parameter(name = ApiConstants.KEEP_MAC_ADDRESS_ON_PUBLIC_NIC,
+            description = ApiConstants.PARAMETER_DESCRIPTION_KEEP_MAC_ADDRESS_ON_PUBLIC_NIC,
+            type = CommandType.BOOLEAN, since = "4.23.0", authorized = {RoleType.Admin})
+    private Boolean keepMacAddressOnPublicNic;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -186,6 +191,10 @@ public String getSourceNatIP() {
         return sourceNatIP;
     }
 
+    public Boolean getKeepMacAddressOnPublicNic() {
+        return keepMacAddressOnPublicNic;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/CreateVPCCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/CreateVPCCmd.java
index 2adbbd664085..86309d7f28a5 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/CreateVPCCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/CreateVPCCmd.java
@@ -130,6 +130,11 @@ public class CreateVPCCmd extends BaseAsyncCreateCmd implements UserCmd {
             description="(optional) for NSX based VPCs: when set to true, use the VR IP as nameserver, otherwise use DNS1 and DNS2")
     private Boolean useVrIpResolver;
 
+    @Parameter(name = ApiConstants.KEEP_MAC_ADDRESS_ON_PUBLIC_NIC,
+            description = ApiConstants.PARAMETER_DESCRIPTION_KEEP_MAC_ADDRESS_ON_PUBLIC_NIC,
+            type = CommandType.BOOLEAN, since = "4.23.0", authorized = {RoleType.Admin})
+    private boolean keepMacAddressOnPublicNic = true;
+
     // ///////////////////////////////////////////////////
     // ///////////////// Accessors ///////////////////////
     // ///////////////////////////////////////////////////
@@ -214,6 +219,10 @@ public boolean getUseVrIpResolver() {
         return BooleanUtils.toBoolean(useVrIpResolver);
     }
 
+    public boolean getKeepMacAddressOnPublicNic() {
+        return keepMacAddressOnPublicNic;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/UpdateVPCCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/UpdateVPCCmd.java
index f2327c9073f3..6cfdb895977d 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/UpdateVPCCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vpc/UpdateVPCCmd.java
@@ -69,6 +69,11 @@ public class UpdateVPCCmd extends BaseAsyncCustomIdCmd implements UserCmd {
             since = "4.19")
     private String sourceNatIP;
 
+    @Parameter(name = ApiConstants.KEEP_MAC_ADDRESS_ON_PUBLIC_NIC,
+            description = ApiConstants.PARAMETER_DESCRIPTION_KEEP_MAC_ADDRESS_ON_PUBLIC_NIC,
+            type = CommandType.BOOLEAN, since = "4.23.0", authorized = {RoleType.Admin})
+    private Boolean keepMacAddressOnPublicNic;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -97,6 +102,10 @@ public String getSourceNatIP() {
         return sourceNatIP;
     }
 
+    public Boolean getKeepMacAddressOnPublicNic() {
+        return keepMacAddressOnPublicNic;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/NetworkResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/NetworkResponse.java
index 7c4b733a80f5..3a3663af2551 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/NetworkResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/NetworkResponse.java
@@ -331,6 +331,10 @@ public class NetworkResponse extends BaseResponseWithAssociatedNetwork implement
     @Param(description = "The BGP peers for the network", since = "4.20.0")
     private Set<BgpPeerResponse> bgpPeers;
 
+    @SerializedName(ApiConstants.KEEP_MAC_ADDRESS_ON_PUBLIC_NIC)
+    @Param(description = ApiConstants.PARAMETER_DESCRIPTION_KEEP_MAC_ADDRESS_ON_PUBLIC_NIC, since = "4.23.0")
+    private Boolean keepMacAddressOnPublicNic;
+
     public NetworkResponse() {}
 
     public Boolean getDisplayNetwork() {
@@ -702,4 +706,8 @@ public void setIpv6Dns1(String ipv6Dns1) {
     public void setIpv6Dns2(String ipv6Dns2) {
         this.ipv6Dns2 = ipv6Dns2;
     }
+
+    public void setKeepMacAddressOnPublicNic(Boolean keepMacAddressOnPublicNic) {
+        this.keepMacAddressOnPublicNic = keepMacAddressOnPublicNic;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/VpcResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/VpcResponse.java
index acfabb113502..34d50d5b9f92 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/VpcResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/VpcResponse.java
@@ -185,6 +185,10 @@ public class VpcResponse extends BaseResponseWithAnnotations implements Controll
     @Param(description = "The BGP peers for the VPC", since = "4.20.0")
     private Set<BgpPeerResponse> bgpPeers;
 
+    @SerializedName(ApiConstants.KEEP_MAC_ADDRESS_ON_PUBLIC_NIC)
+    @Param(description = ApiConstants.PARAMETER_DESCRIPTION_KEEP_MAC_ADDRESS_ON_PUBLIC_NIC, since = "4.23.0")
+    private Boolean keepMacAddressOnPublicNic;
+
     public void setId(final String id) {
         this.id = id;
     }
@@ -366,4 +370,8 @@ public void addBgpPeer(BgpPeerResponse bgpPeer) {
         }
         this.bgpPeers.add(bgpPeer);
     }
+
+    public void setKeepMacAddressOnPublicNic(Boolean keepMacAddressOnPublicNic) {
+        this.keepMacAddressOnPublicNic = keepMacAddressOnPublicNic;
+    }
 }
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/vpc/UpdateVPCCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/vpc/UpdateVPCCmdTest.java
index acb2dc685976..9d56cffd6718 100644
--- a/api/src/test/java/org/apache/cloudstack/api/command/user/vpc/UpdateVPCCmdTest.java
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/vpc/UpdateVPCCmdTest.java
@@ -93,7 +93,7 @@ public void testExecute() throws ResourceUnavailableException, InsufficientCapac
         responseGenerator = Mockito.mock(ResponseGenerator.class);
         cmd._responseGenerator = responseGenerator;
         Mockito.verify(_vpcService, Mockito.times(0)).updateVpc(Mockito.anyLong(), Mockito.anyString(), Mockito.anyString(),
-                Mockito.anyString(), Mockito.anyBoolean(), Mockito.anyInt(), Mockito.anyString());
+                Mockito.anyString(), Mockito.anyBoolean(), Mockito.anyInt(), Mockito.anyString(), Mockito.anyBoolean());
 
     }
 }
diff --git a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/NetworkOrchestrationService.java b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/NetworkOrchestrationService.java
index b7b548fb9407..030c1277efe2 100644
--- a/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/NetworkOrchestrationService.java
+++ b/engine/api/src/main/java/org/apache/cloudstack/engine/orchestration/service/NetworkOrchestrationService.java
@@ -220,6 +220,11 @@ Network createGuestNetwork(long networkOfferingId, String name, String displayTe
                                Boolean displayNetworkEnabled, String isolatedPvlan, Network.PVlanType isolatedPvlanType, String externalId, String routerIp, String routerIpv6,
                                String ip4Dns1, String ip4Dns2, String ip6Dns1, String ip6Dns2, Pair<Integer, Integer> vrIfaceMTUs, Integer networkCidrSize) throws ConcurrentOperationException, InsufficientCapacityException, ResourceAllocationException;
 
+    Network createGuestNetwork(long networkOfferingId, String name, String displayText, String gateway, String cidr, String vlanId, boolean bypassVlanOverlapCheck, String networkDomain, Account owner,
+                               Long domainId, PhysicalNetwork physicalNetwork, long zoneId, ACLType aclType, Boolean subdomainAccess, Long vpcId, String ip6Gateway, String ip6Cidr,
+                               Boolean displayNetworkEnabled, String isolatedPvlan, Network.PVlanType isolatedPvlanType, String externalId, String routerIp, String routerIpv6,
+                               String ip4Dns1, String ip4Dns2, String ip6Dns1, String ip6Dns2, Pair<Integer, Integer> vrIfaceMTUs, Integer networkCidrSize, boolean keepMacAddressOnPublicNic) throws ConcurrentOperationException, InsufficientCapacityException, ResourceAllocationException;
+
     UserDataServiceProvider getPasswordResetProvider(Network network);
 
     UserDataServiceProvider getSSHKeyResetProvider(Network network);
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
index 7d455e7d6dc9..4262ee701aab 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
@@ -863,6 +863,7 @@ private static NetworkVO getNetworkVO(long id, final NetworkOffering offering, f
                 vpcId, offering.isRedundantRouter(), predefined.getExternalId());
         vo.setDisplayNetwork(isDisplayNetworkEnabled == null || isDisplayNetworkEnabled);
         vo.setStrechedL2Network(offering.isSupportingStrechedL2());
+        vo.setKeepMacAddressOnPublicNic(predefined.getKeepMacAddressOnPublicNic());
         return vo;
     }
 
@@ -2724,7 +2725,7 @@ public Network createPrivateNetwork(final long networkOfferingId, final String n
         return createGuestNetwork(networkOfferingId, name, displayText, gateway, cidr, vlanId,
                 bypassVlanOverlapCheck, null, owner, null, pNtwk, pNtwk.getDataCenterId(), ACLType.Account, null,
                 vpcId, null, null, true, null, null, null, true, null, null,
-                null, null, null, null, null, null);
+                null, null, null, null, null, null, true);
     }
 
     @Override
@@ -2735,10 +2736,25 @@ public Network createGuestNetwork(final long networkOfferingId, final String nam
                                       final Boolean isDisplayNetworkEnabled, final String isolatedPvlan, Network.PVlanType isolatedPvlanType, String externalId,
                                       String routerIp, String routerIpv6, String ip4Dns1, String ip4Dns2, String ip6Dns1, String ip6Dns2,
                                       Pair<Integer, Integer> vrIfaceMTUs, Integer networkCidrSize) throws ConcurrentOperationException, InsufficientCapacityException, ResourceAllocationException {
+        return createGuestNetwork(networkOfferingId, name, displayText, gateway, cidr, vlanId, bypassVlanOverlapCheck,
+                networkDomain, owner, domainId, pNtwk, zoneId, aclType, subdomainAccess, vpcId, ip6Gateway, ip6Cidr,
+                isDisplayNetworkEnabled, isolatedPvlan, isolatedPvlanType, externalId, false, routerIp, routerIpv6,
+                ip4Dns1, ip4Dns2, ip6Dns1, ip6Dns2, vrIfaceMTUs, networkCidrSize, true);
+    }
+
+    @Override
+    @DB
+    public Network createGuestNetwork(final long networkOfferingId, final String name, final String displayText, final String gateway, final String cidr, String vlanId,
+                                      boolean bypassVlanOverlapCheck, String networkDomain, final Account owner, final Long domainId, final PhysicalNetwork pNtwk,
+                                      final long zoneId, final ACLType aclType, Boolean subdomainAccess, final Long vpcId, final String ip6Gateway, final String ip6Cidr,
+                                      final Boolean isDisplayNetworkEnabled, final String isolatedPvlan, Network.PVlanType isolatedPvlanType, String externalId,
+                                      String routerIp, String routerIpv6, String ip4Dns1, String ip4Dns2, String ip6Dns1, String ip6Dns2,
+                                      Pair<Integer, Integer> vrIfaceMTUs, Integer networkCidrSize, boolean keepMacAddressOnPublicNic) throws ConcurrentOperationException, InsufficientCapacityException, ResourceAllocationException {
         // create Isolated/Shared/L2 network
         return createGuestNetwork(networkOfferingId, name, displayText, gateway, cidr, vlanId, bypassVlanOverlapCheck,
                 networkDomain, owner, domainId, pNtwk, zoneId, aclType, subdomainAccess, vpcId, ip6Gateway, ip6Cidr,
-                isDisplayNetworkEnabled, isolatedPvlan, isolatedPvlanType, externalId, false, routerIp, routerIpv6, ip4Dns1, ip4Dns2, ip6Dns1, ip6Dns2, vrIfaceMTUs, networkCidrSize);
+                isDisplayNetworkEnabled, isolatedPvlan, isolatedPvlanType, externalId, false, routerIp, routerIpv6,
+                ip4Dns1, ip4Dns2, ip6Dns1, ip6Dns2, vrIfaceMTUs, networkCidrSize, keepMacAddressOnPublicNic);
     }
 
     @DB
@@ -2747,7 +2763,8 @@ private Network createGuestNetwork(final long networkOfferingId, final String na
                                        final long zoneId, final ACLType aclType, Boolean subdomainAccess, final Long vpcId, final String ip6Gateway, final String ip6Cidr,
                                        final Boolean isDisplayNetworkEnabled, final String isolatedPvlan, Network.PVlanType isolatedPvlanType, String externalId,
                                        final Boolean isPrivateNetwork, String routerIp, String routerIpv6, final String ip4Dns1, final String ip4Dns2,
-                                       final String ip6Dns1, final String ip6Dns2, Pair<Integer, Integer> vrIfaceMTUs, Integer networkCidrSize) throws ConcurrentOperationException, InsufficientCapacityException, ResourceAllocationException {
+                                       final String ip6Dns1, final String ip6Dns2, Pair<Integer, Integer> vrIfaceMTUs, Integer networkCidrSize,
+                                       boolean keepMacAddressOnPublicNic) throws ConcurrentOperationException, InsufficientCapacityException, ResourceAllocationException {
 
         final NetworkOfferingVO ntwkOff = _networkOfferingDao.findById(networkOfferingId);
         final DataCenterVO zone = _dcDao.findById(zoneId);
@@ -3095,6 +3112,7 @@ public Network doInTransaction(final TransactionStatus status) {
                     }
                 }
                 userNetwork.setNetworkCidrSize(networkCidrSize);
+                userNetwork.setKeepMacAddressOnPublicNic(keepMacAddressOnPublicNic);
                 final List<? extends Network> networks = setupNetwork(owner, ntwkOff, userNetwork, plan, name, displayText, true, domainId, aclType, subdomainAccessFinal, vpcId,
                         isDisplayNetworkEnabled);
                 Network network;
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkVO.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkVO.java
index 02abaacd854e..f2572ba91c21 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkVO.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkVO.java
@@ -203,9 +203,13 @@ public class NetworkVO implements Network {
     @Column(name = "private_mtu")
     Integer privateMtu;
 
+    @Column(name = "keep_mac_address_on_public_nic")
+    private boolean keepMacAddressOnPublicNic = true;
+
     @Transient
     Integer networkCidrSize;
 
+
     public NetworkVO() {
         uuid = UUID.randomUUID().toString();
     }
@@ -773,4 +777,13 @@ public Integer getNetworkCidrSize() {
     public void setNetworkCidrSize(Integer networkCidrSize) {
         this.networkCidrSize = networkCidrSize;
     }
+
+    @Override
+    public boolean getKeepMacAddressOnPublicNic() {
+        return keepMacAddressOnPublicNic;
+    }
+
+    public void setKeepMacAddressOnPublicNic(boolean keepMacAddressOnPublicNic) {
+        this.keepMacAddressOnPublicNic = keepMacAddressOnPublicNic;
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/vpc/VpcVO.java b/engine/schema/src/main/java/com/cloud/network/vpc/VpcVO.java
index e942eadb8ffb..742d3f2f82ee 100644
--- a/engine/schema/src/main/java/com/cloud/network/vpc/VpcVO.java
+++ b/engine/schema/src/main/java/com/cloud/network/vpc/VpcVO.java
@@ -108,6 +108,9 @@ public class VpcVO implements Vpc {
     @Column(name = "use_router_ip_resolver")
     boolean useRouterIpResolver = false;
 
+    @Column(name = "keep_mac_address_on_public_nic")
+    private boolean keepMacAddressOnPublicNic = true;
+
     @Transient
     boolean rollingRestart = false;
 
@@ -321,4 +324,13 @@ public boolean useRouterIpAsResolver() {
     public void setUseRouterIpResolver(boolean useRouterIpResolver) {
         this.useRouterIpResolver = useRouterIpResolver;
     }
+
+    @Override
+    public boolean getKeepMacAddressOnPublicNic() {
+        return keepMacAddressOnPublicNic;
+    }
+
+    public void setKeepMacAddressOnPublicNic(boolean keepMacAddressOnPublicNic) {
+        this.keepMacAddressOnPublicNic = keepMacAddressOnPublicNic;
+    }
 }
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
index c0feb06e76ac..c99f798d3d56 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
@@ -127,3 +127,7 @@ CREATE TABLE IF NOT EXISTS `cloud_usage`.`quota_tariff_usage` (
     PRIMARY KEY (`id`),
     CONSTRAINT `fk_quota_tariff_usage__tariff_id` FOREIGN KEY (`tariff_id`) REFERENCES `cloud_usage`.`quota_tariff` (`id`),
     CONSTRAINT `fk_quota_tariff_usage__quota_usage_id` FOREIGN KEY (`quota_usage_id`) REFERENCES `cloud_usage`.`quota_usage` (`id`));
+
+-- Add the 'keep_mac_address_on_public_nic' column to the 'cloud.networks' and 'cloud.vpc' tables
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.networks', 'keep_mac_address_on_public_nic', 'TINYINT(1) NOT NULL DEFAULT 1');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vpc', 'keep_mac_address_on_public_nic', 'TINYINT(1) NOT NULL DEFAULT 1');
diff --git a/server/src/main/java/com/cloud/api/ApiResponseHelper.java b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
index 11ac3d639e99..a8551b4c6693 100644
--- a/server/src/main/java/com/cloud/api/ApiResponseHelper.java
+++ b/server/src/main/java/com/cloud/api/ApiResponseHelper.java
@@ -2890,6 +2890,11 @@ public NetworkResponse createNetworkResponse(ResponseView view, Network network)
             }
         }
 
+        if (CallContext.current().getCallingAccount().getType() == Account.Type.ADMIN &&
+                network.getVpcId() == null && network.getGuestType() == Network.GuestType.Isolated) {
+            response.setKeepMacAddressOnPublicNic(network.getKeepMacAddressOnPublicNic());
+        }
+
         response.setObjectName("network");
         return response;
     }
@@ -3653,6 +3658,9 @@ public VpcResponse createVpcResponse(ResponseView view, Vpc vpc) {
             }
         }
 
+        if (CallContext.current().getCallingAccount().getType() == Account.Type.ADMIN) {
+            response.setKeepMacAddressOnPublicNic(vpc.getKeepMacAddressOnPublicNic());
+        }
         response.setObjectName("vpc");
         return response;
     }
diff --git a/server/src/main/java/com/cloud/network/NetworkMigrationManagerImpl.java b/server/src/main/java/com/cloud/network/NetworkMigrationManagerImpl.java
index 450f08c46e35..a09867b8ffc3 100644
--- a/server/src/main/java/com/cloud/network/NetworkMigrationManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/NetworkMigrationManagerImpl.java
@@ -301,7 +301,7 @@ public Long makeCopyOfVpc(long vpcId, long vpcOfferingId) {
 
             copyOfVpc = _vpcService.createVpc(vpc.getZoneId(), vpcOfferingId, vpc.getAccountId(), vpc.getName(),
                     vpc.getDisplayText(), vpc.getCidr(), vpc.getNetworkDomain(), vpc.getIp4Dns1(), vpc.getIp4Dns2(),
-                    vpc.getIp6Dns1(), vpc.getIp6Dns2(), vpc.isDisplay(), vpc.getPublicMtu(), null, null, null, vpc.useRouterIpAsResolver());
+                    vpc.getIp6Dns1(), vpc.getIp6Dns2(), vpc.isDisplay(), vpc.getPublicMtu(), null, null, null, vpc.useRouterIpAsResolver(), vpc.getKeepMacAddressOnPublicNic());
 
             copyOfVpcId = copyOfVpc.getId();
             //on resume of migration the uuid will be swapped already. So the copy will have the value of the original vpcid.
diff --git a/server/src/main/java/com/cloud/network/NetworkServiceImpl.java b/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
index c9884f8c469a..d18fd043f697 100644
--- a/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
+++ b/server/src/main/java/com/cloud/network/NetworkServiceImpl.java
@@ -1549,6 +1549,8 @@ public Network createGuestNetwork(CreateNetworkCmd cmd) throws InsufficientCapac
 
         DataCenter zone = getAndValidateZone(cmd, pNtwk);
 
+        boolean keepMacAddressOnPublicNic = getAndValidateSupportForKeepMacAddressOnPublicNicParameter(cmd.getKeepMacAddressOnPublicNic(), ntwkOff);
+
         _accountMgr.checkAccess(owner, ntwkOff, zone);
 
         validateZoneAvailability(caller, zone);
@@ -1834,7 +1836,7 @@ public Network createGuestNetwork(CreateNetworkCmd cmd) throws InsufficientCapac
 
         Network network = commitNetwork(networkOfferingId, gateway, startIP, endIP, netmask, networkDomain, vlanId, bypassVlanOverlapCheck, name, displayText, caller, physicalNetworkId, zone.getId(),
                 domainId, isDomainSpecific, subdomainAccess, vpcId, startIPv6, endIPv6, ip6Gateway, ip6Cidr, displayNetwork, aclId, secondaryVlanId, privateVlanType, ntwkOff, pNtwk, aclType, owner, cidr, createVlan,
-                externalId, routerIPv4, routerIPv6, associatedNetwork, ip4Dns1, ip4Dns2, ip6Dns1, ip6Dns2, interfaceMTUs, networkCidrSize);
+                externalId, routerIPv4, routerIPv6, associatedNetwork, ip4Dns1, ip4Dns2, ip6Dns1, ip6Dns2, interfaceMTUs, networkCidrSize, keepMacAddressOnPublicNic);
 
         // retrieve, acquire and associate the correct IP addresses
         checkAndSetRouterSourceNatIp(owner, cmd, network);
@@ -1879,6 +1881,24 @@ private void validateNetworkCreationSupported(long zoneId, String zoneName, Gues
         }
     }
 
+    protected boolean getAndValidateSupportForKeepMacAddressOnPublicNicParameter(Boolean keepMacAddressOnPublicNic, NetworkOffering networkOffering) {
+        if (networkOffering.isForVpc() && keepMacAddressOnPublicNic != null) {
+            throw new InvalidParameterValueException(
+                    String.format("The [%s] parameter cannot be specified on the creation of VPC tiers.", ApiConstants.KEEP_MAC_ADDRESS_ON_PUBLIC_NIC)
+            );
+        }
+
+        GuestType guestType = networkOffering.getGuestType();
+        if (guestType != GuestType.Isolated && keepMacAddressOnPublicNic != null) {
+            throw new InvalidParameterValueException(String.format(
+                    "The [%s] parameter can only be specified on the creation of [%s] networks.",
+                    ApiConstants.KEEP_MAC_ADDRESS_ON_PUBLIC_NIC, GuestType.Isolated
+            ));
+        }
+
+        return keepMacAddressOnPublicNic == null || keepMacAddressOnPublicNic;
+    }
+
     @Override
     @DB
     @ActionEvent(eventType = EventTypes.EVENT_NETWORK_CREATE, eventDescription = "creating network")
@@ -2282,7 +2302,7 @@ protected Network commitNetwork(final Long networkOfferingId, final String gatew
                                   final Boolean displayNetwork, final Long aclId, final String isolatedPvlan, final PVlanType isolatedPvlanType, final NetworkOffering ntwkOff, final PhysicalNetwork pNtwk, final ACLType aclType, final Account ownerFinal,
                                   final String cidr, final boolean createVlan, final String externalId, String routerIp, String routerIpv6,
                                   final Network associatedNetwork, final String ip4Dns1, final String ip4Dns2, final String ip6Dns1, final String ip6Dns2, Pair<Integer, Integer> vrIfaceMTUs,
-                                  final Integer networkCidrSize) throws InsufficientCapacityException, ResourceAllocationException {
+                                  final Integer networkCidrSize, final boolean keepMacAddressOnPublicNic) throws InsufficientCapacityException, ResourceAllocationException {
         try {
             Network network = Transaction.execute(new TransactionCallbackWithException<Network, Exception>() {
                 @Override
@@ -2348,7 +2368,7 @@ public Network doInTransaction(TransactionStatus status) throws InsufficientCapa
                         }
                         network = _networkMgr.createGuestNetwork(networkOfferingId, name, displayText, gateway, cidr, vlanId, bypassVlanOverlapCheck, networkDomain, owner, sharedDomainId, pNtwk,
                                 zoneId, aclType, subdomainAccess, vpcId, ip6Gateway, ip6Cidr, displayNetwork, isolatedPvlan, isolatedPvlanType, externalId, routerIp, routerIpv6, ip4Dns1, ip4Dns2,
-                                ip6Dns1, ip6Dns2, vrIfaceMTUs, networkCidrSize);
+                                ip6Dns1, ip6Dns2, vrIfaceMTUs, networkCidrSize, keepMacAddressOnPublicNic);
                     }
 
                     if (createVlan && network != null) {
@@ -3156,6 +3176,7 @@ public Network updateGuestNetwork(final UpdateNetworkCmd cmd) {
         String ip4Dns2 = cmd.getIp4Dns2();
         String ip6Dns1 = cmd.getIp6Dns1();
         String ip6Dns2 = cmd.getIp6Dns2();
+        Boolean keepMacAddressOnPublicNic = cmd.getKeepMacAddressOnPublicNic();
 
         boolean restartNetwork = false;
 
@@ -3214,6 +3235,10 @@ public Network updateGuestNetwork(final UpdateNetworkCmd cmd) {
             network.setUuid(customId);
         }
 
+        if (keepMacAddressOnPublicNic != null) {
+            network.setKeepMacAddressOnPublicNic(getAndValidateSupportForKeepMacAddressOnPublicNicParameter(keepMacAddressOnPublicNic, offering));
+        }
+
         // display flag is not null and has changed
         if (displayNetwork != null && displayNetwork != network.getDisplayNetwork()) {
             // Update resource count if it needs to be updated
diff --git a/server/src/main/java/com/cloud/network/router/NetworkHelperImpl.java b/server/src/main/java/com/cloud/network/router/NetworkHelperImpl.java
index 684f196ce9fd..56534a8ee7df 100644
--- a/server/src/main/java/com/cloud/network/router/NetworkHelperImpl.java
+++ b/server/src/main/java/com/cloud/network/router/NetworkHelperImpl.java
@@ -737,55 +737,91 @@ protected LinkedHashMap<Network, List<? extends NicProfile>> configureControlNic
     }
 
     protected LinkedHashMap<Network, List<? extends NicProfile>> configurePublicNic(final RouterDeploymentDefinition routerDeploymentDefinition, final boolean hasGuestNic) throws InsufficientAddressCapacityException {
-        final LinkedHashMap<Network, List<? extends NicProfile>> publicConfig = new LinkedHashMap<Network, List<? extends NicProfile>>(3);
-
-        if (routerDeploymentDefinition.isPublicNetwork()) {
-            logger.debug("Adding NIC for Virtual Router in Public network ");
-            // if source nat service is supported by the network, get the source
-            // nat ip address
-            final NicProfile defaultNic = new NicProfile();
-            defaultNic.setDefaultNic(true);
-            final PublicIp sourceNatIp = routerDeploymentDefinition.getSourceNatIP();
-            defaultNic.setIPv4Address(sourceNatIp.getAddress().addr());
-            defaultNic.setIPv4Gateway(sourceNatIp.getGateway());
-            defaultNic.setIPv4Netmask(sourceNatIp.getNetmask());
-            defaultNic.setMacAddress(sourceNatIp.getMacAddress());
-            // get broadcast from public network
-            final Network pubNet = _networkDao.findById(sourceNatIp.getNetworkId());
-            if (pubNet.getBroadcastDomainType() == BroadcastDomainType.Vxlan) {
-                defaultNic.setBroadcastType(BroadcastDomainType.Vxlan);
-                defaultNic.setBroadcastUri(BroadcastDomainType.Vxlan.toUri(sourceNatIp.getVlanTag()));
-                defaultNic.setIsolationUri(BroadcastDomainType.Vxlan.toUri(sourceNatIp.getVlanTag()));
-            } else {
-                defaultNic.setBroadcastType(BroadcastDomainType.Vlan);
-                defaultNic.setBroadcastUri(sourceNatIp.getVlanTag() != null ? BroadcastDomainType.Vlan.toUri(sourceNatIp.getVlanTag()) : null);
-                defaultNic.setIsolationUri(sourceNatIp.getVlanTag() != null ?  IsolationType.Vlan.toUri(sourceNatIp.getVlanTag()) : null);
-            }
-
-            //If guest nic has already been added we will have 2 devices in the list.
-            if (hasGuestNic) {
-                defaultNic.setDeviceId(2);
-            }
+        final LinkedHashMap<Network, List<? extends NicProfile>> publicConfig = new LinkedHashMap<>(3);
+        if (!routerDeploymentDefinition.isPublicNetwork()) {
+            return publicConfig;
+        }
 
-            final NetworkOffering publicOffering = _networkModel.getSystemAccountNetworkOfferings(NetworkOffering.SystemPublicNetwork).get(0);
-            final List<? extends Network> publicNetworks = _networkMgr.setupNetwork(s_systemAccount, publicOffering, routerDeploymentDefinition.getPlan(), null, null, false);
-            final String publicIp = defaultNic.getIPv4Address();
-            // We want to use the identical MAC address for RvR on public
-            // interface if possible
-            final NicVO peerNic = _nicDao.findByIp4AddressAndNetworkId(publicIp, publicNetworks.get(0).getId());
-            if (peerNic != null) {
-                logger.info("Use same MAC as previous RvR, the MAC is " + peerNic.getMacAddress());
-                defaultNic.setMacAddress(peerNic.getMacAddress());
-            }
-            if (routerDeploymentDefinition.getGuestNetwork() != null) {
-                ipv6Service.updateNicIpv6(defaultNic, routerDeploymentDefinition.getDest().getDataCenter(), routerDeploymentDefinition.getGuestNetwork());
-            }
-            publicConfig.put(publicNetworks.get(0), new ArrayList<NicProfile>(Arrays.asList(defaultNic)));
+        final PublicIp sourceNatIp = routerDeploymentDefinition.getSourceNatIP();
+        final NicProfile defaultNic = new NicProfile();
+        configurePublicVrNicBasedOnSourceNatIp(defaultNic, sourceNatIp);
+        if (hasGuestNic) {
+            logger.debug("Guest NIC has already been configured, therefore setting device ID of new VR (with source NAT [{}]) public NIC to [2].", sourceNatIp);
+            defaultNic.setDeviceId(2);
         }
 
+        final NetworkOffering publicOffering = _networkModel.getSystemAccountNetworkOfferings(NetworkOffering.SystemPublicNetwork).get(0);
+        final List<? extends Network> publicNetworks = _networkMgr.setupNetwork(s_systemAccount, publicOffering, routerDeploymentDefinition.getPlan(), null, null, false);
+
+        setPublicNicMacAddressSameAsPeerNic(defaultNic, publicNetworks.get(0), routerDeploymentDefinition);
+
+        if (routerDeploymentDefinition.getGuestNetwork() != null) {
+            ipv6Service.updateNicIpv6(defaultNic, routerDeploymentDefinition.getDest().getDataCenter(), routerDeploymentDefinition.getGuestNetwork());
+        }
+        publicConfig.put(publicNetworks.get(0), List.of(defaultNic));
         return publicConfig;
     }
 
+    /**
+     * Configures the public NIC of a Virtual Router based on the provided source NAT IP.
+     * @param nic Virtual Router public NIC to be configured.
+     * @param sourceNatIp Source NAT IP which should be used to configure the Virtual Router's public NIC.
+     */
+    protected void configurePublicVrNicBasedOnSourceNatIp(NicProfile nic, PublicIp sourceNatIp) {
+        logger.debug("Configuring public NIC of VR with source NAT IP equal to [{}]", sourceNatIp.getAddress().addr());
+        nic.setDefaultNic(true);
+        nic.setIPv4Address(sourceNatIp.getAddress().addr());
+        nic.setIPv4Gateway(sourceNatIp.getGateway());
+        nic.setIPv4Netmask(sourceNatIp.getNetmask());
+        nic.setMacAddress(sourceNatIp.getMacAddress());
+
+        Network publicNetwork = _networkDao.findById(sourceNatIp.getNetworkId());
+        if (publicNetwork.getBroadcastDomainType() == BroadcastDomainType.Vxlan) {
+            nic.setBroadcastType(BroadcastDomainType.Vxlan);
+            nic.setBroadcastUri(BroadcastDomainType.Vxlan.toUri(sourceNatIp.getVlanTag()));
+            nic.setIsolationUri(BroadcastDomainType.Vxlan.toUri(sourceNatIp.getVlanTag()));
+        } else {
+            nic.setBroadcastType(BroadcastDomainType.Vlan);
+            nic.setBroadcastUri(sourceNatIp.getVlanTag() != null ? BroadcastDomainType.Vlan.toUri(sourceNatIp.getVlanTag()) : null);
+            nic.setIsolationUri(sourceNatIp.getVlanTag() != null ? IsolationType.Vlan.toUri(sourceNatIp.getVlanTag()) : null);
+        }
+    }
+
+    /**
+     * Sets the MAC address of the new VR's public NIC the same as the previous VR's public NIC MAC address if
+     * {@link RouterDeploymentDefinition#getKeepMacAddressOnPublicNic()} is set to {@code true} and a peer NIC is found; otherwise,
+     * does nothing.
+     */
+    protected void setPublicNicMacAddressSameAsPeerNic(NicProfile defaultNic, Network publicNetwork, RouterDeploymentDefinition routerDeploymentDefinition) throws InsufficientAddressCapacityException {
+        String publicIp = defaultNic.getIPv4Address();
+        logger.info("Verifying if we will use same MAC address for public NIC of new VR (with source NAT [{}]).", publicIp);
+
+        logger.debug("Searching for peer NIC for public IP [{}] and network [{}].", publicIp, publicNetwork.getUuid());
+        NicVO peerNic = _nicDao.findByIp4AddressAndNetworkId(publicIp, publicNetwork.getId());
+        if (peerNic == null) {
+            logger.info("We will not use the same MAC address for public NIC of new VR as we have not found a peer NIC for public IP [{}] and network [{}].",
+                    publicIp, publicNetwork.getUuid());
+            return;
+        }
+
+        logger.info("Found peer NIC [{}] for public IP [{}] and network [{}].", peerNic.getUuid(), publicIp, publicNetwork.getUuid());
+        boolean keepMacAddressOnPublicNic = routerDeploymentDefinition.getKeepMacAddressOnPublicNic();
+        String macAddressLog = String.format("same MAC address for public NIC of new VR (with source NAT [%s]) as the [keep_mac_address_on_public_nic] property is configured as [%s].", publicIp, keepMacAddressOnPublicNic);
+        if (keepMacAddressOnPublicNic) {
+            logger.info("Using {}", macAddressLog);
+            defaultNic.setMacAddress(peerNic.getMacAddress());
+            return;
+        }
+
+        logger.info("Not using {}", macAddressLog);
+        boolean fetchNewMacAddress = peerNic.getMacAddress().equals(defaultNic.getMacAddress());
+        if (fetchNewMacAddress) {
+            logger.debug("Fetching new MAC address for public NIC of new VR, since the MAC address of the peer NIC [UUID: {}, MAC address: {}] is equal to the predefined MAC address of the current NIC.", peerNic.getUuid(), peerNic.getMacAddress());
+            routerDeploymentDefinition.findSourceNatIP();
+            configurePublicVrNicBasedOnSourceNatIp(defaultNic, routerDeploymentDefinition.getSourceNatIP());
+        }
+    }
+
     @Override
     public LinkedHashMap<Network, List<? extends NicProfile>> configureDefaultNics(final RouterDeploymentDefinition routerDeploymentDefinition) throws ConcurrentOperationException, InsufficientAddressCapacityException {
 
diff --git a/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java b/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java
index 5b4ab908ca4c..c5f36e856550 100644
--- a/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java
+++ b/server/src/main/java/com/cloud/network/vpc/VpcManagerImpl.java
@@ -1568,7 +1568,7 @@ public List<Long> getVpcOfferingZones(Long vpcOfferingId) {
     @ActionEvent(eventType = EventTypes.EVENT_VPC_CREATE, eventDescription = "creating vpc", create = true)
     public Vpc createVpc(final long zoneId, final long vpcOffId, final long vpcOwnerId, final String vpcName, final String displayText, final String cidr, String networkDomain,
                          final String ip4Dns1, final String ip4Dns2, final String ip6Dns1, final String ip6Dns2, final Boolean displayVpc, Integer publicMtu,
-                         final Integer cidrSize, final Long asNumber, final List<Long> bgpPeerIds, Boolean useVrIpResolver) throws ResourceAllocationException {
+                         final Integer cidrSize, final Long asNumber, final List<Long> bgpPeerIds, Boolean useVrIpResolver, boolean keepMacAddressOnPublicNic) throws ResourceAllocationException {
         final Account caller = CallContext.current().getCallingAccount();
         final Account owner = _accountMgr.getAccount(vpcOwnerId);
 
@@ -1668,6 +1668,7 @@ public Vpc createVpc(final long zoneId, final long vpcOffId, final long vpcOwner
         vpc.setPublicMtu(publicMtu);
         vpc.setDisplay(Boolean.TRUE.equals(displayVpc));
         vpc.setUseRouterIpResolver(Boolean.TRUE.equals(useVrIpResolver));
+        vpc.setKeepMacAddressOnPublicNic(keepMacAddressOnPublicNic);
 
         try (CheckedReservation vpcReservation = new CheckedReservation(owner, ResourceType.vpc, null, null, 1L, reservationDao, _resourceLimitMgr)) {
             if (vpc.getCidr() == null && cidrSize != null) {
@@ -1728,7 +1729,8 @@ public Vpc createVpc(CreateVPCCmd cmd) throws ResourceAllocationException {
         List<Long> bgpPeerIds = (cmd instanceof CreateVPCCmdByAdmin) ? ((CreateVPCCmdByAdmin)cmd).getBgpPeerIds() : null;
         Vpc vpc = createVpc(cmd.getZoneId(), cmd.getVpcOffering(), cmd.getEntityOwnerId(), cmd.getVpcName(), cmd.getDisplayText(),
             cmd.getCidr(), cmd.getNetworkDomain(), cmd.getIp4Dns1(), cmd.getIp4Dns2(), cmd.getIp6Dns1(),
-            cmd.getIp6Dns2(), cmd.isDisplay(), cmd.getPublicMtu(), cmd.getCidrSize(), cmd.getAsNumber(), bgpPeerIds, cmd.getUseVrIpResolver());
+            cmd.getIp6Dns2(), cmd.isDisplay(), cmd.getPublicMtu(), cmd.getCidrSize(), cmd.getAsNumber(), bgpPeerIds,
+            cmd.getUseVrIpResolver(), cmd.getKeepMacAddressOnPublicNic());
 
         String sourceNatIP = cmd.getSourceNatIP();
         boolean forNsx = isVpcForProvider(Provider.Nsx, vpc);
@@ -1940,12 +1942,14 @@ public void doInTransactionWithoutResult(final TransactionStatus status) {
 
     @Override
     public Vpc updateVpc(UpdateVPCCmd cmd) throws ResourceUnavailableException, InsufficientCapacityException {
-        return updateVpc(cmd.getId(), cmd.getVpcName(), cmd.getDisplayText(), cmd.getCustomId(), cmd.isDisplayVpc(), cmd.getPublicMtu(), cmd.getSourceNatIP());
+        return updateVpc(cmd.getId(), cmd.getVpcName(), cmd.getDisplayText(), cmd.getCustomId(),
+                cmd.isDisplayVpc(), cmd.getPublicMtu(), cmd.getSourceNatIP(), cmd.getKeepMacAddressOnPublicNic());
     }
 
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_VPC_UPDATE, eventDescription = "updating vpc")
-    public Vpc updateVpc(final long vpcId, final String vpcName, final String displayText, final String customId, final Boolean displayVpc, Integer mtu, String sourceNatIp) throws ResourceUnavailableException, InsufficientCapacityException {
+    public Vpc updateVpc(final long vpcId, final String vpcName, final String displayText, final String customId,
+                         final Boolean displayVpc, Integer mtu, String sourceNatIp, Boolean keepMacAddressOnPublicNic) throws ResourceUnavailableException, InsufficientCapacityException {
         final Account caller = CallContext.current().getCallingAccount();
 
         // Verify input parameters
@@ -1977,6 +1981,10 @@ public Vpc updateVpc(final long vpcId, final String vpcName, final String displa
             vpc.setDisplay(displayVpc);
         }
 
+        if (keepMacAddressOnPublicNic != null) {
+            vpc.setKeepMacAddressOnPublicNic(keepMacAddressOnPublicNic);
+        }
+
         mtu = validateMtu(vpcToUpdate, mtu);
         if (mtu != null) {
             updateMtuOfVpcNetwork(vpcToUpdate, vpc, mtu);
diff --git a/server/src/main/java/org/apache/cloudstack/network/router/deployment/RouterDeploymentDefinition.java b/server/src/main/java/org/apache/cloudstack/network/router/deployment/RouterDeploymentDefinition.java
index 4187586736d7..77cd7890e413 100644
--- a/server/src/main/java/org/apache/cloudstack/network/router/deployment/RouterDeploymentDefinition.java
+++ b/server/src/main/java/org/apache/cloudstack/network/router/deployment/RouterDeploymentDefinition.java
@@ -394,7 +394,7 @@ protected void executeDeployment()
         }
     }
 
-    protected void findSourceNatIP() throws InsufficientAddressCapacityException, ConcurrentOperationException {
+    public void findSourceNatIP() throws InsufficientAddressCapacityException, ConcurrentOperationException {
         sourceNatIp = null;
         DataCenter zone = dest.getDataCenter();
         Long zoneId = null;
@@ -548,4 +548,8 @@ protected boolean routersNeedReset() {
 
         return needReset;
     }
+
+    public boolean getKeepMacAddressOnPublicNic() {
+        return guestNetwork == null || guestNetwork.getKeepMacAddressOnPublicNic();
+    }
 }
diff --git a/server/src/main/java/org/apache/cloudstack/network/router/deployment/VpcRouterDeploymentDefinition.java b/server/src/main/java/org/apache/cloudstack/network/router/deployment/VpcRouterDeploymentDefinition.java
index 063565ebf468..9e432265f2a1 100644
--- a/server/src/main/java/org/apache/cloudstack/network/router/deployment/VpcRouterDeploymentDefinition.java
+++ b/server/src/main/java/org/apache/cloudstack/network/router/deployment/VpcRouterDeploymentDefinition.java
@@ -117,7 +117,7 @@ protected boolean prepareDeployment() {
     }
 
     @Override
-    protected void findSourceNatIP() throws InsufficientAddressCapacityException, ConcurrentOperationException {
+    public void findSourceNatIP() throws InsufficientAddressCapacityException, ConcurrentOperationException {
         sourceNatIp = null;
         DataCenter zone = dest.getDataCenter();
         Long zoneId = null;
@@ -219,4 +219,9 @@ public boolean isRedundant() {
     public boolean isRollingRestart() {
         return vpc.isRollingRestart();
     }
+
+    @Override
+    public boolean getKeepMacAddressOnPublicNic() {
+        return vpc == null || vpc.getKeepMacAddressOnPublicNic();
+    }
 }
diff --git a/server/src/test/java/com/cloud/network/NetworkServiceImplTest.java b/server/src/test/java/com/cloud/network/NetworkServiceImplTest.java
index 51b2dad3decd..cd7d40d68951 100644
--- a/server/src/test/java/com/cloud/network/NetworkServiceImplTest.java
+++ b/server/src/test/java/com/cloud/network/NetworkServiceImplTest.java
@@ -460,7 +460,7 @@ public void testCreateGuestNetwork() throws InsufficientCapacityException, Resou
                 null, null, false, null, accountMock, null, phyNet,
                 1L, null, null, null, null, null,
                 true, null, null, null, null, null,
-                null, null, null, null, new Pair<>(1500, privateMtu), null);
+                null, null, null, null, new Pair<>(1500, privateMtu), null, true);
     }
     @Test
     public void testValidateMtuConfigWhenMtusExceedThreshold() {
@@ -1330,4 +1330,52 @@ public void addProjectNetworksConditionToSearch_includesSpecificProjectWhenProje
         Mockito.verify(accountJoin).addAnd("type", SearchCriteria.Op.EQ, Account.Type.PROJECT);
         Mockito.verify(sc).addAnd("id", SearchCriteria.Op.SC, accountJoin);
     }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void getAndValidateSupportForKeepMacAddressOnPublicNicParameterTestThrowExceptionWhenParamIsSpecifiedOnTiersCreation() {
+        networkOfferingVO = Mockito.mock(NetworkOfferingVO.class);
+        Mockito.when(networkOfferingVO.isForVpc()).thenReturn(true);
+
+        service.getAndValidateSupportForKeepMacAddressOnPublicNicParameter(true, networkOfferingVO);
+    }
+
+    @Test
+    public void getAndValidateSupportForKeepMacAddressOnPublicNicParameterTestReturnTrueByDefaultOnTiersCreation() {
+        networkOfferingVO = Mockito.mock(NetworkOfferingVO.class);
+        Mockito.when(networkOfferingVO.isForVpc()).thenReturn(true);
+
+        Assert.assertTrue(service.getAndValidateSupportForKeepMacAddressOnPublicNicParameter(null, networkOfferingVO));
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void getAndValidateSupportForKeepMacAddressOnPublicNicParameterTestThrowExceptionWhenParamIsSpecifiedOnNonIsolatedNetworksCreation() {
+        networkOfferingVO = Mockito.mock(NetworkOfferingVO.class);
+        Mockito.when(networkOfferingVO.getGuestType()).thenReturn(Network.GuestType.Shared);
+
+        service.getAndValidateSupportForKeepMacAddressOnPublicNicParameter(true, networkOfferingVO);
+    }
+
+    @Test
+    public void getAndValidateSupportForKeepMacAddressOnPublicNicParameterTestReturnTrueByDefaultOnNonIsolatedNetworksCreation() {
+        networkOfferingVO = Mockito.mock(NetworkOfferingVO.class);
+        Mockito.when(networkOfferingVO.getGuestType()).thenReturn(Network.GuestType.L2);
+
+        Assert.assertTrue(service.getAndValidateSupportForKeepMacAddressOnPublicNicParameter(null, networkOfferingVO));
+    }
+
+    @Test
+    public void getAndValidateSupportForKeepMacAddressOnPublicNicParameterTestReturnTrueByDefaultOnIsolatedNetworksCreation() {
+        networkOfferingVO = Mockito.mock(NetworkOfferingVO.class);
+        Mockito.when(networkOfferingVO.getGuestType()).thenReturn(Network.GuestType.Isolated);
+
+        Assert.assertTrue(service.getAndValidateSupportForKeepMacAddressOnPublicNicParameter(null, networkOfferingVO));
+    }
+
+    @Test
+    public void getAndValidateSupportForKeepMacAddressOnPublicNicParameterTestReturnSpecifiedValueOnIsolatedNetworksCreation() {
+        networkOfferingVO = Mockito.mock(NetworkOfferingVO.class);
+        Mockito.when(networkOfferingVO.getGuestType()).thenReturn(Network.GuestType.Isolated);
+
+        Assert.assertFalse(service.getAndValidateSupportForKeepMacAddressOnPublicNicParameter(false, networkOfferingVO));
+    }
 }
diff --git a/server/src/test/java/com/cloud/network/router/NetworkHelperImplTest.java b/server/src/test/java/com/cloud/network/router/NetworkHelperImplTest.java
index 4237ef7f6f65..e4773d01de92 100644
--- a/server/src/test/java/com/cloud/network/router/NetworkHelperImplTest.java
+++ b/server/src/test/java/com/cloud/network/router/NetworkHelperImplTest.java
@@ -24,18 +24,31 @@
 import static org.mockito.Mockito.doReturn;
 import static org.mockito.Mockito.lenient;
 import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.when;
 
+import com.cloud.deploy.DeployDestination;
+import com.cloud.exception.InsufficientAddressCapacityException;
+import com.cloud.network.Ipv6Service;
+import com.cloud.network.Network;
+import com.cloud.network.Networks;
+import com.cloud.network.addr.PublicIp;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.offering.NetworkOffering;
+import com.cloud.utils.net.Ip;
+import com.cloud.vm.NicProfile;
+import com.cloud.vm.NicVO;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
 import org.apache.cloudstack.network.router.deployment.RouterDeploymentDefinition;
+import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.mockito.InjectMocks;
 import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
 
 import com.cloud.agent.AgentManager;
@@ -57,6 +70,9 @@
 import com.cloud.vm.dao.DomainRouterDao;
 import com.cloud.vm.dao.NicDao;
 
+import java.util.List;
+import java.util.Map;
+
 
 @RunWith(MockitoJUnitRunner.class)
 public class NetworkHelperImplTest {
@@ -69,32 +85,59 @@ public class NetworkHelperImplTest {
     @Mock
     DomainRouterDao routerDao;
 
+    @Spy
     @InjectMocks
-    protected NetworkHelperImpl nwHelper = new NetworkHelperImpl();
+    protected NetworkHelperImpl networkHelperSpy = new NetworkHelperImpl();
+
     @Mock
     NetworkOrchestrationService networkOrchestrationService;
+
     @Mock
     NetworkDao networkDao;
+
     @Mock
     NetworkModel networkModel;
+
     @Mock
-    NicDao nicDao;
+    private NicDao nicDaoMock;
 
     @Mock
     private RouterDeploymentDefinition routerDeploymentDefinition;
+
     @Mock
     private VirtualRouterProvider virtualProvider;
+
     @Mock
     private Account owner;
+
     @Mock
     private ServiceOfferingVO routerOffering;
+
     @Mock
     private VMTemplateVO template;
 
+    @Mock
+    private PublicIp publicIpMock;
+
+    @Mock
+    private RouterDeploymentDefinition routerDeploymentDefinitionMock;
+
+    @Mock
+    private Ipv6Service ipv6ServiceMock;
+
+    @Mock
+    private NicVO nicVoMock;
+
+    @Mock
+    private Network networkMock;
+
+    private NicProfile nicProfile = new NicProfile();
+
     @Before
     public void setUp() {
-        nwHelper._networkDao = networkDao;
-        nwHelper._networkModel = networkModel;
+        networkHelperSpy._networkDao = networkDao;
+        networkHelperSpy._networkModel = networkModel;
+
         when(template.getId()).thenReturn(1L);
         when(template.isDynamicallyScalable()).thenReturn(true);
         when(virtualProvider.getId()).thenReturn(1L);
@@ -107,7 +150,7 @@ public void setUp() {
     public void testSendCommandsToRouterWrongRouterVersion()
             throws AgentUnavailableException, OperationTimedoutException, ResourceUnavailableException {
         // Prepare
-        NetworkHelperImpl nwHelperUT = spy(this.nwHelper);
+        NetworkHelperImpl nwHelperUT = networkHelperSpy;
         VirtualRouter vr = mock(VirtualRouter.class);
         doReturn(false).when(nwHelperUT).checkRouterVersion(vr);
 
@@ -122,7 +165,7 @@ public void testSendCommandsToRouterWrongRouterVersion()
     public void testSendCommandsToRouter()
             throws AgentUnavailableException, OperationTimedoutException, ResourceUnavailableException {
         // Prepare
-        NetworkHelperImpl nwHelperUT = spy(this.nwHelper);
+        NetworkHelperImpl nwHelperUT = networkHelperSpy;
         VirtualRouter vr = mock(VirtualRouter.class);
         when(vr.getHostId()).thenReturn(HOST_ID);
         doReturn(true).when(nwHelperUT).checkRouterVersion(vr);
@@ -160,7 +203,7 @@ public void testSendCommandsToRouter()
     public void testSendCommandsToRouterWithTrueResult()
             throws AgentUnavailableException, OperationTimedoutException, ResourceUnavailableException {
         // Prepare
-        NetworkHelperImpl nwHelperUT = spy(this.nwHelper);
+        NetworkHelperImpl nwHelperUT = networkHelperSpy;
         VirtualRouter vr = mock(VirtualRouter.class);
         when(vr.getHostId()).thenReturn(HOST_ID);
         doReturn(true).when(nwHelperUT).checkRouterVersion(vr);
@@ -198,7 +241,7 @@ public void testSendCommandsToRouterWithTrueResult()
     public void testSendCommandsToRouterWithNoAnswers()
             throws AgentUnavailableException, OperationTimedoutException, ResourceUnavailableException {
         // Prepare
-        NetworkHelperImpl nwHelperUT = spy(this.nwHelper);
+        NetworkHelperImpl nwHelperUT = networkHelperSpy;
         VirtualRouter vr = mock(VirtualRouter.class);
         when(vr.getHostId()).thenReturn(HOST_ID);
         doReturn(true).when(nwHelperUT).checkRouterVersion(vr);
@@ -227,7 +270,7 @@ public void testCreateDomainRouter_New() {
         boolean offerHA = false;
         Long vpcId = 900L;
         when(routerDao.persist(any(DomainRouterVO.class))).thenAnswer(invocation -> invocation.getArgument(0));
-        DomainRouterVO result = nwHelper.createOrUpdateDomainRouter(
+        DomainRouterVO result = networkHelperSpy.createOrUpdateDomainRouter(
                 null, id, routerDeploymentDefinition, owner, userId, routerOffering, offerHA, vpcId, template);
         assertNotNull(result);
         assertEquals(id, result.getId());
@@ -261,11 +304,234 @@ public void testUpdateDomainRouter() {
                 owner.getDomainId(), owner.getId(), userId, routerDeploymentDefinition.isRedundant(), VirtualRouter.RedundantState.UNKNOWN,
                 offerHA, false, vpcId);
         existing.setDynamicallyScalable(false);
-        DomainRouterVO result = nwHelper.createOrUpdateDomainRouter(
+        DomainRouterVO result = networkHelperSpy.createOrUpdateDomainRouter(
                 existing, id, routerDeploymentDefinition, owner, userId, routerOffering, offerHA, vpcId, template);
         verify(routerDao).update(existing.getId(), existing);
         assertEquals(template.getId(), result.getTemplateId());
         assertEquals(Hypervisor.HypervisorType.KVM, result.getHypervisorType());
         assertTrue(result.isDynamicallyScalable());
     }
+
+
+    private NicProfile getExpectedNicProfile(boolean vxlan, String vlanTag) {
+        NicProfile nic = new NicProfile();
+        nic.setDefaultNic(true);
+        nic.setIPv4Address("192.168.0.10");
+        nic.setIPv4Gateway("192.168.0.1");
+        nic.setIPv4Netmask("255.255.255.0");
+        nic.setMacAddress("ff-ff-ff-ff-ff-ff");
+
+        if (vxlan) {
+            nic.setBroadcastType(Networks.BroadcastDomainType.Vxlan);
+            nic.setBroadcastUri(Networks.BroadcastDomainType.Vxlan.toUri(vlanTag));
+            nic.setIsolationUri(Networks.BroadcastDomainType.Vxlan.toUri(vlanTag));
+        } else {
+            nic.setBroadcastType(Networks.BroadcastDomainType.Vlan);
+            nic.setBroadcastUri(vlanTag != null ? Networks.BroadcastDomainType.Vlan.toUri(vlanTag) : null);
+            nic.setIsolationUri(vlanTag != null ? Networks.IsolationType.Vlan.toUri(vlanTag) : null);
+        }
+
+        return nic;
+    }
+
+    @Test
+    public void configurePublicVrNicBasedOnSourceNatIpTestConfigureVxLanNic() {
+        String vlanTag = "200";
+        NicProfile expected = getExpectedNicProfile(true, vlanTag);
+
+        Ip ipMock = Mockito.mock(Ip.class);
+        NetworkVO publicNetworkMock = Mockito.mock(NetworkVO.class);
+        long networkId = 1L;
+        Mockito.when(publicIpMock.getAddress()).thenReturn(ipMock);
+        Mockito.when(ipMock.addr()).thenReturn(expected.getIPv4Address());
+        Mockito.when(publicIpMock.getGateway()).thenReturn(expected.getIPv4Gateway());
+        Mockito.when(publicIpMock.getNetmask()).thenReturn(expected.getIPv4Netmask());
+        Mockito.when(publicIpMock.getMacAddress()).thenReturn(expected.getMacAddress());
+        Mockito.when(publicIpMock.getNetworkId()).thenReturn(networkId);
+        Mockito.when(networkDao.findById(networkId)).thenReturn(publicNetworkMock);
+        Mockito.when(publicNetworkMock.getBroadcastDomainType()).thenReturn(Networks.BroadcastDomainType.Vxlan);
+        Mockito.when(publicIpMock.getVlanTag()).thenReturn(vlanTag);
+
+        networkHelperSpy.configurePublicVrNicBasedOnSourceNatIp(nicProfile, publicIpMock);
+
+        Assert.assertTrue(nicProfile.isDefaultNic());
+        Assert.assertEquals(expected.getIPv4Address(), nicProfile.getIPv4Address());
+        Assert.assertEquals(expected.getIPv4Gateway(), nicProfile.getIPv4Gateway());
+        Assert.assertEquals(expected.getIPv4Netmask(), nicProfile.getIPv4Netmask());
+        Assert.assertEquals(expected.getMacAddress(), nicProfile.getMacAddress());
+        Assert.assertEquals(expected.getBroadcastType(), nicProfile.getBroadcastType());
+        Assert.assertEquals(expected.getBroadCastUri(), nicProfile.getBroadCastUri());
+        Assert.assertEquals(expected.getIsolationUri(), nicProfile.getIsolationUri());
+    }
+
+    @Test
+    public void configurePublicVrNicBasedOnSourceNatIpTestConfigureVlanNicWithVlanTag() {
+        String vlanTag = "200";
+        NicProfile expected = getExpectedNicProfile(false, vlanTag);
+
+        Ip ipMock = Mockito.mock(Ip.class);
+        NetworkVO publicNetworkMock = Mockito.mock(NetworkVO.class);
+        long networkId = 1L;
+        Mockito.when(publicIpMock.getAddress()).thenReturn(ipMock);
+        Mockito.when(ipMock.addr()).thenReturn(expected.getIPv4Address());
+        Mockito.when(publicIpMock.getGateway()).thenReturn(expected.getIPv4Gateway());
+        Mockito.when(publicIpMock.getNetmask()).thenReturn(expected.getIPv4Netmask());
+        Mockito.when(publicIpMock.getMacAddress()).thenReturn(expected.getMacAddress());
+        Mockito.when(publicIpMock.getNetworkId()).thenReturn(networkId);
+        Mockito.when(networkDao.findById(networkId)).thenReturn(publicNetworkMock);
+        Mockito.when(publicNetworkMock.getBroadcastDomainType()).thenReturn(Networks.BroadcastDomainType.Vlan);
+        Mockito.when(publicIpMock.getVlanTag()).thenReturn(vlanTag);
+
+        networkHelperSpy.configurePublicVrNicBasedOnSourceNatIp(nicProfile, publicIpMock);
+
+        Assert.assertTrue(nicProfile.isDefaultNic());
+        Assert.assertEquals(expected.getIPv4Address(), nicProfile.getIPv4Address());
+        Assert.assertEquals(expected.getIPv4Gateway(), nicProfile.getIPv4Gateway());
+        Assert.assertEquals(expected.getIPv4Netmask(), nicProfile.getIPv4Netmask());
+        Assert.assertEquals(expected.getMacAddress(), nicProfile.getMacAddress());
+        Assert.assertEquals(expected.getBroadcastType(), nicProfile.getBroadcastType());
+        Assert.assertEquals(expected.getBroadCastUri(), nicProfile.getBroadCastUri());
+        Assert.assertEquals(expected.getIsolationUri(), nicProfile.getIsolationUri());
+    }
+
+    @Test
+    public void configurePublicVrNicBasedOnSourceNatIpTestConfigureVlanNicWithNoVlanTag() {
+        String vlanTag = null;
+        NicProfile expected = getExpectedNicProfile(false, vlanTag);
+
+        Ip ipMock = Mockito.mock(Ip.class);
+        NetworkVO publicNetworkMock = Mockito.mock(NetworkVO.class);
+        long networkId = 1L;
+        Mockito.when(publicIpMock.getAddress()).thenReturn(ipMock);
+        Mockito.when(ipMock.addr()).thenReturn(expected.getIPv4Address());
+        Mockito.when(publicIpMock.getGateway()).thenReturn(expected.getIPv4Gateway());
+        Mockito.when(publicIpMock.getNetmask()).thenReturn(expected.getIPv4Netmask());
+        Mockito.when(publicIpMock.getMacAddress()).thenReturn(expected.getMacAddress());
+        Mockito.when(publicIpMock.getNetworkId()).thenReturn(networkId);
+        Mockito.when(networkDao.findById(networkId)).thenReturn(publicNetworkMock);
+        Mockito.when(publicNetworkMock.getBroadcastDomainType()).thenReturn(Networks.BroadcastDomainType.Vlan);
+        Mockito.when(publicIpMock.getVlanTag()).thenReturn(vlanTag);
+
+        networkHelperSpy.configurePublicVrNicBasedOnSourceNatIp(nicProfile, publicIpMock);
+
+        Assert.assertTrue(nicProfile.isDefaultNic());
+        Assert.assertEquals(expected.getIPv4Address(), nicProfile.getIPv4Address());
+        Assert.assertEquals(expected.getIPv4Gateway(), nicProfile.getIPv4Gateway());
+        Assert.assertEquals(expected.getIPv4Netmask(), nicProfile.getIPv4Netmask());
+        Assert.assertEquals(expected.getMacAddress(), nicProfile.getMacAddress());
+        Assert.assertEquals(expected.getBroadcastType(), nicProfile.getBroadcastType());
+        Assert.assertEquals(expected.getBroadCastUri(), nicProfile.getBroadCastUri());
+        Assert.assertEquals(expected.getIsolationUri(), nicProfile.getIsolationUri());
+    }
+
+    @Test
+    public void setPublicNicMacAddressSameAsPeerNicTestDoNothingWhenThereIsNoPeer() throws InsufficientAddressCapacityException {
+        String newMacAddress = "ff-ff-ff-ff-ff-ff";
+        nicProfile.setIPv4Address("10.0.0.1");
+        nicProfile.setMacAddress(newMacAddress);
+        Mockito.when(nicDaoMock.findByIp4AddressAndNetworkId(Mockito.anyString(), Mockito.anyLong())).thenReturn(null);
+
+        networkHelperSpy.setPublicNicMacAddressSameAsPeerNic(nicProfile, networkMock, routerDeploymentDefinitionMock);
+
+        Assert.assertEquals(newMacAddress, nicProfile.getMacAddress());
+    }
+
+    @Test
+    public void setPublicNicMacAddressSameAsPeerNicTestKeepMacAddress() throws InsufficientAddressCapacityException {
+        String peerMacAddress = "ff-ff-ff-ff-ff-ff";
+        nicProfile.setIPv4Address("10.0.0.1");
+        nicProfile.setMacAddress("ff-ff-ff-ff-ff-f1");
+
+        Mockito.when(nicDaoMock.findByIp4AddressAndNetworkId(Mockito.anyString(), Mockito.anyLong())).thenReturn(nicVoMock);
+        Mockito.when(nicVoMock.getMacAddress()).thenReturn(peerMacAddress);
+        Mockito.when(routerDeploymentDefinitionMock.getKeepMacAddressOnPublicNic()).thenReturn(true);
+
+        networkHelperSpy.setPublicNicMacAddressSameAsPeerNic(nicProfile, networkMock, routerDeploymentDefinitionMock);
+
+        Assert.assertEquals(peerMacAddress, nicProfile.getMacAddress());
+    }
+
+    @Test
+    public void setPublicNicMacAddressSameAsPeerNicTestDifferentMacAddressFetchingNewSourceNatIp() throws InsufficientAddressCapacityException {
+        String macAddress = "ff-ff-ff-ff-ff-f1";
+        nicProfile.setIPv4Address("10.0.0.1");
+        nicProfile.setMacAddress(macAddress);
+        PublicIp publicIpMock = Mockito.mock(PublicIp.class);
+
+        Mockito.when(nicDaoMock.findByIp4AddressAndNetworkId(Mockito.anyString(), Mockito.anyLong())).thenReturn(nicVoMock);
+        Mockito.when(nicVoMock.getMacAddress()).thenReturn(macAddress);
+        Mockito.when(routerDeploymentDefinitionMock.getKeepMacAddressOnPublicNic()).thenReturn(false);
+        Mockito.when(routerDeploymentDefinitionMock.getSourceNatIP()).thenReturn(publicIpMock);
+        Mockito.doNothing().when(networkHelperSpy).configurePublicVrNicBasedOnSourceNatIp(nicProfile, publicIpMock);
+
+        networkHelperSpy.setPublicNicMacAddressSameAsPeerNic(nicProfile, networkMock, routerDeploymentDefinitionMock);
+
+        Mockito.verify(routerDeploymentDefinitionMock).findSourceNatIP();
+        Mockito.verify(networkHelperSpy).configurePublicVrNicBasedOnSourceNatIp(nicProfile, publicIpMock);
+    }
+
+    @Test
+    public void setPublicNicMacAddressSameAsPeerNicTestDifferentMacAddressNotFetchingNewSourceNatIp() throws InsufficientAddressCapacityException {
+        String newMacAddress = "ff-ff-ff-ff-ff-ff";
+        nicProfile.setIPv4Address("10.0.0.1");
+        nicProfile.setMacAddress(newMacAddress);
+
+        Mockito.when(nicDaoMock.findByIp4AddressAndNetworkId(Mockito.anyString(), Mockito.anyLong())).thenReturn(nicVoMock);
+        Mockito.when(nicVoMock.getMacAddress()).thenReturn("ff-ff-ff-ff-ff-f1");
+        Mockito.when(routerDeploymentDefinitionMock.getKeepMacAddressOnPublicNic()).thenReturn(false);
+
+        networkHelperSpy.setPublicNicMacAddressSameAsPeerNic(nicProfile, networkMock, routerDeploymentDefinitionMock);
+
+        Mockito.verify(routerDeploymentDefinitionMock, Mockito.never()).findSourceNatIP();
+        Mockito.verify(networkHelperSpy, Mockito.never()).configurePublicVrNicBasedOnSourceNatIp(Mockito.any(), Mockito.any());
+        Assert.assertEquals(newMacAddress, nicProfile.getMacAddress());
+    }
+
+    @Test
+    public void configurePublicNicTestReturnEmptyMapWhenNetworkIsNotPublic() throws InsufficientAddressCapacityException {
+        Mockito.when(routerDeploymentDefinitionMock.isPublicNetwork()).thenReturn(false);
+
+        Map<Network, List<? extends NicProfile>> nic = networkHelperSpy.configurePublicNic(routerDeploymentDefinitionMock, false);
+        Assert.assertTrue(nic.isEmpty());
+    }
+
+    @Test
+    public void configurePublicNicTestConfigureDeviceId() throws InsufficientAddressCapacityException {
+        PublicIp publicIpMock = Mockito.mock(PublicIp.class);
+        NetworkOffering networkOfferingMock = Mockito.mock(NetworkOffering.class);
+
+        Mockito.when(routerDeploymentDefinitionMock.isPublicNetwork()).thenReturn(true);
+        Mockito.when(routerDeploymentDefinitionMock.getSourceNatIP()).thenReturn(publicIpMock);
+        Mockito.doNothing().when(networkHelperSpy).configurePublicVrNicBasedOnSourceNatIp(Mockito.any(), Mockito.any());
+        Mockito.doReturn(List.of(networkOfferingMock)).when(networkModel).getSystemAccountNetworkOfferings(Mockito.any());
+        Mockito.doReturn(List.of(networkMock)).when(networkOrchestrationService).setupNetwork(
+                Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyBoolean()
+        );
+        Mockito.doNothing().when(networkHelperSpy).setPublicNicMacAddressSameAsPeerNic(Mockito.any(), Mockito.any(), Mockito.any());
+
+        Map<Network, List<? extends NicProfile>> nic = networkHelperSpy.configurePublicNic(routerDeploymentDefinitionMock, true);
+        Integer nicDeviceId = nic.get(networkMock).get(0).getDeviceId();
+        Assert.assertEquals(2, nicDeviceId.intValue());
+    }
+
+    @Test
+    public void configurePublicNicTestUpdateGuestNetworksIpv6Nic() throws InsufficientAddressCapacityException {
+        PublicIp publicIpMock = Mockito.mock(PublicIp.class);
+        NetworkOffering networkOfferingMock = Mockito.mock(NetworkOffering.class);
+        DeployDestination deployDestinationMock = Mockito.mock(DeployDestination.class);
+
+        Mockito.when(routerDeploymentDefinitionMock.isPublicNetwork()).thenReturn(true);
+        Mockito.when(routerDeploymentDefinitionMock.getSourceNatIP()).thenReturn(publicIpMock);
+        Mockito.doNothing().when(networkHelperSpy).configurePublicVrNicBasedOnSourceNatIp(Mockito.any(), Mockito.any());
+        Mockito.doReturn(List.of(networkOfferingMock)).when(networkModel).getSystemAccountNetworkOfferings(Mockito.any());
+        Mockito.doReturn(List.of(networkMock)).when(networkOrchestrationService).setupNetwork(
+                Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyBoolean()
+        );
+        Mockito.doNothing().when(networkHelperSpy).setPublicNicMacAddressSameAsPeerNic(Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.when(routerDeploymentDefinitionMock.getGuestNetwork()).thenReturn(networkMock);
+        Mockito.when(routerDeploymentDefinitionMock.getDest()).thenReturn(deployDestinationMock);
+
+        Map<Network, List<? extends NicProfile>> nic = networkHelperSpy.configurePublicNic(routerDeploymentDefinitionMock, false);
+        Mockito.verify(ipv6ServiceMock).updateNicIpv6(Mockito.eq(nic.get(networkMock).get(0)), Mockito.any(), Mockito.eq(networkMock));
+    }
 }
diff --git a/server/src/test/java/com/cloud/network/vpc/VpcManagerImplTest.java b/server/src/test/java/com/cloud/network/vpc/VpcManagerImplTest.java
index 9569769b016d..8b8259421cd0 100644
--- a/server/src/test/java/com/cloud/network/vpc/VpcManagerImplTest.java
+++ b/server/src/test/java/com/cloud/network/vpc/VpcManagerImplTest.java
@@ -492,7 +492,7 @@ public void testCreateVpcDnsOfferingServiceFailure() {
         mockVpcDnsResources(false, false);
         try {
             manager.createVpc(zoneId, vpcOfferingId, vpcOwnerId, vpcName, vpcName, ip4Cidr, vpcDomain,
-                    ip4Dns[0], null, null, null, true, 1500, null, null, null, false);
+                    ip4Dns[0], null, null, null, true, 1500, null, null, null, false, true);
         } catch (ResourceAllocationException e) {
             Assert.fail(String.format("failure with exception: %s", e.getMessage()));
         }
@@ -503,7 +503,7 @@ public void testCreateVpcDnsIpv6OfferingFailure() {
         mockVpcDnsResources(true, false);
         try {
             manager.createVpc(zoneId, vpcOfferingId, vpcOwnerId, vpcName, vpcName, ip4Cidr, vpcDomain,
-                    ip4Dns[0], ip4Dns[1], ip6Dns[0], null, true, 1500, null, null, null, false);
+                    ip4Dns[0], ip4Dns[1], ip6Dns[0], null, true, 1500, null, null, null, false, true);
         } catch (ResourceAllocationException e) {
             Assert.fail(String.format("failure with exception: %s", e.getMessage()));
         }
@@ -517,7 +517,7 @@ public void testCreateVpc() {
         Mockito.when(vpc.getUuid()).thenReturn("uuid");
         try (MockedConstruction<CheckedReservation> mockCheckedReservation = Mockito.mockConstruction(CheckedReservation.class)) {
             manager.createVpc(zoneId, vpcOfferingId, vpcOwnerId, vpcName, vpcName, ip4Cidr, vpcDomain,
-                    ip4Dns[0], ip4Dns[1], null, null, true, 1500, null, null, null, false);
+                    ip4Dns[0], ip4Dns[1], null, null, true, 1500, null, null, null, false, true);
         } catch (ResourceAllocationException e) {
             Assert.fail(String.format("failure with exception: %s", e.getMessage()));
         }
@@ -533,7 +533,7 @@ public void testCreateRoutedVpc() {
         doNothing().when(routedIpv4Manager).getOrCreateIpv4SubnetForVpc(any(), anyString());
         try (MockedConstruction<CheckedReservation> mockCheckedReservation = Mockito.mockConstruction(CheckedReservation.class)) {
             manager.createVpc(zoneId, vpcOfferingId, vpcOwnerId, vpcName, vpcName, ip4Cidr, vpcDomain,
-                    ip4Dns[0], ip4Dns[1], null, null, true, 1500, null, null, null, false);
+                    ip4Dns[0], ip4Dns[1], null, null, true, 1500, null, null, null, false, true);
         } catch (ResourceAllocationException e) {
             Assert.fail(String.format("failure with exception: %s", e.getMessage()));
         }
@@ -556,7 +556,7 @@ public void testCreateRoutedVpcWithDynamicRouting() {
         try (MockedConstruction<CheckedReservation> mockCheckedReservation = Mockito.mockConstruction(CheckedReservation.class)) {
 
             manager.createVpc(zoneId, vpcOfferingId, vpcOwnerId, vpcName, vpcName, null, vpcDomain,
-                    ip4Dns[0], ip4Dns[1], null, null, true, 1500, 24, null, bgpPeerIds, false);
+                    ip4Dns[0], ip4Dns[1], null, null, true, 1500, 24, null, bgpPeerIds, false, true);
         } catch (ResourceAllocationException e) {
             Assert.fail(String.format("failure with exception: %s", e.getMessage()));
         }
diff --git a/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java b/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
index 3b120b88db45..e4bc2096b9da 100644
--- a/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
+++ b/server/src/test/java/com/cloud/vpc/MockNetworkManagerImpl.java
@@ -704,11 +704,19 @@ public Network createPrivateNetwork(final long networkOfferingId, final String n
     public Network createGuestNetwork(long networkOfferingId, String name, String displayText, String gateway, String cidr, String vlanId, boolean bypassVlanOverlapCheck, String networkDomain,
                                       Account owner, Long domainId, PhysicalNetwork physicalNetwork, long zoneId, ACLType aclType, Boolean subdomainAccess, Long vpcId, String gatewayv6,
                                       String cidrv6, Boolean displayNetworkEnabled, String isolatedPvlan, Network.PVlanType isolatedPvlanType, String externalId, String routerIp, String routerIpv6,
-                                      String ip4Dns1, String ip4Dns2, String ip6Dns1, String ip6Dns2, Pair<Integer, Integer> vrIfaceMTUs, Integer networkCidrSize) throws ConcurrentOperationException, ResourceAllocationException {
+                                      String ip4Dns1, String ip4Dns2, String ip6Dns1, String ip6Dns2, Pair<Integer, Integer> vrIfaceMTUs, Integer networkCidrSize) throws ConcurrentOperationException {
         // TODO Auto-generated method stub
         return null;
     }
 
+    @Override
+    public Network createGuestNetwork(long networkOfferingId, String name, String displayText, String gateway, String cidr, String vlanId, boolean bypassVlanOverlapCheck, String networkDomain,
+                                      Account owner, Long domainId, PhysicalNetwork physicalNetwork, long zoneId, ACLType aclType, Boolean subdomainAccess, Long vpcId, String gatewayv6,
+                                      String cidrv6, Boolean displayNetworkEnabled, String isolatedPvlan, Network.PVlanType isolatedPvlanType, String externalId, String routerIp, String routerIpv6,
+                                      String ip4Dns1, String ip4Dns2, String ip6Dns1, String ip6Dns2, Pair<Integer, Integer> vrIfaceMTUs, Integer networkCidrSize, boolean keepMacAddressOnPublicNic) throws ConcurrentOperationException {
+        return null;
+    }
+
     /* (non-Javadoc)
      * @see com.cloud.network.NetworkManager#getPasswordResetProvider(com.cloud.network.Network)
      */
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index e2045eba8dfe..f0a6ad3c79b9 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -1433,6 +1433,7 @@
 "label.javadistribution": "Java Runtime Distribution",
 "label.javaversion": "Java Runtime Version",
 "label.keep": "Keep",
+"label.keep.mac.address.on.public.nic": "Use same MAC address for public NIC of VRs",
 "label.kernelversion": "Kernel Version",
 "label.key": "Key",
 "label.keyboard": "Keyboard language",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index c7ca36c1278d..d2910a3a2b98 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -904,6 +904,7 @@
 "label.items.selected": "item(ns) selecionados",
 "label.japanese.keyboard": "Teclado japon\u00eas",
 "label.keep": "Manter",
+"label.keep.mac.address.on.public.nic": "Utilizar o mesmo endere\u00e7o MAC para a NIC p\u00fablica dos VRs",
 "label.key": "Chave",
 "label.keyboard": "Linguagem do teclado",
 "label.keyboardtype": "Tipo de teclado",
diff --git a/ui/src/config/section/network.js b/ui/src/config/section/network.js
index 37cdd0c8b98a..50c2ff4250b0 100644
--- a/ui/src/config/section/network.js
+++ b/ui/src/config/section/network.js
@@ -49,9 +49,14 @@ export default {
         return fields
       },
       details: () => {
-        var fields = ['name', 'id', 'description', 'type', 'traffictype', 'vpcid', 'vlan', 'broadcasturi', 'cidr', 'ip6cidr', 'netmask', 'gateway', 'asnumber', 'aclname', 'ispersistent', 'restartrequired', 'reservediprange', 'redundantrouter', 'networkdomain', 'egressdefaultpolicy', 'zonename', 'account', 'domainpath', 'associatednetwork', 'associatednetworkid', 'ip4routing', 'ip6firewall', 'ip6routing', 'ip6routes', 'dns1', 'dns2', 'ip6dns1', 'ip6dns2', 'publicmtu', 'privatemtu']
-        if (!isAdmin()) {
-          fields = fields.filter(function (e) { return e !== 'broadcasturi' })
+        const fields = ['name', 'id', 'description', 'type', 'traffictype', 'vpcid', 'vlan', 'cidr', 'ip6cidr', 'netmask', 'gateway', 'asnumber', 'aclname', 'ispersistent', 'restartrequired', 'reservediprange', 'redundantrouter', 'networkdomain', 'egressdefaultpolicy', 'zonename', 'account', 'domainpath', 'associatednetwork', 'associatednetworkid', 'ip4routing', 'ip6firewall', 'ip6routing', 'ip6routes', 'dns1', 'dns2', 'ip6dns1', 'ip6dns2', 'publicmtu', 'privatemtu']
+        if (isAdmin()) {
+          const vlanIndex = fields.findIndex(detail => detail === 'vlan')
+          fields.splice(vlanIndex + 1, 0, 'broadcasturi')
+          fields.push({
+            field: 'keepmacaddressonpublicnic',
+            customTitle: 'keep.mac.address.on.public.nic'
+          })
         }
         return fields
       },
@@ -233,7 +238,16 @@ export default {
         fields.push(...['domain', 'zonename'])
         return fields
       },
-      details: ['name', 'id', 'displaytext', 'cidr', 'networkdomain', 'ip4routing', 'ip4routes', 'ip6routes', 'ispersistent', 'redundantvpcrouter', 'restartrequired', 'zonename', 'account', 'domain', 'dns1', 'dns2', 'ip6dns1', 'ip6dns2', 'publicmtu'],
+      details: () => {
+        const fields = ['name', 'id', 'displaytext', 'cidr', 'networkdomain', 'ip4routing', 'ip4routes', 'ip6routes', 'ispersistent', 'redundantvpcrouter', 'restartrequired', 'zonename', 'account', 'domain', 'dns1', 'dns2', 'ip6dns1', 'ip6dns2', 'publicmtu']
+        if (isAdmin()) {
+          fields.push({
+            field: 'keepmacaddressonpublicnic',
+            customTitle: 'keep.mac.address.on.public.nic'
+          })
+        }
+        return fields
+      },
       searchFilters: ['name', 'zoneid', 'domainid', 'account', 'restartrequired', 'tags'],
       related: [{
         name: 'vm',
@@ -268,7 +282,13 @@ export default {
           icon: 'edit-outlined',
           label: 'label.edit',
           dataView: true,
-          args: ['name', 'displaytext', 'publicmtu', 'sourcenatipaddress']
+          args: () => {
+            const fields = ['name', 'displaytext', 'publicmtu', 'sourcenatipaddress']
+            if (isAdmin()) {
+              fields.push('keepmacaddressonpublicnic')
+            }
+            return fields
+          }
         },
         {
           api: 'restartVPC',
diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index f4aa842d8f2b..066226980c5f 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -294,6 +294,11 @@
                     :title="$t('label.default.network.' + field.name + '.isolated.network')"
                     :tooltip="field.description"
                   />
+                  <tooltip-label
+                    v-else-if="field.name === 'keepmacaddressonpublicnic' && currentAction.api === 'updateVPC'"
+                    :title="$t('label.keep.mac.address.on.public.nic')"
+                    :tooltip="field.description"
+                  />
                   <tooltip-label
                     v-else
                     :title="$t('label.' + field.name)"
diff --git a/ui/src/views/network/CreateIsolatedNetworkForm.vue b/ui/src/views/network/CreateIsolatedNetworkForm.vue
index 7dc4dbe75e3f..8d6fed9cf129 100644
--- a/ui/src/views/network/CreateIsolatedNetworkForm.vue
+++ b/ui/src/views/network/CreateIsolatedNetworkForm.vue
@@ -294,6 +294,15 @@
               v-model:value="form.sourcenatipaddress"
               :placeholder="apiParams.sourcenatipaddress?.description"/>
           </a-form-item>
+          <a-form-item name="keepMacAddressOnPublicNic" ref="keepMacAddressOnPublicNic" v-if="isAdmin() && !selectedNetworkOffering?.forvpc">
+            <template #label>
+              <tooltip-label
+                :title="$t('label.keep.mac.address.on.public.nic')"
+                :tooltip="apiParams.keepmacaddressonpublicnic?.description"
+              />
+            </template>
+            <a-switch v-model:checked="form.keepMacAddressOnPublicNic" />
+          </a-form-item>
           <div :span="24" class="action-button">
             <a-button
               :loading="actionLoading"
@@ -408,7 +417,9 @@ export default {
   methods: {
     initForm () {
       this.formRef = ref()
-      this.form = reactive({})
+      this.form = reactive({
+        keepMacAddressOnPublicNic: true
+      })
       this.rules = reactive({
         name: [{ required: true, message: this.$t('message.error.name') }],
         zoneid: [{ type: 'number', required: true, message: this.$t('message.error.select') }],
@@ -600,14 +611,15 @@ export default {
         const formRaw = toRaw(this.form)
         const values = this.handleRemoveFields(formRaw)
         this.actionLoading = true
-        var params = {
+        const params = {
           zoneId: this.selectedZone.id,
           name: values.name,
           displayText: values.displaytext,
-          networkOfferingId: this.selectedNetworkOffering.id
+          networkOfferingId: this.selectedNetworkOffering.id,
+          keepmacaddressonpublicnic: values.keepMacAddressOnPublicNic
         }
-        var usefulFields = ['gateway', 'netmask', 'cidrsize', 'startip', 'startipv4', 'endip', 'endipv4', 'dns1', 'dns2', 'ip6dns1', 'ip6dns2', 'sourcenatipaddress', 'externalid', 'vpcid', 'vlan', 'networkdomain']
-        for (var field of usefulFields) {
+        const usefulFields = ['gateway', 'netmask', 'cidrsize', 'startip', 'startipv4', 'endip', 'endipv4', 'dns1', 'dns2', 'ip6dns1', 'ip6dns2', 'sourcenatipaddress', 'externalid', 'vpcid', 'vlan', 'networkdomain']
+        for (const field of usefulFields) {
           if (this.isValidTextValueForKey(values, field)) {
             params[field] = values[field]
           }
diff --git a/ui/src/views/network/CreateVpc.vue b/ui/src/views/network/CreateVpc.vue
index 2218662076e6..2b66f79b387d 100644
--- a/ui/src/views/network/CreateVpc.vue
+++ b/ui/src/views/network/CreateVpc.vue
@@ -202,6 +202,15 @@
             v-model:value="form.sourcenatipaddress"
             :placeholder="apiParams.sourcenatipaddress?.description"/>
         </a-form-item>
+        <a-form-item name="keepMacAddressOnPublicNic" ref="keepMacAddressOnPublicNic" v-if="isAdmin()">
+          <template #label>
+            <tooltip-label
+              :title="$t('label.keep.mac.address.on.public.nic')"
+              :tooltip="apiParams.keepmacaddressonpublicnic?.description"
+            />
+          </template>
+          <a-switch v-model:checked="form.keepMacAddressOnPublicNic" />
+        </a-form-item>
         <a-form-item name="start" ref="start">
           <template #label>
             <tooltip-label :title="$t('label.start')" :tooltip="apiParams.start.description"/>
@@ -287,7 +296,8 @@ export default {
     initForm () {
       this.formRef = ref()
       this.form = reactive({
-        start: true
+        start: true,
+        keepMacAddressOnPublicNic: true
       })
       this.rules = reactive({
         name: [{ required: true, message: this.$t('message.error.required.input') }],
@@ -447,7 +457,7 @@ export default {
       if (this.loading) return
       this.formRef.value.validate().then(() => {
         const values = toRaw(this.form)
-        var params = {}
+        const params = {}
         if (this.owner?.account) {
           params.account = this.owner.account
           params.domainid = this.owner.domainid
@@ -460,7 +470,11 @@ export default {
           if (input === '' || input === null || input === undefined) {
             continue
           }
-          params[key] = input
+          if (key === 'keepMacAddressOnPublicNic') {
+            params.keepmacaddressonpublicnic = input
+          } else {
+            params[key] = input
+          }
         }
         if (this.selectedVpcOffering.networkmode === 'ROUTED') {
           if ((values.cidr === undefined || values.cidr === '') && (values.cidrsize === undefined || values.cidrsize === '')) {
diff --git a/ui/src/views/network/UpdateNetwork.vue b/ui/src/views/network/UpdateNetwork.vue
index 4a434bb15ae4..2299d842a71f 100644
--- a/ui/src/views/network/UpdateNetwork.vue
+++ b/ui/src/views/network/UpdateNetwork.vue
@@ -208,6 +208,15 @@
           </template>
           <a-switch v-model:checked="form.displaynetwork" />
         </a-form-item>
+        <a-form-item name="keepMacAddressOnPublicNic" ref="keepMacAddressOnPublicNic" v-if="isAdmin() && isUpdatingIsolatedNetwork && !resource?.vpcid">
+          <template #label>
+            <tooltip-label
+              :title="$t('label.keep.mac.address.on.public.nic')"
+              :tooltip="apiParams.keepmacaddressonpublicnic?.description"
+            />
+          </template>
+          <a-switch v-model:checked="form.keepMacAddressOnPublicNic" />
+        </a-form-item>
         <a-form-item name="forced" ref="forced" v-if="isAdmin()">
           <template #label>
             <tooltip-label :title="$t('label.forced')" :tooltip="apiParams.forced.description"/>
@@ -310,7 +319,8 @@ export default {
       this.form = reactive({
         displaynetwork: this.resource.displaynetwork,
         privatemtu: this.resource.privatemtu,
-        publicmtu: this.resource.publicmtu
+        publicmtu: this.resource.publicmtu,
+        keepMacAddressOnPublicNic: this.resource.keepmacaddressonpublicnic
       })
       this.rules = reactive({
         name: [{ required: true, message: this.$t('message.error.required.input') }],
@@ -393,18 +403,20 @@ export default {
         const formRaw = toRaw(this.form)
         const values = this.handleRemoveFields(formRaw)
         this.loading = true
-        var manualFields = ['name', 'networkofferingid']
+        const manualFields = ['name', 'networkofferingid']
         const params = {
           id: this.resource.id,
           name: values.name
         }
-        for (var field in values) {
+        for (const field in values) {
           if (manualFields.includes(field)) continue
-          var fieldValue = values[field]
-          if (fieldValue !== undefined &&
-            fieldValue !== null &&
-            (!(field in this.resourceValues) || this.resourceValues[field] !== fieldValue)) {
-            params[field] = fieldValue
+          const fieldValue = values[field]
+          if (fieldValue !== undefined && fieldValue !== null && (!(field in this.resourceValues) || this.resourceValues[field] !== fieldValue)) {
+            if (field === 'keepMacAddressOnPublicNic') {
+              params.keepmacaddressonpublicnic = fieldValue
+            } else {
+              params[field] = fieldValue
+            }
           }
         }
         if (values.networkofferingid !== undefined &&

From cbc1ae738803544ba52c7072f81d0dc3847786de Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Thu, 7 May 2026 10:06:32 -0300
Subject: [PATCH 18/64] Bump the github-actions-dependencies group across 1
 directory with 9 updates (#13042)

Bumps the github-actions-dependencies group with 9 updates in the / directory:

| Package | From | To |
| --- | --- | --- |
| [codecov/codecov-action](https://github.com/codecov/codecov-action) | `4` | `6` |
| [github/codeql-action](https://github.com/github/codeql-action) | `3` | `4` |
| [github/gh-aw](https://github.com/github/gh-aw) | `0.45.0` | `0.71.1` |
| [actions/github-script](https://github.com/actions/github-script) | `8.0.0` | `9.0.0` |
| [actions/upload-artifact](https://github.com/actions/upload-artifact) | `6.0.0` | `7.0.1` |
| [actions/download-artifact](https://github.com/actions/download-artifact) | `6.0.0` | `8.0.1` |
| [docker/login-action](https://github.com/docker/login-action) | `2` | `4` |
| [eps1lon/actions-label-merge-conflict](https://github.com/eps1lon/actions-label-merge-conflict) | `2.0.0` | `3.0.3` |
| [actions/setup-node](https://github.com/actions/setup-node) | `5` | `6` |



Updates `codecov/codecov-action` from 4 to 6
- [Release notes](https://github.com/codecov/codecov-action/releases)
- [Changelog](https://github.com/codecov/codecov-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/codecov/codecov-action/compare/v4...v6)

Updates `github/codeql-action` from 3 to 4
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/v3...v4)

Updates `github/gh-aw` from 0.45.0 to 0.71.1
- [Release notes](https://github.com/github/gh-aw/releases)
- [Changelog](https://github.com/github/gh-aw/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/gh-aw/compare/58d1d157fbac0f1204798500faefc4f7461ebe28...f01a9d118afa6e306f3645ca31e43f4ea8fb4d22)

Updates `actions/github-script` from 8.0.0 to 9.0.0
- [Release notes](https://github.com/actions/github-script/releases)
- [Commits](https://github.com/actions/github-script/compare/ed597411d8f924073f98dfc5c65a23a2325f34cd...3a2844b7e9c422d3c10d287c895573f7108da1b3)

Updates `actions/upload-artifact` from 6.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a)

Updates `actions/download-artifact` from 6.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c)

Updates `docker/login-action` from 2 to 4
- [Release notes](https://github.com/docker/login-action/releases)
- [Commits](https://github.com/docker/login-action/compare/v2...v4)

Updates `eps1lon/actions-label-merge-conflict` from 2.0.0 to 3.0.3
- [Release notes](https://github.com/eps1lon/actions-label-merge-conflict/releases)
- [Changelog](https://github.com/eps1lon/actions-label-merge-conflict/blob/main/CHANGELOG.md)
- [Commits](https://github.com/eps1lon/actions-label-merge-conflict/compare/v2.0.0...v3.0.3)

Updates `actions/setup-node` from 5 to 6
- [Release notes](https://github.com/actions/setup-node/releases)
- [Commits](https://github.com/actions/setup-node/compare/v5...v6)

---
updated-dependencies:
- dependency-name: actions/download-artifact
  dependency-version: 8.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/github-script
  dependency-version: 9.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/setup-node
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: codecov/codecov-action
  dependency-version: '6'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: docker/login-action
  dependency-version: '4'
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: eps1lon/actions-label-merge-conflict
  dependency-version: 3.0.3
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: github/codeql-action
  dependency-version: 4.35.1
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions-dependencies
- dependency-name: github/gh-aw
  dependency-version: 0.68.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yml                      |  2 +-
 .github/workflows/codecov.yml                 |  2 +-
 .github/workflows/codeql-analysis.yml         |  6 +-
 .github/workflows/daily-repo-status.lock.yml  | 62 +++++++++----------
 .../workflows/docker-cloudstack-simulator.yml |  2 +-
 .github/workflows/issue-triage-agent.lock.yml | 62 +++++++++----------
 .github/workflows/merge-conflict-checker.yml  |  2 +-
 .github/workflows/ui.yml                      |  4 +-
 8 files changed, 71 insertions(+), 71 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index df60179ceb51..48735341d6a5 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -341,7 +341,7 @@ jobs:
           echo -e "Simulator CI Test Results: (only failures listed)\n"
           python3 ./tools/marvin/xunit-reader.py integration-test-results/
 
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v6
         with:
           files: jacoco-coverage.xml
           fail_ci_if_error: true
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
index 88b10ac9178f..0ee10baa385b 100644
--- a/.github/workflows/codecov.yml
+++ b/.github/workflows/codecov.yml
@@ -49,7 +49,7 @@ jobs:
           cd nonoss && bash -x install-non-oss.sh && cd ..
           mvn -P quality -Dsimulator -Dnoredist clean install -T$(nproc)
 
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v6
         with:
           files: ./client/target/site/jacoco-aggregate/jacoco.xml
           fail_ci_if_error: true
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 31a8746b85af..cb1fa88a1023 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -37,12 +37,12 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v6
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3
+        uses: github/codeql-action/init@v4
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v3
+        uses: github/codeql-action/autobuild@v4
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3
+        uses: github/codeql-action/analyze@v4
         with:
           category: "Security"
diff --git a/.github/workflows/daily-repo-status.lock.yml b/.github/workflows/daily-repo-status.lock.yml
index 1d7e7eecd14d..35eb5d409a48 100644
--- a/.github/workflows/daily-repo-status.lock.yml
+++ b/.github/workflows/daily-repo-status.lock.yml
@@ -54,11 +54,11 @@ jobs:
       comment_repo: ""
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Check workflow file
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_WORKFLOW_FILE: "daily-repo-status.lock.yml"
         with:
@@ -96,7 +96,7 @@ jobs:
       secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Checkout
@@ -120,7 +120,7 @@ jobs:
         id: checkout-
         if: |
           github.event.
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
         with:
@@ -132,7 +132,7 @@ jobs:
             await main();
       - name: Generate agentic run
         id:
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         with:
           script: |
             const fs = require('fs');
@@ -469,7 +469,7 @@ jobs:
           }
 
       - name: Generate workflow
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         with:
           script: |
             const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
@@ -559,7 +559,7 @@ jobs:
           {{#runtime-import .github/workflows/daily-repo-status.md}}
 
       - name: Substitute
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.
           GH_AW_GITHUB_ACTOR: ${{ github.actor }}
@@ -589,7 +589,7 @@ jobs:
               }
             });
       - name: Interpolate variables and render
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.
         with:
@@ -667,7 +667,7 @@ jobs:
           bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
       - name: Redact secrets in
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         with:
           script: |
             const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
@@ -682,7 +682,7 @@ jobs:
           SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload Safe
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
         with:
           name: safe-
           path: ${{ env.GH_AW_SAFE_OUTPUTS }}
@@ -690,7 +690,7 @@ jobs:
       - name: Ingest agent
         id:
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
           GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
@@ -704,13 +704,13 @@ jobs:
             await main();
       - name: Upload sanitized agent
         if: always() && env.
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
         with:
           name: agent-
           path: ${{ env.GH_AW_AGENT_OUTPUT }}
           if-no-files-found:
       - name: Upload engine output
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
         with:
           name:
           path: |
@@ -719,7 +719,7 @@ jobs:
           if-no-files-found:
       - name: Parse agent logs for step
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
         with:
@@ -730,7 +730,7 @@ jobs:
             await main();
       - name: Parse MCP Gateway logs for step
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         with:
           script: |
             const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
@@ -755,7 +755,7 @@ jobs:
       - name: Upload agent
         if: always()
         continue-on-error:
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
         with:
           name: agent-
           path: |
@@ -784,12 +784,12 @@ jobs:
       total_count: ${{ steps.missing_tool.outputs.total_count }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Download agent output
         continue-on-error:
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6.0.
         with:
           name: agent-
           path: /tmp/gh-aw/safeoutputs/
@@ -800,7 +800,7 @@ jobs:
           echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
       - name: Process No-Op
         id:
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_NOOP_MAX:
@@ -816,7 +816,7 @@ jobs:
             await main();
       - name: Record Missing
         id:
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_WORKFLOW_NAME: "Daily Repo Status"
@@ -831,7 +831,7 @@ jobs:
             await main();
       - name: Handle Agent
         id:
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_WORKFLOW_NAME: "Daily Repo Status"
@@ -851,7 +851,7 @@ jobs:
             await main();
       - name: Handle No-Op
         id:
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_WORKFLOW_NAME: "Daily Repo Status"
@@ -881,18 +881,18 @@ jobs:
       success: ${{ steps.parse_results.outputs.success }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Download agent
         continue-on-error:
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6.0.
         with:
           name: agent-
           path: /tmp/gh-aw/threat-detection/
       - name: Download agent output
         continue-on-error:
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6.0.
         with:
           name: agent-
           path: /tmp/gh-aw/threat-detection/
@@ -902,7 +902,7 @@ jobs:
         run: |
           echo "Agent output-types: $AGENT_OUTPUT_TYPES"
       - name: Setup threat
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           WORKFLOW_NAME: "Daily Repo Status"
           WORKFLOW_DESCRIPTION: "This workflow creates daily repo status reports. It gathers recent repository\nactivity (issues, PRs, discussions, releases, code changes) and generates\nengaging GitHub issues with productivity insights, community highlights,\nand project recommendations."
@@ -955,7 +955,7 @@ jobs:
           XDG_CONFIG_HOME: /home/
       - name: Parse threat detection
         id:
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         with:
           script: |
             const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
@@ -964,7 +964,7 @@ jobs:
             await main();
       - name: Upload threat detection
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
         with:
           name: threat-detection.
           path: /tmp/gh-aw/threat-detection/detection.
@@ -993,12 +993,12 @@ jobs:
       process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Download agent output
         continue-on-error:
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6.0.
         with:
           name: agent-
           path: /tmp/gh-aw/safeoutputs/
@@ -1009,7 +1009,7 @@ jobs:
           echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
       - name: Process Safe
         id:
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"report\",\"daily-status\"],\"max\":1,\"title_prefix\":\"[repo-status] \"},\"missing_data\":{},\"missing_tool\":{}}"
diff --git a/.github/workflows/docker-cloudstack-simulator.yml b/.github/workflows/docker-cloudstack-simulator.yml
index 8d23ac449dd5..96c9400935c2 100644
--- a/.github/workflows/docker-cloudstack-simulator.yml
+++ b/.github/workflows/docker-cloudstack-simulator.yml
@@ -38,7 +38,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
       - name: Login to Docker Registry
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKERHUB_USER }}
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index 2410f7b9e457..1c3d11a800e6 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -53,11 +53,11 @@ jobs:
       comment_repo: ""
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.0
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
         with:
           destination: /opt/gh-aw/actions
       - name: Check workflow file timestamps
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_WORKFLOW_FILE: "issue-triage-agent.lock.yml"
         with:
@@ -91,7 +91,7 @@ jobs:
       secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.0
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
         with:
           destination: /opt/gh-aw/actions
       - name: Checkout repository
@@ -113,7 +113,7 @@ jobs:
           echo "Git configured with standard GitHub Actions identity"
       - name: Generate agentic run info
         id: generate_aw_info
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const fs = require('fs');
@@ -167,7 +167,7 @@ jobs:
         run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.18.0
       - name: Determine automatic lockdown mode for GitHub MCP Server
         id: determine-automatic-lockdown
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
           GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
@@ -459,7 +459,7 @@ jobs:
           }
           GH_AW_MCP_CONFIG_EOF
       - name: Generate workflow overview
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
@@ -552,7 +552,7 @@ jobs:
           {{#runtime-import .github/workflows/issue-triage-agent.md}}
           GH_AW_PROMPT_EOF
       - name: Substitute placeholders
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
           GH_AW_GITHUB_ACTOR: ${{ github.actor }}
@@ -582,7 +582,7 @@ jobs:
               }
             });
       - name: Interpolate variables and render templates
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
           GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
@@ -661,7 +661,7 @@ jobs:
           bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
       - name: Redact secrets in logs
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
@@ -676,7 +676,7 @@ jobs:
           SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Upload Safe Outputs
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: safe-output
           path: ${{ env.GH_AW_SAFE_OUTPUTS }}
@@ -684,7 +684,7 @@ jobs:
       - name: Ingest agent output
         id: collect_output
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
           GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
@@ -698,13 +698,13 @@ jobs:
             await main();
       - name: Upload sanitized agent output
         if: always() && env.GH_AW_AGENT_OUTPUT
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: agent-output
           path: ${{ env.GH_AW_AGENT_OUTPUT }}
           if-no-files-found: warn
       - name: Upload engine output files
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: agent_outputs
           path: |
@@ -713,7 +713,7 @@ jobs:
           if-no-files-found: ignore
       - name: Parse agent logs for step summary
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
         with:
@@ -724,7 +724,7 @@ jobs:
             await main();
       - name: Parse MCP Gateway logs for step summary
         if: always()
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
@@ -749,7 +749,7 @@ jobs:
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: agent-artifacts
           path: |
@@ -780,12 +780,12 @@ jobs:
       total_count: ${{ steps.missing_tool.outputs.total_count }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.0
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
         with:
           destination: /opt/gh-aw/actions
       - name: Download agent output artifact
         continue-on-error: true
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: agent-output
           path: /tmp/gh-aw/safeoutputs/
@@ -796,7 +796,7 @@ jobs:
           echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
       - name: Process No-Op Messages
         id: noop
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_NOOP_MAX: 1
@@ -812,7 +812,7 @@ jobs:
             await main();
       - name: Record Missing Tool
         id: missing_tool
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
@@ -827,7 +827,7 @@ jobs:
             await main();
       - name: Handle Agent Failure
         id: handle_agent_failure
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
@@ -846,7 +846,7 @@ jobs:
             await main();
       - name: Handle No-Op Message
         id: handle_noop_message
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
@@ -874,18 +874,18 @@ jobs:
       success: ${{ steps.parse_results.outputs.success }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.0
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
         with:
           destination: /opt/gh-aw/actions
       - name: Download agent artifacts
         continue-on-error: true
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: agent-artifacts
           path: /tmp/gh-aw/threat-detection/
       - name: Download agent output artifact
         continue-on-error: true
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: agent-output
           path: /tmp/gh-aw/threat-detection/
@@ -895,7 +895,7 @@ jobs:
         run: |
           echo "Agent output-types: $AGENT_OUTPUT_TYPES"
       - name: Setup threat detection
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           WORKFLOW_NAME: "Issue Triage Agent"
           WORKFLOW_DESCRIPTION: "No description provided"
@@ -948,7 +948,7 @@ jobs:
           XDG_CONFIG_HOME: /home/runner
       - name: Parse threat detection results
         id: parse_results
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
@@ -957,7 +957,7 @@ jobs:
             await main();
       - name: Upload threat detection log
         if: always()
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: threat-detection.log
           path: /tmp/gh-aw/threat-detection/detection.log
@@ -987,12 +987,12 @@ jobs:
       process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@58d1d157fbac0f1204798500faefc4f7461ebe28 # v0.45.0
+        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
         with:
           destination: /opt/gh-aw/actions
       - name: Download agent output artifact
         continue-on-error: true
-        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: agent-output
           path: /tmp/gh-aw/safeoutputs/
@@ -1003,7 +1003,7 @@ jobs:
           echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
       - name: Process Safe Outputs
         id: process_safe_outputs
-        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
           GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"add_labels\":{\"allowed\":[\"bug\",\"feature\",\"enhancement\",\"documentation\",\"question\",\"help-wanted\",\"good-first-issue\"]},\"missing_data\":{},\"missing_tool\":{}}"
diff --git a/.github/workflows/merge-conflict-checker.yml b/.github/workflows/merge-conflict-checker.yml
index a997cb94ccc0..748156a2d9ce 100644
--- a/.github/workflows/merge-conflict-checker.yml
+++ b/.github/workflows/merge-conflict-checker.yml
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-22.04
     steps:
     - name: Conflict Check
-      uses: eps1lon/actions-label-merge-conflict@v2.0.0
+      uses: eps1lon/actions-label-merge-conflict@v3.0.3
       with:
         repoToken: "${{ secrets.GITHUB_TOKEN }}"
         dirtyLabel: "status:has-conflicts"
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index 4580b6bbd5da..2db8456fcba7 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -34,7 +34,7 @@ jobs:
       - uses: actions/checkout@v6
 
       - name: Set up Node
-        uses: actions/setup-node@v5
+        uses: actions/setup-node@v6
         with:
           node-version: 16
 
@@ -55,7 +55,7 @@ jobs:
           npm run lint
           npm run test:unit
 
-      - uses: codecov/codecov-action@v4
+      - uses: codecov/codecov-action@v6
         if: github.repository == 'apache/cloudstack'
         with:
           working-directory: ui

From f6efda50d2f6fd27179e6d9b105081b1a828967d Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Thu, 7 May 2026 17:11:54 +0200
Subject: [PATCH 19/64] Update .asf.yaml: Add ingox as collaborator(#12058)

---
 .asf.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.asf.yaml b/.asf.yaml
index a19e3a60a2ba..ef6781bf7f9e 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -50,6 +50,7 @@ github:
     rebase: false
 
   collaborators:
+    - ingox
     - gpordeus
     - erikbocks
     - Imvedansh

From 4425ee423480d12a71a867300c366b87c2e53ab4 Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Fri, 8 May 2026 06:07:31 +0530
Subject: [PATCH 20/64] Remove unnecessary if-else branch in template
 permission validation (#12683)

* consolidate if-else branch
---
 .../main/java/com/cloud/api/query/QueryManagerImpl.java  | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
index 2ceaffd69d1f..051af377c6d0 100644
--- a/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
+++ b/server/src/main/java/com/cloud/api/query/QueryManagerImpl.java
@@ -5034,16 +5034,13 @@ private Pair<List<TemplateJoinVO>, Integer> searchForTemplatesInternal(Long temp
                 ex.addProxyObject(template.getUuid(), "templateId");
                 throw ex;
             }
+
             if (!template.isPublicTemplate() && caller.getType() == Account.Type.DOMAIN_ADMIN) {
                 Account template_acc = accountMgr.getAccount(template.getAccountId());
                 DomainVO domain = _domainDao.findById(template_acc.getDomainId());
                 accountMgr.checkAccess(caller, domain);
-            }
-
-            // if template is not public, perform permission check here
-            else if (!template.isPublicTemplate() && caller.getType() != Account.Type.ADMIN) {
-                accountMgr.checkAccess(caller, null, false, template);
-            } else if (template.isPublicTemplate()) {
+            } else if (template.isPublicTemplate() || caller.getType() != Account.Type.ADMIN) {
+                // if template is not public or non-admin caller, perform permission check here
                 accountMgr.checkAccess(caller, null, false, template);
             }
 

From 72b99a3f8ce2265d51dd42526afaf1b399f378f3 Mon Sep 17 00:00:00 2001
From: Manoj Kumar <manojkr.itbhu@gmail.com>
Date: Fri, 8 May 2026 10:56:50 +0530
Subject: [PATCH 21/64] Make resource deletion safer with name confirmation
 (#13104)

* enable double confirmation in delete flow for resource

* address copilot comments
---
 ui/public/locales/en.json        |  1 +
 ui/src/config/section/project.js |  1 +
 ui/src/views/AutogenView.vue     | 45 ++++++++++++++++++++------------
 3 files changed, 30 insertions(+), 17 deletions(-)

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index f0a6ad3c79b9..1187b3e62b40 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -795,6 +795,7 @@
 "label.delete.ciscoasa1000v": "Delete CiscoASA1000v",
 "label.delete.ciscovnmc.resource": "Delete CiscoVNMC resource",
 "label.delete.condition": "Delete condition",
+"label.delete.confirmation": "Enter the exact resource name to proceed with deletion",
 "label.delete.custom.action": "Delete Custom Action",
 "label.delete.dedicated.vlan.range": "Deleted dedicated VLAN/VNI range.",
 "label.delete.domain": "Delete domain",
diff --git a/ui/src/config/section/project.js b/ui/src/config/section/project.js
index 5a1f5f71c81d..c08cb8dce4dc 100644
--- a/ui/src/config/section/project.js
+++ b/ui/src/config/section/project.js
@@ -162,6 +162,7 @@ export default {
       },
       groupAction: true,
       popup: true,
+      requireNameConfirmation: true,
       groupMap: (selection, values) => { return selection.map(x => { return { id: x, cleanup: values.cleanup || null } }) },
       args: (record, store) => {
         const fields = []
diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index 066226980c5f..985d12bd7180 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -195,8 +195,6 @@
         :footer="null"
         style="top: 20px;"
         :width="modalWidth"
-        :ok-button-props="getOkProps()"
-        :cancel-button-props="getCancelProps()"
         :confirmLoading="actionLoading"
         @cancel="cancelAction"
         centered
@@ -270,8 +268,18 @@
               </a-table>
             </div>
             <br v-if="currentAction.paramFields.length > 0" />
-          </span>
-          <a-form
+             </span>
+           <div v-if="currentAction.requireNameConfirmation && !(currentAction.groupAction && selectedRowKeys.length > 0)" style="margin-bottom: 5px">
+            <a-form-item>
+                <a-input v-model:value="actionConfirmText" :placeholder="resource.name" />
+            </a-form-item>
+            <a-alert type="info">
+              <template #message>
+                <div v-html="$t('label.delete.confirmation')"></div>
+              </template>
+            </a-alert>
+           </div>
+           <a-form
             :ref="formRef"
             :model="form"
             :rules="rules"
@@ -531,6 +539,7 @@
                 type="primary"
                 @click="handleSubmit"
                 ref="submit"
+                :disabled="isSubmitDisabled"
               >{{ $t('label.ok') }}</a-button>
             </div>
           </a-form>
@@ -691,6 +700,7 @@ export default {
       confirmDirty: false,
       firstIndex: 0,
       modalWidth: '30vw',
+      actionConfirmText: '',
       promises: []
     }
   },
@@ -898,6 +908,12 @@ export default {
         return 'active'
       }
       return 'self'
+    },
+    isSubmitDisabled () {
+      if (this.currentAction?.requireNameConfirmation && !(this.currentAction.groupAction && this.selectedRowKeys.length > 0)) {
+        return this.actionConfirmText.trim() !== this.resource?.name?.trim()
+      }
+      return false
     }
   },
   methods: {
@@ -907,19 +923,6 @@ export default {
       }
       return 'inline-flex'
     },
-    getOkProps () {
-      if (this.selectedRowKeys.length > 0 && this.currentAction?.groupAction) {
-      } else {
-        return { props: { type: 'primary' } }
-      }
-    },
-    getCancelProps () {
-      if (this.selectedRowKeys.length > 0 && this.currentAction?.groupAction) {
-        return { props: { type: 'primary' } }
-      } else {
-        return { props: { type: 'default' } }
-      }
-    },
     switchProject (projectId) {
       if (!projectId || !projectId.length || projectId.length !== 36) {
         return
@@ -1308,6 +1311,7 @@ export default {
       this.actionLoading = false
       this.showAction = false
       this.currentAction = {}
+      this.actionConfirmText = ''
     },
     cancelAction () {
       eventBus.emit('action-closing', { action: this.currentAction })
@@ -1365,6 +1369,7 @@ export default {
       this.currentAction = action
       this.currentAction.params = store.getters.apis[this.currentAction.api].params
       this.resource = action.resource
+      this.actionConfirmText = ''
       this.$emit('change-resource', this.resource)
       var paramFields = this.currentAction.params
       paramFields.sort(function (a, b) {
@@ -1647,6 +1652,12 @@ export default {
     },
     handleSubmit (e) {
       if (this.actionLoading) return
+
+      if (this.currentAction?.requireNameConfirmation && !(this.currentAction.groupAction && this.selectedRowKeys.length > 0)) {
+        if (this.actionConfirmText.trim() !== this.resource?.name?.trim()) {
+          return
+        }
+      }
       this.promises = []
       if (!this.dataView && this.currentAction.groupAction && this.selectedRowKeys.length > 0) {
         if (this.selectedRowKeys.length > 0) {

From ddcc0c889d723651d0072f8736865577d5315601 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Fri, 8 May 2026 12:20:06 +0530
Subject: [PATCH 22/64] Don't delete volume on store if it is not created or
 doesn't exist on it (#13111)

---
 .../storage/volume/VolumeServiceImpl.java     | 25 ++++++++++++-------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
index 34e257a561d6..426d157b13a6 100644
--- a/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
+++ b/engine/storage/volume/src/main/java/org/apache/cloudstack/storage/volume/VolumeServiceImpl.java
@@ -395,9 +395,9 @@ public AsyncCallFuture<VolumeApiResult> expungeVolumeAsync(VolumeInfo volume) {
         }
 
         // Find out if the volume is at state of download_in_progress on secondary storage
-        VolumeDataStoreVO volumeStore = _volumeStoreDao.findByVolume(volume.getId());
-        if (volumeStore != null) {
-            if (volumeStore.getDownloadState() == VMTemplateStorageResourceAssoc.Status.DOWNLOAD_IN_PROGRESS) {
+        VolumeDataStoreVO volumeOnImageStore = _volumeStoreDao.findByVolume(volume.getId());
+        if (volumeOnImageStore != null) {
+            if (volumeOnImageStore.getDownloadState() == VMTemplateStorageResourceAssoc.Status.DOWNLOAD_IN_PROGRESS) {
                 String msg = String.format("Volume: %s is currently being uploaded; can't delete it.", volume);
                 logger.debug(msg);
                 result.setSuccess(false);
@@ -416,10 +416,10 @@ public AsyncCallFuture<VolumeApiResult> expungeVolumeAsync(VolumeInfo volume) {
 
         if (!volumeExistsOnPrimary(vol)) {
             // not created on primary store
-            if (volumeStore == null) {
+            if (volumeOnImageStore == null) {
                 // also not created on secondary store
                 if (logger.isDebugEnabled()) {
-                    logger.debug("Marking volume that was never created as destroyed: " + vol);
+                    logger.debug("Marking volume that was never created as destroyed: {}", vol);
                 }
                 VMTemplateVO template = templateDao.findById(vol.getTemplateId());
                 if (template != null && !template.isDeployAsIs()) {
@@ -435,11 +435,21 @@ public AsyncCallFuture<VolumeApiResult> expungeVolumeAsync(VolumeInfo volume) {
         if (volume.getDataStore().getRole() == DataStoreRole.Image) {
             // no need to change state in volumes table
             volume.processEventOnly(Event.DestroyRequested);
+            if (volumeOnImageStore == null) {
+                logger.debug("Volume {} doesn't exist on image store, no need to delete", vol);
+                future.complete(result);
+                return future;
+            }
         } else if (volume.getDataStore().getRole() == DataStoreRole.Primary) {
             if (vol.getState() == Volume.State.Expunging) {
                 logger.info("Volume {} is already in Expunging, retrying", volume);
             }
             volume.processEvent(Event.ExpungeRequested);
+            if (!volumeExistsOnPrimary(vol)) {
+                logger.debug("Volume {} doesn't exist on primary storage, no need to delete", vol);
+                future.complete(result);
+                return future;
+            }
         }
 
         DeleteVolumeContext<VolumeApiResult> context = new DeleteVolumeContext<>(null, vo, future);
@@ -460,13 +470,11 @@ public void ensureVolumeIsExpungeReady(long volumeId) {
 
     private boolean volumeExistsOnPrimary(VolumeVO vol) {
         Long poolId = vol.getPoolId();
-
         if (poolId == null) {
             return false;
         }
 
         PrimaryDataStore primaryStore = dataStoreMgr.getPrimaryDataStore(poolId);
-
         if (primaryStore == null) {
             return false;
         }
@@ -476,8 +484,7 @@ private boolean volumeExistsOnPrimary(VolumeVO vol) {
         }
 
         String volumePath = vol.getPath();
-
-        if (volumePath == null || volumePath.trim().isEmpty()) {
+        if (StringUtils.isBlank(volumePath)) {
             return false;
         }
 

From 4359198904c54f9b5bc9afa0d9e474beb4ec2d4d Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Fri, 8 May 2026 19:50:50 +0530
Subject: [PATCH 23/64] KVM Host HA improvements - Fix to not cancel VM HA
 items when Host HA inspection in progress, and some code improvements
 (#13088)

* Host HA code improvements

* Fix to not cancel VM HA items when Host HA is enabled & inspection in progress, and some code improvements

- When Host HA inspection in progress, the investigor returns the Host Status as Up which cancels the VM HA items
- Don't cancel the VM HA items, instead reschedule them to try again later

* Changes to consider Recovered/Available Host HA state along with the agent connection status to determine the Host HA inspection in progress or not, and some code improvements
---
 .../main/java/com/cloud/ha/Investigator.java  |  16 +-
 .../admin/ha/ConfigureHAForHostCmd.java       |   1 +
 .../cloud/agent/api/CheckOnHostAnswer.java    |   3 +-
 .../cloud/agent/api/CheckOnHostCommand.java   |  10 +-
 .../com/cloud/ha/HighAvailabilityManager.java |   4 +-
 .../java/com/cloud/ha/HypervInvestigator.java |   6 +-
 .../java/com/cloud/ha/KVMInvestigator.java    |  87 ++------
 .../hypervisor/kvm/resource/KVMHABase.java    |  11 +-
 .../hypervisor/kvm/resource/KVMHAChecker.java |  33 ++-
 .../hypervisor/kvm/resource/KVMHAMonitor.java |  65 +++---
 .../kvm/resource/KVMHAVMActivityChecker.java  |   6 +-
 .../resource/LibvirtComputingResource.java    |   6 +-
 .../LibvirtCheckOnHostCommandWrapper.java     |  16 +-
 ...VMActivityOnStoragePoolCommandWrapper.java |   4 +-
 .../kvm/storage/IscsiAdmStoragePool.java      |   4 +-
 .../kvm/storage/KVMStoragePool.java           |  70 +++----
 .../kvm/storage/LibvirtStoragePool.java       |  36 ++--
 .../kvm/storage/MultipathSCSIPool.java        |   6 +-
 .../kvm/storage/ScaleIOStoragePool.java       |   4 +-
 .../apache/cloudstack/kvm/ha/KVMHAConfig.java |  23 +-
 .../cloudstack/kvm/ha/KVMHAProvider.java      |   7 +-
 .../kvm/ha/KVMHostActivityChecker.java        | 198 ++++++++++--------
 .../LibvirtComputingResourceTest.java         |   2 +-
 .../com/cloud/ha/SimulatorInvestigator.java   |   4 +-
 .../java/com/cloud/ha/VmwareInvestigator.java |   2 +-
 .../kvm/storage/LinstorStoragePool.java       |  14 +-
 .../kvm/storage/StorPoolStoragePool.java      |  10 +-
 scripts/vm/hypervisor/kvm/kvmheartbeat.sh     |   4 +-
 .../cloud/ha/CheckOnAgentInvestigator.java    |   2 +-
 .../cloud/ha/HighAvailabilityManagerImpl.java | 136 +++++++-----
 .../src/main/java/com/cloud/ha/KVMFencer.java |  11 +-
 .../ha/ManagementIPSystemVMInvestigator.java  |   2 +-
 .../com/cloud/ha/UserVmDomRInvestigator.java  |   2 +-
 .../com/cloud/ha/XenServerInvestigator.java   |   4 +-
 .../org/apache/cloudstack/ha/HAManager.java   |   7 +-
 .../apache/cloudstack/ha/HAManagerImpl.java   |  72 ++++---
 .../cloudstack/ha/HAResourceCounter.java      |   6 +-
 .../cloudstack/ha/task/ActivityCheckTask.java |   6 +-
 .../apache/cloudstack/ha/task/BaseHATask.java |   2 +-
 .../ha/HighAvailabilityManagerImplTest.java   |   5 +-
 .../utils/redfish/RedfishClient.java          |  14 +-
 41 files changed, 481 insertions(+), 440 deletions(-)

diff --git a/api/src/main/java/com/cloud/ha/Investigator.java b/api/src/main/java/com/cloud/ha/Investigator.java
index 88d802a1ce44..00371d395f5a 100644
--- a/api/src/main/java/com/cloud/ha/Investigator.java
+++ b/api/src/main/java/com/cloud/ha/Investigator.java
@@ -26,17 +26,19 @@ public interface Investigator extends Adapter {
      * Returns if the vm is still alive.
      *
      * @param vm to work on.
+     * @return true if vm is alive, otherwise false
      */
-    public boolean isVmAlive(VirtualMachine vm, Host host) throws UnknownVM;
+    boolean isVmAlive(VirtualMachine vm, Host host) throws UnknownVM;
 
-    public Status isAgentAlive(Host agent);
+    /**
+     * Returns the agent status of the host.
+     *
+     * @param host
+     * @return status of the host agent
+     */
+    Status getHostAgentStatus(Host host);
 
     class UnknownVM extends Exception {
-
-        /**
-         *
-         */
         private static final long serialVersionUID = 1L;
-
     };
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/ha/ConfigureHAForHostCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/ha/ConfigureHAForHostCmd.java
index d7707e197d64..ed3b166e6ead 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/ha/ConfigureHAForHostCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/ha/ConfigureHAForHostCmd.java
@@ -87,6 +87,7 @@ private void setupResponse(final boolean result, final String resourceUuid) {
         final HostHAResponse response = new HostHAResponse();
         response.setId(resourceUuid);
         response.setProvider(getHaProvider().toLowerCase());
+        response.setStatus(result);
         response.setResponseName(getCommandName());
         setResponseObject(response);
     }
diff --git a/core/src/main/java/com/cloud/agent/api/CheckOnHostAnswer.java b/core/src/main/java/com/cloud/agent/api/CheckOnHostAnswer.java
index 5a26b22ec6a5..41e266784db8 100644
--- a/core/src/main/java/com/cloud/agent/api/CheckOnHostAnswer.java
+++ b/core/src/main/java/com/cloud/agent/api/CheckOnHostAnswer.java
@@ -38,6 +38,8 @@ public CheckOnHostAnswer(CheckOnHostCommand cmd, Boolean alive, String details)
 
     public CheckOnHostAnswer(CheckOnHostCommand cmd, String details) {
         super(cmd, false, details);
+        determined = false;
+        alive = false;
     }
 
     public boolean isDetermined() {
@@ -47,5 +49,4 @@ public boolean isDetermined() {
     public boolean isAlive() {
         return alive;
     }
-
 }
diff --git a/core/src/main/java/com/cloud/agent/api/CheckOnHostCommand.java b/core/src/main/java/com/cloud/agent/api/CheckOnHostCommand.java
index 94239f2900ef..72b5217604dc 100644
--- a/core/src/main/java/com/cloud/agent/api/CheckOnHostCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/CheckOnHostCommand.java
@@ -24,7 +24,7 @@
 
 public class CheckOnHostCommand extends Command {
     HostTO host;
-    boolean reportCheckFailureIfOneStorageIsDown;
+    boolean reportIfHeartBeatFailedForOneStoragePool;
 
     protected CheckOnHostCommand() {
     }
@@ -34,17 +34,17 @@ public CheckOnHostCommand(Host host) {
         setWait(20);
     }
 
-    public CheckOnHostCommand(Host host, boolean reportCheckFailureIfOneStorageIsDown) {
+    public CheckOnHostCommand(Host host, boolean reportIfHeartBeatFailedForOneStoragePool) {
         this(host);
-        this.reportCheckFailureIfOneStorageIsDown = reportCheckFailureIfOneStorageIsDown;
+        this.reportIfHeartBeatFailedForOneStoragePool = reportIfHeartBeatFailedForOneStoragePool;
     }
 
     public HostTO getHost() {
         return host;
     }
 
-    public boolean isCheckFailedOnOneStorage() {
-        return reportCheckFailureIfOneStorageIsDown;
+    public boolean shouldReportIfHeartBeatFailedForOneStoragePool() {
+        return reportIfHeartBeatFailedForOneStoragePool;
     }
 
     @Override
diff --git a/engine/components-api/src/main/java/com/cloud/ha/HighAvailabilityManager.java b/engine/components-api/src/main/java/com/cloud/ha/HighAvailabilityManager.java
index 3ae94479cea5..53bfcce27038 100644
--- a/engine/components-api/src/main/java/com/cloud/ha/HighAvailabilityManager.java
+++ b/engine/components-api/src/main/java/com/cloud/ha/HighAvailabilityManager.java
@@ -75,10 +75,10 @@ public interface HighAvailabilityManager extends Manager {
         + " which are registered for the HA event that were successful and are now ready to be purged.",
         true, Cluster);
 
-    public static final ConfigKey<Boolean> KvmHAFenceHostIfHeartbeatFailsOnStorage = new ConfigKey<>("Advanced", Boolean.class, "kvm.ha.fence.on.storage.heartbeat.failure", "false",
+    ConfigKey<Boolean> KvmHAFenceHostIfHeartbeatFailsOnStorage = new ConfigKey<>("Advanced", Boolean.class, "kvm.ha.fence.on.storage.heartbeat.failure", "false",
             "Proceed fencing the host even the heartbeat failed for only one storage pool", false, ConfigKey.Scope.Zone);
 
-    public enum WorkType {
+    enum WorkType {
         Migration,  // Migrating VMs off of a host.
         Stop,       // Stops a VM for storage pool migration purposes.  This should be obsolete now.
         CheckStop,  // Checks if a VM has been stopped.
diff --git a/plugins/hypervisors/hyperv/src/main/java/com/cloud/ha/HypervInvestigator.java b/plugins/hypervisors/hyperv/src/main/java/com/cloud/ha/HypervInvestigator.java
index 3d79b9efdd13..4e44d8cb7359 100644
--- a/plugins/hypervisors/hyperv/src/main/java/com/cloud/ha/HypervInvestigator.java
+++ b/plugins/hypervisors/hyperv/src/main/java/com/cloud/ha/HypervInvestigator.java
@@ -41,15 +41,15 @@ public class HypervInvestigator extends AdapterBase implements Investigator {
 
     @Override
     public boolean isVmAlive(com.cloud.vm.VirtualMachine vm, Host host) throws UnknownVM {
-        Status status = isAgentAlive(host);
+        Status status = getHostAgentStatus(host);
         if (status == null) {
             throw new UnknownVM();
         }
-        return status == Status.Up ? true : null;
+        return status == Status.Up;
     }
 
     @Override
-    public Status isAgentAlive(Host agent) {
+    public Status getHostAgentStatus(Host agent) {
         if (agent.getHypervisorType() != Hypervisor.HypervisorType.Hyperv) {
             return null;
         }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/ha/KVMInvestigator.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/ha/KVMInvestigator.java
index ce9fbe6c232c..da9a0d6e2919 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/ha/KVMInvestigator.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/ha/KVMInvestigator.java
@@ -19,10 +19,7 @@
 package com.cloud.ha;
 
 import com.cloud.agent.AgentManager;
-import com.cloud.agent.api.Answer;
-import com.cloud.agent.api.CheckOnHostCommand;
 import com.cloud.host.Host;
-import com.cloud.host.HostVO;
 import com.cloud.host.Status;
 import com.cloud.host.dao.HostDao;
 import com.cloud.hypervisor.Hypervisor;
@@ -34,11 +31,12 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreProviderManager;
 import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStoreDriver;
 import org.apache.cloudstack.ha.HAManager;
+import org.apache.cloudstack.kvm.ha.KVMHostActivityChecker;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 
 import javax.inject.Inject;
-import java.util.Arrays;
+import java.util.Collections;
 import java.util.List;
 
 public class KVMInvestigator extends AdapterBase implements Investigator {
@@ -54,13 +52,15 @@ public class KVMInvestigator extends AdapterBase implements Investigator {
     private HAManager haManager;
     @Inject
     private DataStoreProviderManager dataStoreProviderMgr;
+    @Inject
+    private KVMHostActivityChecker hostActivityChecker;
 
     @Override
     public boolean isVmAlive(com.cloud.vm.VirtualMachine vm, Host host) throws UnknownVM {
         if (haManager.isHAEligible(host)) {
             return haManager.isVMAliveOnHost(host);
         }
-        Status status = isAgentAlive(host);
+        Status status = getHostAgentStatus(host);
         logger.debug("HA: HOST is ineligible legacy state {} for host {}", status, host);
         if (status == null) {
             throw new UnknownVM();
@@ -73,86 +73,41 @@ public boolean isVmAlive(com.cloud.vm.VirtualMachine vm, Host host) throws Unkno
     }
 
     @Override
-    public Status isAgentAlive(Host agent) {
-        if (agent.getHypervisorType() != Hypervisor.HypervisorType.KVM && agent.getHypervisorType() != Hypervisor.HypervisorType.LXC) {
+    public Status getHostAgentStatus(Host host) {
+        if (host.getHypervisorType() != Hypervisor.HypervisorType.KVM && host.getHypervisorType() != Hypervisor.HypervisorType.LXC) {
             return null;
         }
 
-        if (haManager.isHAEligible(agent)) {
-            return haManager.getHostStatus(agent);
+        if (haManager.isHAEligible(host)) {
+            return haManager.getHostStatusFromHAConfig(host);
         }
 
-        List<StoragePoolVO> clusterPools = _storagePoolDao.findPoolsInClusters(Arrays.asList(agent.getClusterId()), null);
-        boolean storageSupportHA = storageSupportHa(clusterPools);
-        if (!storageSupportHA) {
-            List<StoragePoolVO> zonePools = _storagePoolDao.findZoneWideStoragePoolsByHypervisor(agent.getDataCenterId(), agent.getHypervisorType());
-            storageSupportHA = storageSupportHa(zonePools);
+        List<StoragePoolVO> clusterPools = _storagePoolDao.findPoolsInClusters(Collections.singletonList(host.getClusterId()), null);
+        boolean storageSupportsHA = storageSupportsHA(clusterPools);
+        if (!storageSupportsHA) {
+            List<StoragePoolVO> zonePools = _storagePoolDao.findZoneWideStoragePoolsByHypervisor(host.getDataCenterId(), host.getHypervisorType());
+            storageSupportsHA = storageSupportsHA(zonePools);
         }
-        if (!storageSupportHA) {
-            logger.warn("Agent investigation was requested on host {}, but host does not support investigation because it has no NFS storage. Skipping investigation.", agent);
+        if (!storageSupportsHA) {
+            logger.warn("Agent investigation was requested on host {}, but host does not support investigation" +
+                    " because it has no HA supported storage. Skipping investigation.", host);
             return null;
         }
 
-        Status hostStatus = null;
-        Status neighbourStatus = null;
-        boolean reportFailureIfOneStorageIsDown = HighAvailabilityManager.KvmHAFenceHostIfHeartbeatFailsOnStorage.value();
-        CheckOnHostCommand cmd = new CheckOnHostCommand(agent, reportFailureIfOneStorageIsDown);
-
-        try {
-            Answer answer = _agentMgr.easySend(agent.getId(), cmd);
-            if (answer != null) {
-                hostStatus = answer.getResult() ? Status.Down : Status.Up;
-            }
-        } catch (Exception e) {
-            logger.debug("Failed to send command to host: {}", agent);
-        }
-        if (hostStatus == null) {
-            hostStatus = Status.Disconnected;
-        }
-
-        List<HostVO> neighbors = _resourceMgr.listHostsInClusterByStatus(agent.getClusterId(), Status.Up);
-        for (HostVO neighbor : neighbors) {
-            if (neighbor.getId() == agent.getId()
-                    || (neighbor.getHypervisorType() != Hypervisor.HypervisorType.KVM && neighbor.getHypervisorType() != Hypervisor.HypervisorType.LXC)) {
-                continue;
-            }
-            logger.debug("Investigating host:{} via neighbouring host:{}", agent, neighbor);
-            try {
-                Answer answer = _agentMgr.easySend(neighbor.getId(), cmd);
-                if (answer != null) {
-                    neighbourStatus = answer.getResult() ? Status.Down : Status.Up;
-                    logger.debug("Neighbouring host:{} returned status:{} for the investigated host:{}", neighbor, neighbourStatus, agent);
-                    if (neighbourStatus == Status.Up) {
-                        break;
-                    }
-                }
-            } catch (Exception e) {
-                logger.debug("Failed to send command to host: {}", neighbor);
-            }
-        }
-        if (neighbourStatus == Status.Up && (hostStatus == Status.Disconnected || hostStatus == Status.Down)) {
-            hostStatus = Status.Disconnected;
-        }
-        if (neighbourStatus == Status.Down && (hostStatus == Status.Disconnected || hostStatus == Status.Down)) {
-            hostStatus = Status.Down;
-        }
-        logger.debug("HA: HOST is ineligible legacy state {} for host {}", hostStatus, agent);
-        return hostStatus;
+        return hostActivityChecker.getHostAgentStatus(host);
     }
 
-    private boolean storageSupportHa(List<StoragePoolVO> pools) {
-        boolean storageSupportHA = false;
+    private boolean storageSupportsHA(List<StoragePoolVO> pools) {
         for (StoragePoolVO pool : pools) {
             DataStoreProvider storeProvider = dataStoreProviderMgr.getDataStoreProvider(pool.getStorageProviderName());
             DataStoreDriver storeDriver = storeProvider.getDataStoreDriver();
             if (storeDriver instanceof PrimaryDataStoreDriver) {
                 PrimaryDataStoreDriver primaryStoreDriver = (PrimaryDataStoreDriver)storeDriver;
                 if (primaryStoreDriver.isStorageSupportHA(pool.getPoolType())) {
-                    storageSupportHA = true;
-                    break;
+                    return true;
                 }
             }
         }
-        return storageSupportHA;
+        return false;
     }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHABase.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHABase.java
index e9a7ac8951ce..f30e2c779195 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHABase.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHABase.java
@@ -35,10 +35,9 @@
 public class KVMHABase {
     protected Logger logger = LogManager.getLogger(getClass());
     private long _timeout = 60000; /* 1 minutes */
-    protected long _heartBeatUpdateTimeout = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.HEARTBEAT_UPDATE_TIMEOUT);
-    protected long _heartBeatUpdateFreq = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_FREQUENCY);
+    protected long _heartBeatUpdateFreqInMs = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_FREQUENCY);
     protected long _heartBeatUpdateMaxTries = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_MAX_TRIES);
-    protected long _heartBeatUpdateRetrySleep = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_RETRY_SLEEP);
+    protected long _heartBeatUpdateRetrySleepInMs = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_RETRY_SLEEP);
 
     public static enum PoolType {
         PrimaryStorage, SecondaryStorage
@@ -138,7 +137,7 @@ protected String checkingMountPoint(HAStoragePool pool, String poolName) {
             /* Can't find the mount point? */
             /* we need to mount it under poolName */
             if (poolName != null) {
-                Script mount = new Script("/bin/bash", 60000);
+                Script mount = new Script("/bin/bash", _timeout);
                 mount.add("-c");
                 mount.add("mount " + mountSource + " " + destPath);
                 String result = mount.execute();
@@ -154,7 +153,6 @@ protected String checkingMountPoint(HAStoragePool pool, String poolName) {
     }
 
     protected String getMountPoint(HAStoragePool storagePool) {
-
         StoragePool pool = null;
         String poolName = null;
         try {
@@ -171,7 +169,6 @@ protected String getMountPoint(HAStoragePool storagePool) {
                 }
                 poolName = pool.getName();
             }
-
         } catch (LibvirtException e) {
             logger.debug("Ignoring libvirt error.", e);
         } finally {
@@ -234,7 +231,7 @@ protected String runScriptRetry(String cmdString, OutputInterpreter interpreter)
         return result;
     }
 
-    public Boolean checkingHeartBeat() {
+    public Boolean hasHeartBeat() {
         // TODO Auto-generated method stub
         return null;
     }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAChecker.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAChecker.java
index db6190fa8f28..0ee59c95da39 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAChecker.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAChecker.java
@@ -26,44 +26,43 @@
 public class KVMHAChecker extends KVMHABase implements Callable<Boolean> {
     private List<HAStoragePool> storagePools;
     private HostTO host;
-    private boolean reportFailureIfOneStorageIsDown;
+    private boolean reportIfHeartBeatFailedForOneStoragePool;
 
-    public KVMHAChecker(List<HAStoragePool> pools, HostTO host, boolean reportFailureIfOneStorageIsDown) {
+    public KVMHAChecker(List<HAStoragePool> pools, HostTO host, boolean reportIfHeartBeatFailedForOneStoragePool) {
         this.storagePools = pools;
         this.host = host;
-        this.reportFailureIfOneStorageIsDown = reportFailureIfOneStorageIsDown;
+        this.reportIfHeartBeatFailedForOneStoragePool = reportIfHeartBeatFailedForOneStoragePool;
     }
 
     /*
-     * True means heartbeaing is on going, or we can't get it's status. False
-     * means heartbeating is stopped definitely
+     * True means heart beating is on going, or we can't get it's status.
+     * False means heart beating is stopped definitely.
      */
     @Override
-    public Boolean checkingHeartBeat() {
-        boolean validResult = false;
-
-        String hostAndPools = String.format("host IP [%s] in pools [%s]", host.getPrivateNetwork().getIp(), storagePools.stream().map(pool -> pool.getPoolUUID()).collect(Collectors.joining(", ")));
-
-        logger.debug(String.format("Checking heart beat with KVMHAChecker for %s", hostAndPools));
+    public Boolean hasHeartBeat() {
+        String hostAndPools = String.format("host IP [%s] in pools [%s]", host.getPrivateNetwork().getIp(),
+                storagePools.stream().map(pool -> pool.getPoolUUID()).collect(Collectors.joining(", ")));
+        logger.debug("Checking heart beat with KVMHAChecker for {}", hostAndPools);
 
+        boolean heartBeatCheckResult = false;
         for (HAStoragePool pool : storagePools) {
-            validResult = pool.getPool().checkingHeartBeat(pool, host);
-            if (reportFailureIfOneStorageIsDown && !validResult) {
+            heartBeatCheckResult = pool.getPool().hasHeartBeat(pool, host);
+            if (reportIfHeartBeatFailedForOneStoragePool && !heartBeatCheckResult) {
                 break;
             }
         }
 
-        if (!validResult) {
-            logger.warn(String.format("All checks with KVMHAChecker for %s considered it as dead. It may cause a shutdown of the host.", hostAndPools));
+        if (!heartBeatCheckResult) {
+            logger.warn("All checks with KVMHAChecker for {} considered it as dead. It may cause a shutdown of the host.", hostAndPools);
         }
 
-        return validResult;
+        return heartBeatCheckResult;
     }
 
     @Override
     public Boolean call() throws Exception {
         // logger.addAppender(new org.apache.log4j.ConsoleAppender(new
         // org.apache.log4j.PatternLayout(), "System.out"));
-        return checkingHeartBeat();
+        return hasHeartBeat();
     }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAMonitor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAMonitor.java
index aa868ff1d3f2..9f1b849e9727 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAMonitor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAMonitor.java
@@ -34,53 +34,49 @@
 
 public class KVMHAMonitor extends KVMHABase implements Runnable {
 
-    private final Map<String, HAStoragePool> storagePool = new ConcurrentHashMap<>();
+    private final Map<String, HAStoragePool> haStoragePools = new ConcurrentHashMap<>();
     private final boolean rebootHostAndAlertManagementOnHeartbeatTimeout;
 
     private final String hostPrivateIp;
 
-    public KVMHAMonitor(HAStoragePool pool, String host) {
-        if (pool != null) {
-            storagePool.put(pool.getPoolUUID(), pool);
-        }
+    public KVMHAMonitor(String host) {
         hostPrivateIp = host;
-
         rebootHostAndAlertManagementOnHeartbeatTimeout = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.REBOOT_HOST_AND_ALERT_MANAGEMENT_ON_HEARTBEAT_TIMEOUT);
     }
 
     public void addStoragePool(HAStoragePool pool) {
-        synchronized (storagePool) {
-            storagePool.put(pool.getPoolUUID(), pool);
+        synchronized (haStoragePools) {
+            haStoragePools.put(pool.getPoolUUID(), pool);
         }
     }
 
     public void removeStoragePool(String uuid) {
-        synchronized (storagePool) {
-            HAStoragePool pool = storagePool.get(uuid);
+        synchronized (haStoragePools) {
+            HAStoragePool pool = haStoragePools.get(uuid);
             if (pool != null) {
                 Script.runSimpleBashScript("umount " + pool.getMountDestPath());
-                storagePool.remove(uuid);
+                haStoragePools.remove(uuid);
             }
         }
     }
 
     public List<HAStoragePool> getStoragePools() {
-        synchronized (storagePool) {
-            return new ArrayList<>(storagePool.values());
+        synchronized (haStoragePools) {
+            return new ArrayList<>(haStoragePools.values());
         }
     }
 
     public HAStoragePool getStoragePool(String uuid) {
-        synchronized (storagePool) {
-            return storagePool.get(uuid);
+        synchronized (haStoragePools) {
+            return haStoragePools.get(uuid);
         }
     }
 
     protected void runHeartBeat() {
-        synchronized (storagePool) {
+        synchronized (haStoragePools) {
             Set<String> removedPools = new HashSet<>();
-            for (String uuid : storagePool.keySet()) {
-                HAStoragePool primaryStoragePool = storagePool.get(uuid);
+            for (String uuid : haStoragePools.keySet()) {
+                HAStoragePool primaryStoragePool = haStoragePools.get(uuid);
                 if (HighAvailabilityManager.LIBVIRT_STORAGE_POOL_TYPES_WITH_HA_SUPPORT.contains(primaryStoragePool.getPool().getType())) {
                     checkForNotExistingLibvirtStoragePools(removedPools, uuid);
                     if (removedPools.contains(uuid)) {
@@ -91,7 +87,7 @@ protected void runHeartBeat() {
                 result = executePoolHeartBeatCommand(uuid, primaryStoragePool, result);
 
                 if (result != null && rebootHostAndAlertManagementOnHeartbeatTimeout) {
-                    logger.warn(String.format("Write heartbeat for pool [%s] failed: %s; stopping cloudstack-agent.", uuid, result));
+                    logger.warn("Write heartbeat for pool [{}] failed: {}; stopping cloudstack-agent.", uuid, result);
                     primaryStoragePool.getPool().createHeartBeatCommand(primaryStoragePool, null, false);;
                 }
             }
@@ -104,20 +100,18 @@ protected void runHeartBeat() {
     }
 
     private String executePoolHeartBeatCommand(String uuid, HAStoragePool primaryStoragePool, String result) {
-        for (int i = 1; i <= _heartBeatUpdateMaxTries; i++) {
+        for (int attempt = 1; attempt <= _heartBeatUpdateMaxTries; attempt++) {
             result = primaryStoragePool.getPool().createHeartBeatCommand(primaryStoragePool, hostPrivateIp, true);
-
-            if (result != null) {
-                logger.warn(String.format("Write heartbeat for pool [%s] failed: %s; try: %s of %s.", uuid, result, i, _heartBeatUpdateMaxTries));
-                try {
-                    Thread.sleep(_heartBeatUpdateRetrySleep);
-                } catch (InterruptedException e) {
-                    logger.debug("[IGNORED] Interrupted between heartbeat retries.", e);
-                }
-            } else {
+            if (result == null) {
                 break;
             }
 
+            logger.warn("Write heartbeat for pool [{}] failed: {}; try: {} of {}.", uuid, result, attempt, _heartBeatUpdateMaxTries);
+            try {
+                Thread.sleep(_heartBeatUpdateRetrySleepInMs);
+            } catch (InterruptedException e) {
+                logger.debug("[IGNORED] Interrupted between heartbeat retries.", e);
+            }
         }
         return result;
     }
@@ -128,21 +122,21 @@ private void checkForNotExistingLibvirtStoragePools(Set<String> removedPools, St
             StoragePool storage = conn.storagePoolLookupByUUIDString(uuid);
             if (storage == null || storage.getInfo().state != StoragePoolState.VIR_STORAGE_POOL_RUNNING) {
                 if (storage == null) {
-                    logger.debug(String.format("Libvirt storage pool [%s] not found, removing from HA list.", uuid));
+                    logger.debug("Libvirt storage pool [{}] not found, removing from HA list.", uuid);
                 } else {
-                    logger.debug(String.format("Libvirt storage pool [%s] found, but not running, removing from HA list.", uuid));
+                    logger.debug("Libvirt storage pool [{}] found, but not running, removing from HA list.", uuid);
                 }
 
                 removedPools.add(uuid);
             }
 
-            logger.debug(String.format("Found NFS storage pool [%s] in libvirt, continuing.", uuid));
+            logger.debug("Found NFS storage pool [{}] in libvirt, continuing.", uuid);
 
         } catch (LibvirtException e) {
-            logger.debug(String.format("Failed to lookup libvirt storage pool [%s].", uuid), e);
+            logger.debug("Failed to lookup libvirt storage pool [{}].", uuid, e);
 
             if (e.toString().contains("pool not found")) {
-                logger.debug(String.format("Removing pool [%s] from HA monitor since it was deleted.", uuid));
+                logger.debug("Removing pool [{}] from HA monitor since it was deleted.", uuid);
                 removedPools.add(uuid);
             }
         }
@@ -155,11 +149,10 @@ public void run() {
             runHeartBeat();
 
             try {
-                Thread.sleep(_heartBeatUpdateFreq);
+                Thread.sleep(_heartBeatUpdateFreqInMs);
             } catch (InterruptedException e) {
                 logger.debug("[IGNORED] Interrupted between heartbeats.", e);
             }
         }
     }
-
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAVMActivityChecker.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAVMActivityChecker.java
index e6937b515e95..c13be64a3a3e 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAVMActivityChecker.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/KVMHAVMActivityChecker.java
@@ -39,12 +39,12 @@ public KVMHAVMActivityChecker(final HAStoragePool pool, final HostTO host, final
     }
 
     @Override
-    public Boolean checkingHeartBeat() {
-        return this.storagePool.getPool().vmActivityCheck(storagePool, host, activityScriptTimeout, volumeUuidList, vmActivityCheckPath, suspectTimeInSeconds);
+    public Boolean hasHeartBeat() {
+        return this.storagePool.getPool().hasVmActivity(storagePool, host, activityScriptTimeout, volumeUuidList, vmActivityCheckPath, suspectTimeInSeconds);
     }
 
     @Override
     public Boolean call() throws Exception {
-        return checkingHeartBeat();
+        return hasHeartBeat();
     }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index 25162ca9b929..80d9a51cb855 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -1386,9 +1386,9 @@ public boolean configure(final String name, final Map<String, Object> params) th
 
         final String[] info = NetUtils.getNetworkParams(privateNic);
 
-        kvmhaMonitor = new KVMHAMonitor(null, info[0]);
-        final Thread ha = new Thread(kvmhaMonitor);
-        ha.start();
+        kvmhaMonitor = new KVMHAMonitor(info[0]);
+        final Thread haMonitorThread = new Thread(kvmhaMonitor);
+        haMonitorThread.start();
 
         storagePoolManager = new KVMStoragePoolManager(storageLayer, kvmhaMonitor);
 
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckOnHostCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckOnHostCommandWrapper.java
index 48996a7ba97c..f901fd97ca76 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckOnHostCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckOnHostCommandWrapper.java
@@ -26,6 +26,7 @@
 import java.util.concurrent.Future;
 
 import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.CheckOnHostAnswer;
 import com.cloud.agent.api.CheckOnHostCommand;
 import com.cloud.agent.api.to.HostTO;
 import com.cloud.hypervisor.kvm.resource.KVMHABase.HAStoragePool;
@@ -45,20 +46,21 @@ public Answer execute(final CheckOnHostCommand command, final LibvirtComputingRe
 
         final List<HAStoragePool> pools = monitor.getStoragePools();
         final HostTO host = command.getHost();
-        final KVMHAChecker ha = new KVMHAChecker(pools, host, command.isCheckFailedOnOneStorage());
+
+        final KVMHAChecker ha = new KVMHAChecker(pools, host, command.shouldReportIfHeartBeatFailedForOneStoragePool());
 
         final Future<Boolean> future = executors.submit(ha);
         try {
-            final Boolean result = future.get();
-            if (result) {
-                return new Answer(command, false, "Heart is beating...");
+            final Boolean hasHeartBeat = future.get();
+            if (hasHeartBeat) {
+                return new CheckOnHostAnswer(command, true, "Heart is beating");
             } else {
-                return new Answer(command);
+                return new CheckOnHostAnswer(command, "Heart is not beating");
             }
         } catch (final InterruptedException e) {
-            return new Answer(command, false, "CheckOnHostCommand: can't get status of host: InterruptedException");
+            return new CheckOnHostAnswer(command, "CheckOnHostCommand: can't get status of host: InterruptedException");
         } catch (final ExecutionException e) {
-            return new Answer(command, false, "CheckOnHostCommand: can't get status of host: ExecutionException");
+            return new CheckOnHostAnswer(command, "CheckOnHostCommand: can't get status of host: ExecutionException");
         }
     }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVMActivityOnStoragePoolCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVMActivityOnStoragePoolCommandWrapper.java
index d3f537dc9173..b132f6d98ce9 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVMActivityOnStoragePoolCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCheckVMActivityOnStoragePoolCommandWrapper.java
@@ -49,8 +49,8 @@ public Answer execute(final CheckVMActivityOnStoragePoolCommand command, final L
         KVMStoragePool primaryPool = storagePoolMgr.getStoragePool(pool.getType(), pool.getUuid());
 
         if (primaryPool.isPoolSupportHA()) {
-            final HAStoragePool nfspool = monitor.getStoragePool(pool.getUuid());
-            final KVMHAVMActivityChecker ha = new KVMHAVMActivityChecker(nfspool, command.getHost(), command.getVolumeList(), libvirtComputingResource.getVmActivityCheckPath(), command.getSuspectTimeInSeconds());
+            final HAStoragePool haPool = monitor.getStoragePool(pool.getUuid());
+            final KVMHAVMActivityChecker ha = new KVMHAVMActivityChecker(haPool, command.getHost(), command.getVolumeList(), libvirtComputingResource.getVmActivityCheckPath(), command.getSuspectTimeInSeconds());
             final Future<Boolean> future = executors.submit(ha);
             try {
                 final Boolean result = future.get();
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/IscsiAdmStoragePool.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/IscsiAdmStoragePool.java
index f5bfd898a4f4..8cf6de68f955 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/IscsiAdmStoragePool.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/IscsiAdmStoragePool.java
@@ -208,12 +208,12 @@ public String getStorageNodeId() {
     }
 
     @Override
-    public Boolean checkingHeartBeat(HAStoragePool pool, HostTO host) {
+    public Boolean hasHeartBeat(HAStoragePool pool, HostTO host) {
         return null;
     }
 
     @Override
-    public Boolean vmActivityCheck(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration) {
+    public Boolean hasVmActivity(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration) {
         return null;
     }
 
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java
index 8dd2116e1235..3e35ed9476b1 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStoragePool.java
@@ -33,35 +33,33 @@
 
 public interface KVMStoragePool {
 
-    public static final long HeartBeatUpdateTimeout = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.HEARTBEAT_UPDATE_TIMEOUT);
-    public static final long HeartBeatUpdateFreq = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_FREQUENCY);
-    public static final long HeartBeatUpdateMaxTries = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_MAX_TRIES);
-    public static final long HeartBeatUpdateRetrySleep = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_RETRY_SLEEP);
-    public static final long HeartBeatCheckerTimeout = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_CHECKER_TIMEOUT);
+    long HeartBeatUpdateTimeoutInMs = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.HEARTBEAT_UPDATE_TIMEOUT);
+    long HeartBeatUpdateFreqInMs = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_UPDATE_FREQUENCY);
+    long HeartBeatCheckerTimeoutInMs = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.KVM_HEARTBEAT_CHECKER_TIMEOUT);
 
-    public default KVMPhysicalDisk createPhysicalDisk(String volumeUuid, PhysicalDiskFormat format, Storage.ProvisioningType provisioningType, long size, Long usableSize, byte[] passphrase) {
+    default KVMPhysicalDisk createPhysicalDisk(String volumeUuid, PhysicalDiskFormat format, Storage.ProvisioningType provisioningType, long size, Long usableSize, byte[] passphrase) {
         return createPhysicalDisk(volumeUuid, format, provisioningType, size, passphrase);
     }
 
-    public KVMPhysicalDisk createPhysicalDisk(String volumeUuid, PhysicalDiskFormat format, Storage.ProvisioningType provisioningType, long size, byte[] passphrase);
+    KVMPhysicalDisk createPhysicalDisk(String volumeUuid, PhysicalDiskFormat format, Storage.ProvisioningType provisioningType, long size, byte[] passphrase);
 
-    public KVMPhysicalDisk createPhysicalDisk(String volumeUuid, Storage.ProvisioningType provisioningType, long size, byte[] passphrase);
+    KVMPhysicalDisk createPhysicalDisk(String volumeUuid, Storage.ProvisioningType provisioningType, long size, byte[] passphrase);
 
-    public boolean connectPhysicalDisk(String volumeUuid, Map<String, String> details);
+    boolean connectPhysicalDisk(String volumeUuid, Map<String, String> details);
 
-    public KVMPhysicalDisk getPhysicalDisk(String volumeUuid);
+    KVMPhysicalDisk getPhysicalDisk(String volumeUuid);
 
-    public boolean disconnectPhysicalDisk(String volumeUuid);
+    boolean disconnectPhysicalDisk(String volumeUuid);
 
-    public boolean deletePhysicalDisk(String volumeUuid, Storage.ImageFormat format);
+    boolean deletePhysicalDisk(String volumeUuid, Storage.ImageFormat format);
 
-    public List<KVMPhysicalDisk> listPhysicalDisks();
+    List<KVMPhysicalDisk> listPhysicalDisks();
 
-    public String getUuid();
+    String getUuid();
 
-    public long getCapacity();
+    long getCapacity();
 
-    public long getUsed();
+    long getUsed();
 
     default Long getCapacityIops() {
         return null;
@@ -71,51 +69,51 @@ default Long getUsedIops() {
         return null;
     }
 
-    public long getAvailable();
+    long getAvailable();
 
-    public boolean refresh();
+    boolean refresh();
 
-    public boolean isExternalSnapshot();
+    boolean isExternalSnapshot();
 
-    public String getLocalPath();
+    String getLocalPath();
 
-    public String getSourceHost();
+    String getSourceHost();
 
-    public String getSourceDir();
+    String getSourceDir();
 
-    public int getSourcePort();
+    int getSourcePort();
 
-    public String getAuthUserName();
+    String getAuthUserName();
 
-    public String getAuthSecret();
+    String getAuthSecret();
 
-    public StoragePoolType getType();
+    StoragePoolType getType();
 
-    public boolean delete();
+    boolean delete();
 
     PhysicalDiskFormat getDefaultFormat();
 
-    public boolean createFolder(String path);
+    boolean createFolder(String path);
 
-    public boolean supportsConfigDriveIso();
+    boolean supportsConfigDriveIso();
 
-    public Map<String, String> getDetails();
+    Map<String, String> getDetails();
 
     default String getLocalPathFor(String relativePath) {
         return String.format("%s%s%s", getLocalPath(), File.separator, relativePath);
     }
 
-    public boolean isPoolSupportHA();
+    boolean isPoolSupportHA();
 
-    public String getHearthBeatPath();
+    String getHearthBeatPath();
 
-    public String createHeartBeatCommand(HAStoragePool primaryStoragePool, String hostPrivateIp, boolean hostValidation);
+    String createHeartBeatCommand(HAStoragePool primaryStoragePool, String hostPrivateIp, boolean hostValidation);
 
-    public String getStorageNodeId();
+    String getStorageNodeId();
 
-    public Boolean checkingHeartBeat(HAStoragePool pool, HostTO host);
+    Boolean hasHeartBeat(HAStoragePool pool, HostTO host);
 
-    public Boolean vmActivityCheck(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration);
+    Boolean hasVmActivity(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration);
 
     default LibvirtVMDef.DiskDef.BlockIOSize getSupportedLogicalBlockSize() {
         return null;
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java
index 45c22d3ac754..910f0eb15e0b 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/LibvirtStoragePool.java
@@ -345,16 +345,14 @@ public String getHearthBeatPath() {
 
 
     public String createHeartBeatCommand(HAStoragePool primaryStoragePool, String hostPrivateIp, boolean hostValidation) {
-        Script cmd = new Script(primaryStoragePool.getPool().getHearthBeatPath(), HeartBeatUpdateTimeout, logger);
+        Script cmd = new Script(primaryStoragePool.getPool().getHearthBeatPath(), HeartBeatUpdateTimeoutInMs, logger);
         cmd.add("-i", primaryStoragePool.getPoolIp());
         cmd.add("-p", primaryStoragePool.getPoolMountSourcePath());
         cmd.add("-m", primaryStoragePool.getMountDestPath());
 
         if (hostValidation) {
             cmd.add("-h", hostPrivateIp);
-        }
-
-        if (!hostValidation) {
+        } else {
             cmd.add("-c");
         }
 
@@ -372,53 +370,53 @@ public String getStorageNodeId() {
     }
 
     @Override
-    public Boolean checkingHeartBeat(HAStoragePool pool, HostTO host) {
-        boolean validResult = false;
+    public Boolean hasHeartBeat(HAStoragePool pool, HostTO host) {
         String hostIp = host.getPrivateNetwork().getIp();
-        Script cmd = new Script(getHearthBeatPath(), HeartBeatCheckerTimeout, logger);
+        Script cmd = new Script(getHearthBeatPath(), HeartBeatCheckerTimeoutInMs, logger);
         cmd.add("-i", pool.getPoolIp());
         cmd.add("-p", pool.getPoolMountSourcePath());
         cmd.add("-m", pool.getMountDestPath());
         cmd.add("-h", hostIp);
         cmd.add("-r");
-        cmd.add("-t", String.valueOf(HeartBeatUpdateFreq / 1000));
+        cmd.add("-t", String.valueOf(HeartBeatUpdateFreqInMs / 1000));
         OutputInterpreter.OneLineParser parser = new OutputInterpreter.OneLineParser();
         String result = cmd.execute(parser);
         String parsedLine = parser.getLine();
 
-        logger.debug(String.format("Checking heart beat with KVMHAChecker [{command=\"%s\", result: \"%s\", log: \"%s\", pool: \"%s\"}].", cmd.toString(), result, parsedLine,
-                pool.getPoolIp()));
+        logger.debug("Checking heart beat for host IP {} with KVMHAChecker [{command=\"{}\", result: \"{}\", log: \"{}\", pool: \"{}\"}].", hostIp, cmd.toString(), result, parsedLine, pool.getPoolIp());
 
         if (result == null && parsedLine.contains("DEAD")) {
-            logger.warn(String.format("Checking heart beat with KVMHAChecker command [%s] returned [%s]. [%s]. It may cause a shutdown of host IP [%s].", cmd.toString(),
-                    result, parsedLine, hostIp));
+            logger.warn("Checking heart beat for host IP {} with KVMHAChecker command [{}] returned [{}]. It may cause a shutdown of the host.", hostIp, cmd.toString(), parsedLine);
+            return false;
         } else {
-            validResult = true;
+            logger.debug("Checking heart beat for host IP {} with KVMHAChecker command [{}] succeeded.", hostIp, cmd.toString());
+            return true;
         }
-        return validResult;
     }
 
     @Override
-    public Boolean vmActivityCheck(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration) {
+    public Boolean hasVmActivity(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration) {
+        String hostIp = host.getPrivateNetwork().getIp();
         Script cmd = new Script(vmActivityCheckPath, activityScriptTimeout.getStandardSeconds(), logger);
         cmd.add("-i", pool.getPoolIp());
         cmd.add("-p", pool.getPoolMountSourcePath());
         cmd.add("-m", pool.getMountDestPath());
-        cmd.add("-h", host.getPrivateNetwork().getIp());
+        cmd.add("-h", hostIp);
         cmd.add("-u", volumeUUIDListString);
-        cmd.add("-t", String.valueOf(String.valueOf(System.currentTimeMillis() / 1000)));
+        cmd.add("-t", String.valueOf(System.currentTimeMillis() / 1000));
         cmd.add("-d", String.valueOf(duration));
         OutputInterpreter.OneLineParser parser = new OutputInterpreter.OneLineParser();
 
         String result = cmd.execute(parser);
         String parsedLine = parser.getLine();
 
-        logger.debug(String.format("Checking heart beat with KVMHAVMActivityChecker [{command=\"%s\", result: \"%s\", log: \"%s\", pool: \"%s\"}].", cmd.toString(), result, parsedLine, pool.getPoolIp()));
+        logger.debug("Checking VM activity for host IP {} with KVMHAVMActivityChecker [{command=\"{}\", result: \"{}\", log: \"{}\", pool: \"{}\"}].", hostIp, cmd.toString(), result, parsedLine, pool.getPoolIp());
 
         if (result == null && parsedLine.contains("DEAD")) {
-            logger.warn(String.format("Checking heart beat with KVMHAVMActivityChecker command [%s] returned [%s]. It is [%s]. It may cause a shutdown of host IP [%s].", cmd.toString(), result, parsedLine, host.getPrivateNetwork().getIp()));
+            logger.warn("Checking VM activity for host IP {} with KVMHAVMActivityChecker command [{}] returned [{}]. It may cause a shutdown of the host.", hostIp, cmd.toString(), parsedLine);
             return false;
         } else {
+            logger.debug("Checking VM activity for host IP {} with KVMHAVMActivityChecker command [{}] succeeded.", hostIp, cmd.toString());
             return true;
         }
     }
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/MultipathSCSIPool.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/MultipathSCSIPool.java
index 229481b1f795..df9986c99194 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/MultipathSCSIPool.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/MultipathSCSIPool.java
@@ -225,13 +225,13 @@ public String getStorageNodeId() {
     }
 
     @Override
-    public Boolean checkingHeartBeat(HAStoragePool pool, HostTO host) {
+    public Boolean hasHeartBeat(HAStoragePool pool, HostTO host) {
         return null;
     }
 
     @Override
-    public Boolean vmActivityCheck(HAStoragePool pool, HostTO host, Duration activityScriptTimeout,
-            String volumeUUIDListString, String vmActivityCheckPath, long duration) {
+    public Boolean hasVmActivity(HAStoragePool pool, HostTO host, Duration activityScriptTimeout,
+                                 String volumeUUIDListString, String vmActivityCheckPath, long duration) {
         return null;
     }
 
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/ScaleIOStoragePool.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/ScaleIOStoragePool.java
index e8243c3f7cfe..fc512ff94a94 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/ScaleIOStoragePool.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/ScaleIOStoragePool.java
@@ -236,12 +236,12 @@ public String getStorageNodeId() {
     }
 
     @Override
-    public Boolean checkingHeartBeat(HAStoragePool pool, HostTO host) {
+    public Boolean hasHeartBeat(HAStoragePool pool, HostTO host) {
         return null;
     }
 
     @Override
-    public Boolean vmActivityCheck(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration) {
+    public Boolean hasVmActivity(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration) {
         return null;
     }
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHAConfig.java b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHAConfig.java
index 59ea720328f5..3fbb5340fcce 100644
--- a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHAConfig.java
+++ b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHAConfig.java
@@ -19,38 +19,37 @@
 
 import org.apache.cloudstack.framework.config.ConfigKey;
 
-public class KVMHAConfig {
+public interface KVMHAConfig {
 
-    public static final ConfigKey<Long> KvmHAHealthCheckTimeout = new ConfigKey<>("Advanced", Long.class, "kvm.ha.health.check.timeout", "10",
+    ConfigKey<Long> KvmHAHealthCheckTimeout = new ConfigKey<>("Advanced", Long.class, "kvm.ha.health.check.timeout", "10",
             "The maximum length of time, in seconds, expected for an health check to complete.", true, ConfigKey.Scope.Cluster);
 
-    public static final ConfigKey<Long> KvmHAActivityCheckTimeout = new ConfigKey<>("Advanced", Long.class, "kvm.ha.activity.check.timeout", "60",
+    ConfigKey<Long> KvmHAActivityCheckTimeout = new ConfigKey<>("Advanced", Long.class, "kvm.ha.activity.check.timeout", "60",
             "The maximum length of time, in seconds, expected for an activity check to complete.", true, ConfigKey.Scope.Cluster);
 
-    public static final ConfigKey<Long> KvmHAActivityCheckInterval = new ConfigKey<>("Advanced", Long.class, "kvm.ha.activity.check.interval", "60",
+    ConfigKey<Long> KvmHAActivityCheckInterval = new ConfigKey<>("Advanced", Long.class, "kvm.ha.activity.check.interval", "60",
             "The interval, in seconds, between activity checks.", true, ConfigKey.Scope.Cluster);
 
-    public static final ConfigKey<Long> KvmHAActivityCheckMaxAttempts = new ConfigKey<>("Advanced", Long.class, "kvm.ha.activity.check.max.attempts", "10",
+    ConfigKey<Long> KvmHAActivityCheckMaxAttempts = new ConfigKey<>("Advanced", Long.class, "kvm.ha.activity.check.max.attempts", "10",
             "The maximum number of activity check attempts to perform before deciding to recover or degrade a resource.", true, ConfigKey.Scope.Cluster);
 
-    public static final ConfigKey<Double> KvmHAActivityCheckFailureThreshold = new ConfigKey<>("Advanced", Double.class, "kvm.ha.activity.check.failure.ratio", "0.7",
+    ConfigKey<Double> KvmHAActivityCheckFailureThreshold = new ConfigKey<>("Advanced", Double.class, "kvm.ha.activity.check.failure.ratio", "0.7",
             "The activity check failure threshold ratio. This is used with the activity check maximum attempts for deciding to recover or degrade a resource. For most environments, please keep this value above 0.5.",
             true, ConfigKey.Scope.Cluster);
 
-    public static final ConfigKey<Long> KvmHADegradedMaxPeriod = new ConfigKey<>("Advanced", Long.class, "kvm.ha.degraded.max.period", "300",
+    ConfigKey<Long> KvmHADegradedMaxPeriod = new ConfigKey<>("Advanced", Long.class, "kvm.ha.degraded.max.period", "300",
             "The maximum length of time, in seconds, a resource can be in degraded state where only health checks are performed.", true, ConfigKey.Scope.Cluster);
 
-    public static final ConfigKey<Long> KvmHARecoverTimeout = new ConfigKey<>("Advanced", Long.class, "kvm.ha.recover.timeout", "60",
+    ConfigKey<Long> KvmHARecoverTimeout = new ConfigKey<>("Advanced", Long.class, "kvm.ha.recover.timeout", "60",
             "The maximum length of time, in seconds, expected for a recovery operation to complete.", true, ConfigKey.Scope.Cluster);
 
-    public static final ConfigKey<Long> KvmHARecoverWaitPeriod = new ConfigKey<>("Advanced", Long.class, "kvm.ha.recover.wait.period", "600",
+    ConfigKey<Long> KvmHARecoverWaitPeriod = new ConfigKey<>("Advanced", Long.class, "kvm.ha.recover.wait.period", "600",
             "The maximum length of time, in seconds, to wait for a resource to recover.", true, ConfigKey.Scope.Cluster);
 
-    public static final ConfigKey<Long> KvmHARecoverAttemptThreshold = new ConfigKey<>("Advanced", Long.class, "kvm.ha.recover.failure.threshold", "1",
+    ConfigKey<Long> KvmHARecoverAttemptThreshold = new ConfigKey<>("Advanced", Long.class, "kvm.ha.recover.failure.threshold", "1",
             "The maximum recovery attempts to be made for a resource, after which the resource is fenced. The recovery counter resets when a health check passes for a resource.",
             true, ConfigKey.Scope.Cluster);
 
-    public static final ConfigKey<Long> KvmHAFenceTimeout = new ConfigKey<>("Advanced", Long.class, "kvm.ha.fence.timeout", "60",
+    ConfigKey<Long> KvmHAFenceTimeout = new ConfigKey<>("Advanced", Long.class, "kvm.ha.fence.timeout", "60",
             "The maximum length of time, in seconds, expected for a fence operation to complete.", true, ConfigKey.Scope.Cluster);
-
 }
diff --git a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHAProvider.java b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHAProvider.java
index b937be5265b7..f0b5cfc337de 100644
--- a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHAProvider.java
+++ b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHAProvider.java
@@ -68,17 +68,18 @@ public boolean hasActivity(final Host r, final DateTime suspectTime) throws HACh
 
     @Override
     public boolean recover(Host r) throws HARecoveryException {
+        logger.debug("Recover the host {}", r);
         try {
-            if (outOfBandManagementService.isOutOfBandManagementEnabled(r)){
+            if (outOfBandManagementService.isOutOfBandManagementEnabled(r)) {
                 final OutOfBandManagementResponse resp = outOfBandManagementService.executePowerOperation(r, PowerOperation.RESET, null);
                 return resp.getSuccess();
             } else {
                 logger.warn("OOBM recover operation failed for the host {}", r);
                 return false;
             }
-        } catch (Exception e){
+        } catch (Exception e) {
             logger.warn("OOBM service is not configured or enabled for this host {} error is {}", r, e.getMessage());
-            throw new HARecoveryException(String.format(" OOBM service is not configured or enabled for this host %s", r), e);
+            throw new HARecoveryException(String.format("OOBM service is not configured or enabled for this host %s", r), e);
         }
     }
 
diff --git a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHostActivityChecker.java b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHostActivityChecker.java
index 31f87d7e0442..af7441c4fd29 100644
--- a/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHostActivityChecker.java
+++ b/plugins/hypervisors/kvm/src/main/java/org/apache/cloudstack/kvm/ha/KVMHostActivityChecker.java
@@ -19,6 +19,7 @@
 
 import com.cloud.agent.AgentManager;
 import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.CheckOnHostAnswer;
 import com.cloud.agent.api.CheckOnHostCommand;
 import com.cloud.agent.api.CheckVMActivityOnStoragePoolCommand;
 import com.cloud.dc.dao.ClusterDao;
@@ -61,7 +62,7 @@ public class KVMHostActivityChecker extends AdapterBase implements ActivityCheck
     @Inject
     private AgentManager agentMgr;
     @Inject
-    private PrimaryDataStoreDao storagePool;
+    private PrimaryDataStoreDao storagePoolDao;
     @Inject
     private StorageManager storageManager;
     @Inject
@@ -70,11 +71,11 @@ public class KVMHostActivityChecker extends AdapterBase implements ActivityCheck
     @Override
     public boolean isActive(Host r, DateTime suspectTime) throws HACheckerException {
         try {
-            return isVMActivityOnHost(r, suspectTime);
+            return hasVMActivityOnHost(r, suspectTime);
         } catch (HACheckerException e) {
-            //Re-throwing the exception to avoid poluting the 'HACheckerException' already thrown
+            //Re-throwing the exception to avoid polluting the 'HACheckerException' already thrown
             throw e;
-        } catch (Exception e){
+        } catch (Exception e) {
             String message = String.format("Operation timed out, probably the %s is not reachable.", r.toString());
             logger.warn(message, e);
             throw new HACheckerException(message, e);
@@ -83,82 +84,115 @@ public boolean isActive(Host r, DateTime suspectTime) throws HACheckerException
 
     @Override
     public boolean isHealthy(Host r) {
-        return isAgentActive(r);
+        return isHostAgentUp(r);
     }
 
-    private boolean isAgentActive(Host agent) {
-        if (agent.getHypervisorType() != Hypervisor.HypervisorType.KVM && agent.getHypervisorType() != Hypervisor.HypervisorType.LXC) {
-            throw new IllegalStateException(String.format("Calling KVM investigator for non KVM Host of type [%s].", agent.getHypervisorType()));
+    private boolean isHostAgentUp(Host host) {
+        if (host.getHypervisorType() != Hypervisor.HypervisorType.KVM && host.getHypervisorType() != Hypervisor.HypervisorType.LXC) {
+            throw new IllegalStateException(String.format("Calling KVM investigator for non KVM Host of type [%s].", host.getHypervisorType()));
+        }
+
+        Status hostStatus = getHostAgentStatus(host);
+
+        logger.debug("{} has the status [{}].", host.toString(), hostStatus);
+        return hostStatus == Status.Up;
+    }
+
+    public Status getHostAgentStatus(Host host) {
+        if (host.getHypervisorType() != Hypervisor.HypervisorType.KVM && host.getHypervisorType() != Hypervisor.HypervisorType.LXC) {
+            return null;
+        }
+
+        Status hostStatusFromItself = checkHostStatusWithSameHost(host);
+        if (hostStatusFromItself == Status.Up) {
+            return Status.Up;
         }
-        Status hostStatus = Status.Unknown;
-        Status neighbourStatus = Status.Unknown;
-        final CheckOnHostCommand cmd = new CheckOnHostCommand(agent, HighAvailabilityManager.KvmHAFenceHostIfHeartbeatFailsOnStorage.value());
+
+        Status hostStatusFromNeighbour = checkHostStatusWithNeighbourHosts(host);
+        Status hostStatus = hostStatusFromItself;
+        if (hostStatusFromNeighbour == Status.Up && (hostStatusFromItself == Status.Disconnected || hostStatusFromItself == Status.Down)) {
+            hostStatus = Status.Disconnected;
+        }
+        if (hostStatusFromNeighbour == Status.Down && (hostStatusFromItself == Status.Disconnected || hostStatusFromItself == Status.Down)) {
+            hostStatus = Status.Down;
+        }
+
+        logger.debug("HA: HOST is ineligible legacy state {} for host {}", hostStatus, host);
+        return hostStatus;
+    }
+
+    private Status checkHostStatusWithSameHost(Host host) {
+        Status hostStatus;
+        boolean reportFailureIfOneStorageIsDown = HighAvailabilityManager.KvmHAFenceHostIfHeartbeatFailsOnStorage.value();
+        final CheckOnHostCommand cmd = new CheckOnHostCommand(host, reportFailureIfOneStorageIsDown);
         try {
-            logger.debug(String.format("Checking %s status...", agent.toString()));
-            Answer answer = agentMgr.easySend(agent.getId(), cmd);
+            logger.debug("Checking {} status...", host.toString());
+            Answer answer = agentMgr.easySend(host.getId(), cmd);
             if (answer != null) {
-                hostStatus = answer.getResult() ? Status.Down : Status.Up;
-                logger.debug(String.format("%s has the status [%s].", agent.toString(), hostStatus));
-
-                if ( hostStatus == Status.Up ){
-                    return true;
+                if (answer.getResult()) {
+                    hostStatus = ((CheckOnHostAnswer)answer).isAlive() ? Status.Up : Status.Down;
+                } else {
+                    logger.debug("{} is not active according to itself, details: {}.", host.toString(), answer.getDetails());
+                    hostStatus = Status.Down;
                 }
-            }
-            else {
-                logger.debug(String.format("Setting %s to \"Disconnected\" status.", agent.toString()));
+                logger.debug("{} has the status [{}].", host.toString(), hostStatus);
+            } else {
+                logger.debug("Setting {} to \"Disconnected\" status.", host.toString());
                 hostStatus = Status.Disconnected;
             }
         } catch (Exception e) {
-            logger.warn(String.format("Failed to send command CheckOnHostCommand to %s.", agent.toString()), e);
+            logger.warn("Failed to send command CheckOnHostCommand to {}.", host.toString(), e);
+            hostStatus = Status.Disconnected;
         }
 
-        List<HostVO> neighbors = resourceManager.listHostsInClusterByStatus(agent.getClusterId(), Status.Up);
+        return hostStatus;
+    }
+
+    private Status checkHostStatusWithNeighbourHosts(Host host) {
+        Status hostStatusFromNeighbour = Status.Unknown;
+        boolean reportFailureIfOneStorageIsDown = HighAvailabilityManager.KvmHAFenceHostIfHeartbeatFailsOnStorage.value();
+        final CheckOnHostCommand cmd = new CheckOnHostCommand(host, reportFailureIfOneStorageIsDown);
+        List<HostVO> neighbors = resourceManager.listHostsInClusterByStatus(host.getClusterId(), Status.Up);
         for (HostVO neighbor : neighbors) {
-            if (neighbor.getId() == agent.getId() || (neighbor.getHypervisorType() != Hypervisor.HypervisorType.KVM && neighbor.getHypervisorType() != Hypervisor.HypervisorType.LXC)) {
+            if (neighbor.getId() == host.getId()
+                    || (neighbor.getHypervisorType() != Hypervisor.HypervisorType.KVM && neighbor.getHypervisorType() != Hypervisor.HypervisorType.LXC)) {
                 continue;
             }
 
             try {
-                logger.debug(String.format("Investigating %s via neighbouring %s.", agent.toString(), neighbor.toString()));
-
+                logger.debug("Investigating {} via neighboring {}.", host.toString(), neighbor.toString());
                 Answer answer = agentMgr.easySend(neighbor.getId(), cmd);
                 if (answer != null) {
-                    neighbourStatus = answer.getResult() ? Status.Down : Status.Up;
-
-                    logger.debug(String.format("Neighbouring %s returned status [%s] for the investigated %s.", neighbor.toString(), neighbourStatus, agent.toString()));
-
-                    if (neighbourStatus == Status.Up) {
-                        break;
+                    if (answer.getResult()) {
+                        hostStatusFromNeighbour = ((CheckOnHostAnswer)answer).isAlive() ? Status.Up : Status.Down;
+                        logger.debug("Neighboring {} returned status [{}] for the investigated {}.", neighbor.toString(), hostStatusFromNeighbour, host.toString());
+                        if (hostStatusFromNeighbour == Status.Up) {
+                            return hostStatusFromNeighbour;
+                        }
+                    } else {
+                        logger.debug("{} is not active according to neighbor {}, details: {}.", host.toString(), neighbor.toString(), answer.getDetails());
                     }
                 } else {
-                    logger.debug(String.format("Neighbouring %s is Disconnected.", neighbor.toString()));
+                    logger.debug("Neighboring {} is Disconnected.", neighbor.toString());
                 }
             } catch (Exception e) {
-                logger.warn(String.format("Failed to send command CheckOnHostCommand to %s.", neighbor.toString()), e);
+                logger.warn("Failed to send command CheckOnHostCommand to neighbor {}.", neighbor.toString(), e);
             }
         }
-        if (neighbourStatus == Status.Up && (hostStatus == Status.Disconnected || hostStatus == Status.Down)) {
-            hostStatus = Status.Disconnected;
-        }
-        if (neighbourStatus == Status.Down && (hostStatus == Status.Disconnected || hostStatus == Status.Down)) {
-            hostStatus = Status.Down;
-        }
 
-        logger.debug(String.format("%s has the status [%s].", agent.toString(), hostStatus));
-
-        return hostStatus == Status.Up;
+        return hostStatusFromNeighbour;
     }
 
-    private boolean isVMActivityOnHost(Host agent, DateTime suspectTime) throws HACheckerException {
-        if (agent.getHypervisorType() != Hypervisor.HypervisorType.KVM && agent.getHypervisorType() != Hypervisor.HypervisorType.LXC) {
-            throw new IllegalStateException(String.format("Calling KVM investigator for non KVM Host of type [%s].", agent.getHypervisorType()));
+    private boolean hasVMActivityOnHost(Host host, DateTime suspectTime) throws HACheckerException {
+        if (host.getHypervisorType() != Hypervisor.HypervisorType.KVM && host.getHypervisorType() != Hypervisor.HypervisorType.LXC) {
+            throw new IllegalStateException(String.format("Calling KVM investigator for non KVM Host of type [%s].", host.getHypervisorType()));
         }
         boolean activityStatus = true;
-        HashMap<StoragePool, List<Volume>> poolVolMap = getVolumeUuidOnHost(agent);
-        for (StoragePool pool : poolVolMap.keySet()) {
-            activityStatus = verifyActivityOfStorageOnHost(poolVolMap, pool, agent, suspectTime, activityStatus);
+        HashMap<StoragePool, List<Volume>> poolVolumeMap = getStoragePoolAndVolumeInfoOnHost(host);
+        for (StoragePool pool : poolVolumeMap.keySet()) {
+            activityStatus = verifyActivityOfStorageOnHost(poolVolumeMap, pool, host, suspectTime, activityStatus);
             if (!activityStatus) {
-                logger.warn("It seems that the storage pool [{}] does not have activity on {}.", pool, agent);
+                logger.warn("It seems that the storage pool [{}] does not have activity on {}.", pool, host);
                 break;
             }
         }
@@ -166,66 +200,64 @@ private boolean isVMActivityOnHost(Host agent, DateTime suspectTime) throws HACh
         return activityStatus;
     }
 
-    protected boolean verifyActivityOfStorageOnHost(HashMap<StoragePool, List<Volume>> poolVolMap, StoragePool pool, Host agent, DateTime suspectTime, boolean activityStatus) throws HACheckerException, IllegalStateException {
+    protected boolean verifyActivityOfStorageOnHost(HashMap<StoragePool, List<Volume>> poolVolMap, StoragePool pool, Host host, DateTime suspectTime, boolean activityStatus) throws HACheckerException, IllegalStateException {
         List<Volume> volume_list = poolVolMap.get(pool);
-        final CheckVMActivityOnStoragePoolCommand cmd = new CheckVMActivityOnStoragePoolCommand(agent, pool, volume_list, suspectTime);
+        final CheckVMActivityOnStoragePoolCommand cmd = new CheckVMActivityOnStoragePoolCommand(host, pool, volume_list, suspectTime);
 
-        logger.debug("Checking VM activity for {} on storage pool [{}].", agent.toString(), pool);
+        logger.debug("Checking VM activity for {} on storage pool [{}].", host.toString(), pool);
         try {
-            Answer answer = storageManager.sendToPool(pool, getNeighbors(agent), cmd);
-
+            Answer answer = storageManager.sendToPool(pool, getNeighbors(host), cmd);
             if (answer != null) {
                 activityStatus = !answer.getResult();
-                logger.debug("{} {} activity on storage pool [{}]", agent.toString(), activityStatus ? "has" : "does not have", pool);
+                logger.debug("{} {} activity on storage pool [{}]", host.toString(), activityStatus ? "has" : "does not have", pool);
             } else {
-                String message = String.format("Did not get a valid response for VM activity check for %s on storage pool [%s].", agent.toString(), pool);
+                String message = String.format("Did not get a valid response for VM activity check for %s on storage pool [%s].", host.toString(), pool);
                 logger.debug(message);
                 throw new IllegalStateException(message);
             }
-        } catch (StorageUnavailableException e){
-            String message = String.format("Storage [%s] is unavailable to do the check, probably the %s is not reachable.", pool, agent);
+        } catch (StorageUnavailableException e) {
+            String message = String.format("Storage [%s] is unavailable to do the check, probably the %s is not reachable.", pool, host);
             logger.warn(message, e);
             throw new HACheckerException(message, e);
         }
         return activityStatus;
     }
 
-    private HashMap<StoragePool, List<Volume>> getVolumeUuidOnHost(Host agent) {
-        List<VMInstanceVO> vm_list = vmInstanceDao.listByHostId(agent.getId());
-        List<VolumeVO> volume_list = new ArrayList<VolumeVO>();
-        for (VirtualMachine vm : vm_list) {
+    private HashMap<StoragePool, List<Volume>> getStoragePoolAndVolumeInfoOnHost(Host host) {
+        List<VMInstanceVO> vmListOnHost = vmInstanceDao.listByHostId(host.getId());
+        List<VolumeVO> volumeListOnHost = new ArrayList<>();
+        for (VirtualMachine vm : vmListOnHost) {
             logger.debug("Retrieving volumes of VM [{}]...", vm);
-            List<VolumeVO> vm_volume_list = volumeDao.findByInstance(vm.getId());
-            volume_list.addAll(vm_volume_list);
+            List<VolumeVO> volumeListOfVM = volumeDao.findByInstance(vm.getId());
+            volumeListOnHost.addAll(volumeListOfVM);
         }
 
-        HashMap<StoragePool, List<Volume>> poolVolMap = new HashMap<StoragePool, List<Volume>>();
-        for (Volume vol : volume_list) {
-            StoragePool sp = storagePool.findById(vol.getPoolId());
-            logger.debug("Retrieving storage pool [{}] of volume [{}]...", sp, vol);
-            if (!poolVolMap.containsKey(sp)) {
-                List<Volume> list = new ArrayList<Volume>();
-                list.add(vol);
+        HashMap<StoragePool, List<Volume>> poolVolumeMap = new HashMap<>();
+        for (Volume volume : volumeListOnHost) {
+            StoragePool pool = storagePoolDao.findById(volume.getPoolId());
+            logger.debug("Retrieving storage pool [{}] of volume [{}]...", pool, volume);
+            if (!poolVolumeMap.containsKey(pool)) {
+                List<Volume> volList = new ArrayList<>();
+                volList.add(volume);
 
-                poolVolMap.put(sp, list);
+                poolVolumeMap.put(pool, volList);
             } else {
-                poolVolMap.get(sp).add(vol);
+                poolVolumeMap.get(pool).add(volume);
             }
         }
-        return poolVolMap;
+        return poolVolumeMap;
     }
 
-    public long[] getNeighbors(Host agent) {
-        List<Long> neighbors = new ArrayList<Long>();
-        List<HostVO> cluster_hosts = resourceManager.listHostsInClusterByStatus(agent.getClusterId(), Status.Up);
-        logger.debug("Retrieving all \"Up\" hosts from cluster [{}]...", clusterDao.findById(agent.getClusterId()));
-        for (HostVO host : cluster_hosts) {
-            if (host.getId() == agent.getId() || (host.getHypervisorType() != Hypervisor.HypervisorType.KVM && host.getHypervisorType() != Hypervisor.HypervisorType.LXC)) {
+    public long[] getNeighbors(Host host) {
+        List<Long> neighbors = new ArrayList<>();
+        List<HostVO> clusterHosts = resourceManager.listHostsInClusterByStatus(host.getClusterId(), Status.Up);
+        logger.debug("Retrieving all \"Up\" hosts from cluster [{}]...", clusterDao.findById(host.getClusterId()));
+        for (HostVO clusterHost : clusterHosts) {
+            if (clusterHost.getId() == host.getId() || (clusterHost.getHypervisorType() != Hypervisor.HypervisorType.KVM && clusterHost.getHypervisorType() != Hypervisor.HypervisorType.LXC)) {
                 continue;
             }
-            neighbors.add(host.getId());
+            neighbors.add(clusterHost.getId());
         }
         return ArrayUtils.toPrimitive(neighbors.toArray(new Long[neighbors.size()]));
     }
-
 }
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
index 0fae98072431..662b09a30448 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
@@ -3130,7 +3130,7 @@ public void testCheckOnHostCommand() {
         assertNotNull(wrapper);
 
         final Answer answer = wrapper.execute(command, libvirtComputingResourceMock);
-        assertTrue(answer.getResult());
+        assertFalse(answer.getResult());
 
         verify(libvirtComputingResourceMock, times(1)).getMonitor();
     }
diff --git a/plugins/hypervisors/simulator/src/main/java/com/cloud/ha/SimulatorInvestigator.java b/plugins/hypervisors/simulator/src/main/java/com/cloud/ha/SimulatorInvestigator.java
index 7114a8411578..95a6a1291cf1 100644
--- a/plugins/hypervisors/simulator/src/main/java/com/cloud/ha/SimulatorInvestigator.java
+++ b/plugins/hypervisors/simulator/src/main/java/com/cloud/ha/SimulatorInvestigator.java
@@ -54,13 +54,13 @@ protected SimulatorInvestigator() {
     }
 
     @Override
-    public Status isAgentAlive(Host agent) {
+    public Status getHostAgentStatus(Host agent) {
         if (agent.getHypervisorType() != HypervisorType.Simulator) {
             return null;
         }
 
         if (haManager.isHAEligible(agent)) {
-            return haManager.getHostStatus(agent);
+            return haManager.getHostStatusFromHAConfig(agent);
         }
 
         CheckOnHostCommand cmd = new CheckOnHostCommand(agent);
diff --git a/plugins/hypervisors/vmware/src/main/java/com/cloud/ha/VmwareInvestigator.java b/plugins/hypervisors/vmware/src/main/java/com/cloud/ha/VmwareInvestigator.java
index 5bfc18968430..3d4fab0d229e 100644
--- a/plugins/hypervisors/vmware/src/main/java/com/cloud/ha/VmwareInvestigator.java
+++ b/plugins/hypervisors/vmware/src/main/java/com/cloud/ha/VmwareInvestigator.java
@@ -28,7 +28,7 @@ protected VmwareInvestigator() {
     }
 
     @Override
-    public Status isAgentAlive(Host agent) {
+    public Status getHostAgentStatus(Host agent) {
         if (agent.getHypervisorType() == HypervisorType.VMware)
             return Status.Disconnected;
 
diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java
index bb354bec9b4b..1bcfaa4ebf7f 100644
--- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java
+++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStoragePool.java
@@ -228,11 +228,11 @@ public String getHearthBeatPath() {
     public String createHeartBeatCommand(HAStoragePool pool, String hostPrivateIp,
             boolean hostValidation) {
         LOGGER.trace(String.format("Linstor.createHeartBeatCommand: %s, %s, %b", pool.getPoolIp(), hostPrivateIp, hostValidation));
-        boolean isStorageNodeUp = checkingHeartBeat(pool, null);
+        boolean isStorageNodeUp = hasHeartBeat(pool, null);
         if (!isStorageNodeUp && !hostValidation) {
             //restart the host
             LOGGER.debug(String.format("The host [%s] will be restarted because the health check failed for the storage pool [%s]", hostPrivateIp, pool.getPool().getType()));
-            Script cmd = new Script(pool.getPool().getHearthBeatPath(), Duration.millis(HeartBeatUpdateTimeout), LOGGER);
+            Script cmd = new Script(pool.getPool().getHearthBeatPath(), Duration.millis(HeartBeatUpdateTimeoutInMs), LOGGER);
             cmd.add("-c");
             cmd.execute();
             return "Down";
@@ -258,7 +258,7 @@ static String getHostname() {
     }
 
     @Override
-    public Boolean checkingHeartBeat(HAStoragePool pool, HostTO host) {
+    public Boolean hasHeartBeat(HAStoragePool pool, HostTO host) {
         String hostName;
         if (host == null) {
             hostName = localNodeName;
@@ -274,7 +274,7 @@ public Boolean checkingHeartBeat(HAStoragePool pool, HostTO host) {
     }
 
     private String executeDrbdSetupStatus(OutputInterpreter.AllLinesParser parser) {
-        Script sc = new Script("drbdsetup", Duration.millis(HeartBeatUpdateTimeout), LOGGER);
+        Script sc = new Script("drbdsetup", Duration.millis(HeartBeatUpdateTimeoutInMs), LOGGER);
         sc.add("status");
         sc.add("--json");
         return sc.execute(parser);
@@ -329,7 +329,7 @@ private boolean checkDrbdSetupStatusOutput(String output, String otherNodeName)
     }
 
     private String executeDrbdEventsNow(OutputInterpreter.AllLinesParser parser) {
-        Script sc = new Script("drbdsetup", Duration.millis(HeartBeatUpdateTimeout), LOGGER);
+        Script sc = new Script("drbdsetup", Duration.millis(HeartBeatUpdateTimeoutInMs), LOGGER);
         sc.add("events2");
         sc.add("--now");
         return sc.execute(parser);
@@ -369,8 +369,8 @@ private boolean checkHostUpToDateAndConnected(String hostName) {
     }
 
     @Override
-    public Boolean vmActivityCheck(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration) {
+    public Boolean hasVmActivity(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUUIDListString, String vmActivityCheckPath, long duration) {
         LOGGER.trace(String.format("Linstor.vmActivityCheck: %s, %s", pool.getPoolIp(), host.getPrivateNetwork().getIp()));
-        return checkingHeartBeat(pool, host);
+        return hasHeartBeat(pool, host);
     }
 }
diff --git a/plugins/storage/volume/storpool/src/main/java/com/cloud/hypervisor/kvm/storage/StorPoolStoragePool.java b/plugins/storage/volume/storpool/src/main/java/com/cloud/hypervisor/kvm/storage/StorPoolStoragePool.java
index ab5dc03d3431..04100a3c6d38 100644
--- a/plugins/storage/volume/storpool/src/main/java/com/cloud/hypervisor/kvm/storage/StorPoolStoragePool.java
+++ b/plugins/storage/volume/storpool/src/main/java/com/cloud/hypervisor/kvm/storage/StorPoolStoragePool.java
@@ -198,11 +198,11 @@ public String getHearthBeatPath() {
 
     @Override
     public String createHeartBeatCommand(HAStoragePool primaryStoragePool, String hostPrivateIp, boolean hostValidation) {
-        boolean isStorageNodeUp = checkingHeartBeat(primaryStoragePool, null);
+        boolean isStorageNodeUp = hasHeartBeat(primaryStoragePool, null);
         if (!isStorageNodeUp && !hostValidation) {
             //restart the host
             logger.debug(String.format("The host [%s] will be restarted because the health check failed for the storage pool [%s]", hostPrivateIp, primaryStoragePool.getPool().getType()));
-            Script cmd = new Script(primaryStoragePool.getPool().getHearthBeatPath(), HeartBeatUpdateTimeout, logger);
+            Script cmd = new Script(primaryStoragePool.getPool().getHearthBeatPath(), HeartBeatUpdateTimeoutInMs, logger);
             cmd.add("-c");
             cmd.execute();
             return "Down";
@@ -240,7 +240,7 @@ public static final String getStorPoolConfigParam(String param) {
     }
 
     @Override
-    public Boolean checkingHeartBeat(HAStoragePool pool, HostTO host) {
+    public Boolean hasHeartBeat(HAStoragePool pool, HostTO host) {
         boolean isNodeWorking = false;
         OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
 
@@ -300,8 +300,8 @@ private String executeStorPoolServiceListCmd(OutputInterpreter.AllLinesParser pa
     }
 
     @Override
-    public Boolean vmActivityCheck(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUuidListString, String vmActivityCheckPath, long duration) {
-        return checkingHeartBeat(pool, host);
+    public Boolean hasVmActivity(HAStoragePool pool, HostTO host, Duration activityScriptTimeout, String volumeUuidListString, String vmActivityCheckPath, long duration) {
+        return hasHeartBeat(pool, host);
     }
 
     @Override
diff --git a/scripts/vm/hypervisor/kvm/kvmheartbeat.sh b/scripts/vm/hypervisor/kvm/kvmheartbeat.sh
index 9b7eadada69f..1fa49b807769 100755
--- a/scripts/vm/hypervisor/kvm/kvmheartbeat.sh
+++ b/scripts/vm/hypervisor/kvm/kvmheartbeat.sh
@@ -75,7 +75,7 @@ fi
 #delete VMs on this mountpoint
 deleteVMs() {
   local mountPoint=$1
-  vmPids=$(ps aux| grep qemu | grep "$mountPoint" | awk '{print $2}' 2> /dev/null)
+  vmPids=$(ps aux | grep qemu | grep "$mountPoint" | awk '{print $2}' 2> /dev/null)
   if [ $? -gt 0 ]
   then
      return
@@ -93,7 +93,7 @@ deleteVMs() {
 }
 
 #checking is there the same nfs server mounted under $MountPoint?
-mounts=$(cat /proc/mounts |grep nfs|grep $MountPoint)
+mounts=$(cat /proc/mounts | grep nfs | grep $MountPoint)
 if [ $? -gt 0 ]
 then
    # remount it
diff --git a/server/src/main/java/com/cloud/ha/CheckOnAgentInvestigator.java b/server/src/main/java/com/cloud/ha/CheckOnAgentInvestigator.java
index d7945ef20776..e0dbc8fcbe11 100644
--- a/server/src/main/java/com/cloud/ha/CheckOnAgentInvestigator.java
+++ b/server/src/main/java/com/cloud/ha/CheckOnAgentInvestigator.java
@@ -38,7 +38,7 @@ protected CheckOnAgentInvestigator() {
     }
 
     @Override
-    public Status isAgentAlive(Host agent) {
+    public Status getHostAgentStatus(Host agent) {
         return null;
     }
 
diff --git a/server/src/main/java/com/cloud/ha/HighAvailabilityManagerImpl.java b/server/src/main/java/com/cloud/ha/HighAvailabilityManagerImpl.java
index c8635397b661..755de00dec26 100644
--- a/server/src/main/java/com/cloud/ha/HighAvailabilityManagerImpl.java
+++ b/server/src/main/java/com/cloud/ha/HighAvailabilityManagerImpl.java
@@ -42,6 +42,9 @@
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
+import org.apache.cloudstack.ha.HAConfig;
+import org.apache.cloudstack.ha.HAResource;
+import org.apache.cloudstack.ha.dao.HAConfigDao;
 import org.apache.cloudstack.managed.context.ManagedContext;
 import org.apache.cloudstack.managed.context.ManagedContextRunnable;
 import org.apache.cloudstack.management.ManagementServerHost;
@@ -223,6 +226,8 @@ public void setHaPlanners(List<HAPlanner> haPlanners) {
     @Inject
     ConfigurationDao _configDao;
     @Inject
+    HAConfigDao _haConfigDao;
+    @Inject
     VolumeOrchestrationService volumeMgr;
 
     String _instance;
@@ -237,25 +242,53 @@ public void setHaPlanners(List<HAPlanner> haPlanners) {
     long _timeBetweenCleanups;
     String _haTag = null;
 
+    protected HighAvailabilityManagerImpl() {
+    }
+
     private boolean vmHasPendingHAJob(final List<HaWorkVO> pendingHaWorks, final VMInstanceVO vm) {
         Optional<HaWorkVO> item = pendingHaWorks.stream()
                 .filter(h -> h.getInstanceId() == vm.getId())
                 .reduce((first, second) -> second);
         if (item.isPresent() && (item.get().getTimesTried() < _maxRetries ||
                 !item.get().canScheduleNew(_timeBetweenFailures))) {
-            logger.debug(String.format("Skipping HA on %s as there is already a running HA job for it", vm));
+            logger.debug("Skipping HA on {} as there is already a running HA job for it", vm);
             return true;
         }
         return false;
     }
 
-    protected HighAvailabilityManagerImpl() {
+    private boolean isHostHAInspectionInProgress(long hostId) {
+        final HAConfig haConfig = _haConfigDao.findHAResource(hostId, HAResource.ResourceType.Host);
+        if (haConfig == null || !haConfig.isEnabled()) {
+            return false;
+        }
+
+        HAConfig.HAState state = haConfig.getState();
+        logger.debug("Checking Host HA inspection is in progress or not for the host {} from HAConfig, HA state is {}", hostId, state);
+        if (state == HAConfig.HAState.Suspect || state == HAConfig.HAState.Checking) {
+            return true;
+        }
+
+        if (state == HAConfig.HAState.Recovered || state == HAConfig.HAState.Available) {
+            // If the host HA state is Recovered, it indicates that the host has restarted successfully.
+            // If the host HA state is Available, it means the host has restarted successfully and the recovery waiting period has completed.
+            // In both states, the agent can connect as soon as the host is ready (and can move to Suspect -> Checking HA state if the agent connection fails again before Fencing).
+            final HostVO host = _hostDao.findById(hostId);
+            if (host != null && host.getStatus() != Status.Up) {
+                logger.debug("{} is in {} status and HA state is {}, considering Host HA inspection is still in progress" +
+                        " until we are sure the host is ready after a recovery wait period and agent is connected/Up", host, host.getStatus(), state);
+                return true;
+            }
+        }
+
+        return false;
     }
 
     @Override
     public Status investigate(final long hostId) {
         final HostVO host = _hostDao.findById(hostId);
         if (host == null) {
+            logger.warn("Host with id {} is removed or doesn't exists.", hostId);
             return Status.Alert;
         }
 
@@ -270,7 +303,7 @@ public Status investigate(final long hostId) {
 
         Status hostState = null;
         for (Investigator investigator : investigators) {
-            hostState = investigator.isAgentAlive(host);
+            hostState = investigator.getHostAgentStatus(host);
             if (hostState != null) {
                 if (logger.isDebugEnabled()) {
                     logger.debug("{} was able to determine host {} is in {}", investigator.getName(), host, hostState.toString());
@@ -278,7 +311,7 @@ public Status investigate(final long hostId) {
                 return hostState;
             }
             if (logger.isDebugEnabled()) {
-                logger.debug(investigator.getName() + " unable to determine the state of the host.  Moving on.");
+                logger.debug("{} unable to determine the state of the host.  Moving on.", investigator.getName());
             }
         }
 
@@ -570,9 +603,9 @@ private void startVm(VirtualMachine vm, Map<VirtualMachineProfile.Param, Object>
     }
 
     protected Long restart(final HaWorkVO work) {
-        logger.debug("RESTART with HAWORK");
+        logger.debug("RESTART with HA WORK");
         List<HaWorkVO> items = _haDao.listFutureHaWorkForVm(work.getInstanceId(), work.getId());
-        if (items.size() > 0) {
+        if (!items.isEmpty()) {
             StringBuilder str = new StringBuilder("Cancelling this work item because newer ones have been scheduled.  Work Ids = [");
             for (HaWorkVO item : items) {
                 str.append(item.getId()).append(", ");
@@ -583,7 +616,7 @@ protected Long restart(final HaWorkVO work) {
         }
 
         items = _haDao.listRunningHaWorkForVm(work.getInstanceId());
-        if (items.size() > 0) {
+        if (!items.isEmpty()) {
             StringBuilder str = new StringBuilder("Waiting because there's HA work being executed on an item currently.  Work Ids =[");
             for (HaWorkVO item : items) {
                 str.append(item.getId()).append(", ");
@@ -597,21 +630,21 @@ protected Long restart(final HaWorkVO work) {
 
         VirtualMachine vm = _itMgr.findById(work.getInstanceId());
         if (vm == null) {
-            logger.info("Unable to find vm: " + vmId);
+            logger.info("Unable to find vm: {}", vmId);
             return null;
         }
         if (checkAndCancelWorkIfNeeded(work)) {
             return null;
         }
 
-        logger.info("HA on " + vm);
+        logger.info("HA on {}", vm);
         if (vm.getState() != work.getPreviousState() || vm.getUpdated() != work.getUpdateTime()) {
-            logger.info("VM " + vm + " has been changed.  Current State = " + vm.getState() + " Previous State = " + work.getPreviousState() + " last updated = " +
-                vm.getUpdated() + " previous updated = " + work.getUpdateTime());
+            logger.info("VM {} has been changed.  Current State = {} Previous State = {} last updated = {} previous updated = {}",
+                    vm, vm.getState(), work.getPreviousState(), vm.getUpdated(), work.getUpdateTime());
             return null;
         }
         if (vm.getHostId() != null && !vm.getHostId().equals(work.getHostId())) {
-            logger.info("VM " + vm + " has been changed.  Current host id = " + vm.getHostId() + " Previous host id = " + work.getHostId());
+            logger.info("VM {} has been changed.  Current host id = {} Previous host id = {}", vm, vm.getHostId(), work.getHostId());
             return null;
         }
 
@@ -628,10 +661,13 @@ protected Long restart(final HaWorkVO work) {
         boolean isHostRemoved = false;
         if (host == null) {
             host = _hostDao.findByIdIncludingRemoved(work.getHostId());
-            if (host != null) {
-                logger.debug("VM {} is now no longer on host {} as the host is removed", vm, host);
-                isHostRemoved = true;
+            if (host == null) {
+                logger.debug("VM {} is now no longer on host {}, the host doesn't exist", vm, work.getHostId());
+                return null;
             }
+
+            logger.debug("VM {} is now no longer on host {} as the host is removed", vm, host);
+            isHostRemoved = true;
         }
 
         DataCenterVO dcVO = _dcDao.findById(host.getDataCenterId());
@@ -652,40 +688,39 @@ protected Long restart(final HaWorkVO work) {
                     try
                     {
                         alive = investigator.isVmAlive(vm, host);
-                        logger.info(investigator.getName() + " found " + vm + " to be alive? " + alive);
+                        logger.info("{} found {} to be alive? {}", investigator.getName(), vm, alive);
                         break;
                     } catch (UnknownVM e) {
-                        logger.info(investigator.getName() + " could not find " + vm);
+                        logger.info("{} could not find {}", investigator.getName(), vm);
                     }
                 }
 
                 boolean fenced = false;
                 if (alive == null) {
-                    logger.debug("Fencing off VM that we don't know the state of");
+                    logger.debug("Fencing off VM {} that we don't know the state of", vm);
                     for (FenceBuilder fb : fenceBuilders) {
                         Boolean result = fb.fenceOff(vm, host);
-                        logger.info("Fencer " + fb.getName() + " returned " + result);
+                        logger.info("Fencer {} returned {}", fb.getName(), result);
                         if (result != null && result) {
                             fenced = true;
                             break;
                         }
                     }
-
                 } else if (!alive) {
                     fenced = true;
                 } else {
-                    logger.debug("VM {} is found to be alive by {}", vm, investigator.getName());
+                    logger.debug("VM {} is found to be alive by {} on host {}", vm, investigator.getName(), host);
                     if (host.getStatus() == Status.Up) {
-                        logger.info(vm + " is alive and host is up. No need to restart it.");
+                        logger.info("{} is alive and host {} is up. No need to restart it.", vm, host);
                         return null;
                     } else {
-                        logger.debug("Rescheduling because the host is not up but the vm is alive");
+                        logger.debug("Rescheduling because the host {} is not up but the vm {} is alive", host, vm);
                         return (System.currentTimeMillis() >> 10) + _investigateRetryInterval;
                     }
                 }
 
                 if (!fenced) {
-                    logger.debug("We were unable to fence off the VM " + vm);
+                    logger.debug("We were unable to fence off the VM {}", vm);
                     _alertMgr.sendAlert(alertType, vm.getDataCenterId(), vm.getPodIdToDeployIn(), "Unable to restart " + vm.getHostName() +
                         " which was running on host " + hostDesc, "Insufficient capacity to restart VM, name: " + vm.getHostName() + ", id: " + vmId +
                         " which was running on host " + hostDesc);
@@ -728,15 +763,15 @@ protected Long restart(final HaWorkVO work) {
 
         if (!ForceHA.value() && !vm.isHaEnabled()) {
             if (logger.isDebugEnabled()) {
-                logger.debug("VM is not HA enabled so we're done.");
+                logger.debug("VM {} is not HA enabled so we're done.", vm);
             }
             return null; // VM doesn't require HA
         }
 
-        if ((host == null || host.getRemoved() != null || host.getState() != Status.Up)
+        if ((host.getRemoved() != null || host.getState() != Status.Up)
                  && !volumeMgr.canVmRestartOnAnotherServer(vm.getId())) {
             if (logger.isDebugEnabled()) {
-                logger.debug("VM can not restart on another server.");
+                logger.debug("VM {} can not restart on another server.", vm);
             }
             return null;
         }
@@ -777,13 +812,13 @@ protected Long restart(final HaWorkVO work) {
             if (started != null && started.getState() == VirtualMachine.State.Running) {
                 String message = String.format("HA starting VM: %s (%s)", started.getHostName(), started.getInstanceName());
                 HostVO hostVmHasStarted = _hostDao.findById(started.getHostId());
-                logger.info(String.format("HA is now restarting %s on %s", started, hostVmHasStarted));
+                logger.info("HA is now restarting {} on {}", started, hostVmHasStarted);
                 _alertMgr.sendAlert(alertType, vm.getDataCenterId(), vm.getPodIdToDeployIn(), message, message);
                 return null;
             }
 
             if (logger.isDebugEnabled()) {
-                logger.debug("Rescheduling VM " + vm.toString() + " to try again in " + _restartRetryInterval);
+                logger.debug("Rescheduling VM {} to try again in {}", vm.toString(), _restartRetryInterval);
             }
         } catch (final InsufficientCapacityException e) {
             logger.warn("Unable to restart " + vm.toString() + " due to " + e.getMessage());
@@ -815,6 +850,9 @@ protected boolean checkAndCancelWorkIfNeeded(final HaWorkVO work) {
         if (!CancellableWorkReasonTypes.contains(work.getReasonType())) {
             return false;
         }
+        if (isHostHAInspectionInProgress(work.getHostId())) {
+            return false;
+        }
         Status hostStatus = investigate(work.getHostId());
         if (!Status.Up.equals(hostStatus)) {
             return false;
@@ -825,13 +863,14 @@ protected boolean checkAndCancelWorkIfNeeded(final HaWorkVO work) {
     }
 
     public Long migrate(final HaWorkVO work) {
+        logger.debug("MIGRATE with HA WORK");
         long vmId = work.getInstanceId();
         long srcHostId = work.getHostId();
         HostVO srcHost = _hostDao.findById(srcHostId);
 
         VMInstanceVO vm = _instanceDao.findById(vmId);
         if (vm == null) {
-            logger.info("Unable to find vm: " + vmId + ", skipping migrate.");
+            logger.info("Unable to find vm: {}, skipping migrate.", vmId);
             return null;
         }
         if (checkAndCancelWorkIfNeeded(work)) {
@@ -840,11 +879,11 @@ public Long migrate(final HaWorkVO work) {
         logger.info("Migration attempt: for {} from {}. Starting attempt: {}/{} times.", vm, srcHost, 1 + work.getTimesTried(), _maxRetries);
 
         if (VirtualMachine.State.Stopped.equals(vm.getState())) {
-            logger.info(String.format("vm %s is Stopped, skipping migrate.", vm));
+            logger.info("vm {} is Stopped, skipping migrate.", vm);
             return null;
         }
         if (VirtualMachine.State.Running.equals(vm.getState()) && srcHostId != vm.getHostId()) {
-            logger.info(String.format("VM %s is running on a different host %s, skipping migration", vm, vm.getHostId()));
+            logger.info("VM {} is running on a different host {}, skipping migration", vm, vm.getHostId());
             return null;
         }
 
@@ -879,7 +918,7 @@ public boolean scheduleDestroy(VMInstanceVO vm, long hostId, ReasonType reasonTy
         final HaWorkVO work = new HaWorkVO(vm.getId(), vm.getType(), WorkType.Destroy, Step.Scheduled, hostId, vm.getState(), 0, vm.getUpdated(), reasonType);
         _haDao.persist(work);
         if (logger.isDebugEnabled()) {
-            logger.debug("Scheduled " + work.toString());
+            logger.debug("{}}", work.toString());
         }
         wakeupWorkers();
         return true;
@@ -897,7 +936,7 @@ private void stopVMWithCleanup(VirtualMachine vm, VirtualMachine.State state) th
     }
 
     private void destroyVM(VirtualMachine vm, boolean expunge) throws OperationTimedoutException, AgentUnavailableException {
-        logger.info("Destroying " + vm.toString());
+        logger.info("Destroying {}", vm.toString());
         if (VirtualMachine.Type.ConsoleProxy.equals(vm.getType())) {
             consoleProxyManager.destroyProxy(vm.getId());
         } else if (VirtualMachine.Type.SecondaryStorageVm.equals(vm.getType())) {
@@ -908,9 +947,10 @@ private void destroyVM(VirtualMachine vm, boolean expunge) throws OperationTimed
     }
 
     protected Long destroyVM(final HaWorkVO work) {
+        logger.debug("DESTROY with HA WORK");
         final VirtualMachine vm = _itMgr.findById(work.getInstanceId());
         if (vm == null) {
-            logger.info("No longer can find VM " + work.getInstanceId() + ". Throwing away " + work);
+            logger.info("No longer can find VM {}. Throwing away {}",  work.getInstanceId(), work);
             return null;
         }
         if (checkAndCancelWorkIfNeeded(work)) {
@@ -944,20 +984,21 @@ protected Long destroyVM(final HaWorkVO work) {
     }
 
     protected Long stopVM(final HaWorkVO work) throws ConcurrentOperationException {
+        logger.debug("STOP with HA WORK");
         VirtualMachine vm = _itMgr.findById(work.getInstanceId());
         if (vm == null) {
-            logger.info("No longer can find VM " + work.getInstanceId() + ". Throwing away " + work);
+            logger.info("No longer can find VM {}. Throwing away {}", work.getInstanceId(), work);
             work.setStep(Step.Done);
             return null;
         }
         if (checkAndCancelWorkIfNeeded(work)) {
             return null;
         }
-        logger.info("Stopping " + vm);
+        logger.info("Stopping {}", vm);
         try {
             if (work.getWorkType() == WorkType.Stop) {
                 _itMgr.advanceStop(vm.getUuid(), false);
-                logger.info("Successfully stopped " + vm);
+                logger.info("Successfully stopped {}", vm);
                 return null;
             } else if (work.getWorkType() == WorkType.CheckStop) {
                 if ((vm.getState() != work.getPreviousState()) || vm.getUpdated() != work.getUpdateTime() || vm.getHostId() == null ||
@@ -969,7 +1010,7 @@ protected Long stopVM(final HaWorkVO work) throws ConcurrentOperationException {
                 }
 
                 _itMgr.advanceStop(vm.getUuid(), false);
-                logger.info("Stop for " + vm + " was successful");
+                logger.info("Stop for {} was successful", vm);
                 return null;
             } else if (work.getWorkType() == WorkType.ForceStop) {
                 if ((vm.getState() != work.getPreviousState()) || vm.getUpdated() != work.getUpdateTime() || vm.getHostId() == null ||
@@ -981,13 +1022,13 @@ protected Long stopVM(final HaWorkVO work) throws ConcurrentOperationException {
                 }
 
                 _itMgr.advanceStop(vm.getUuid(), true);
-                logger.info("Stop for " + vm + " was successful");
+                logger.info("Stop for {} was successful", vm);
                 return null;
             } else {
                 assert false : "Who decided there's other steps but didn't modify the guy who does the work?";
             }
         } catch (final ResourceUnavailableException e) {
-            logger.debug("Agnet is not available" + e.getMessage());
+            logger.debug("Agent is not available" + e.getMessage());
         } catch (OperationTimedoutException e) {
             logger.debug("operation timed out: " + e.getMessage());
         }
@@ -1043,7 +1084,8 @@ private void processWork(final HaWorkVO work) {
         try {
             if (vm != null && !VmHaEnabled.valueIn(vm.getDataCenterId())) {
                 if (logger.isDebugEnabled()) {
-                    logger.debug(String.format("VM high availability manager is disabled, rescheduling the HA work %s, for the VM %s (id) to retry later in case VM high availability manager is enabled on retry attempt", work, vm.getName(), vm.getId()));
+                    logger.debug("VM high availability manager is disabled, rescheduling the HA work {} for the VM {} ({}) " +
+                            "to retry later in case VM high availability manager is enabled on retry attempt", work, vm.getName(), vm.getId());
                 }
                 long nextTime = getRescheduleTime(wt);
                 rescheduleWork(work, nextTime);
@@ -1065,13 +1107,13 @@ private void processWork(final HaWorkVO work) {
             }
 
             if (nextTime == null) {
-                logger.info("Completed work " + work + ". Took " + (work.getTimesTried() + 1) + "/" + _maxRetries + " attempts.");
+                logger.info("Completed work {}. Took {}/{} attempts.", work, work.getTimesTried() + 1, _maxRetries);
                 work.setStep(Step.Done);
             } else {
                 rescheduleWork(work, nextTime.longValue());
             }
         } catch (Exception e) {
-            logger.warn("Encountered unhandled exception during HA process, reschedule work", e);
+            logger.warn("Encountered unhandled exception during HA process, reschedule work {}", work, e);
 
             long nextTime = getRescheduleTime(wt);
             rescheduleWork(work, nextTime);
@@ -1085,11 +1127,11 @@ private void processWork(final HaWorkVO work) {
         } finally {
             if (!Step.Done.equals(work.getStep())) {
                 if (work.getTimesTried() >= _maxRetries) {
-                    logger.warn("Giving up, retried max " + work.getTimesTried() + "/" + _maxRetries + " times for work: " + work);
+                    logger.warn("Giving up, retried max {}/{} times for work: {}", work.getTimesTried(), _maxRetries, work);
                     work.setStep(Step.Done);
                 } else {
-                    logger.warn("Rescheduling work " + work + " to try again at " + new Date(work.getTimeToTry() << 10) +
-                            ". Finished attempt " + work.getTimesTried() + "/" + _maxRetries + " times.");
+                    logger.warn("Rescheduling work {} to try again at {}. Finished attempt {}/{} times.",
+                            work, new Date(work.getTimeToTry() << 10), work.getTimesTried(), _maxRetries);
                 }
             }
             _haDao.update(work.getId(), work);
diff --git a/server/src/main/java/com/cloud/ha/KVMFencer.java b/server/src/main/java/com/cloud/ha/KVMFencer.java
index b51ed00b028c..4a6606b09cc3 100644
--- a/server/src/main/java/com/cloud/ha/KVMFencer.java
+++ b/server/src/main/java/com/cloud/ha/KVMFencer.java
@@ -74,7 +74,7 @@ public KVMFencer() {
     @Override
     public Boolean fenceOff(VirtualMachine vm, Host host) {
         if (host.getHypervisorType() != HypervisorType.KVM && host.getHypervisorType() != HypervisorType.LXC) {
-            logger.warn("Don't know how to fence non kvm hosts " + host.getHypervisorType());
+            logger.warn("Don't know how to fence non kvm hosts {}", host.getHypervisorType());
             return null;
         }
 
@@ -97,11 +97,8 @@ public Boolean fenceOff(VirtualMachine vm, Host host) {
                 FenceAnswer answer;
                 try {
                     answer = (FenceAnswer)_agentMgr.send(h.getId(), fence);
-                } catch (AgentUnavailableException e) {
-                    logger.info("Moving on to the next host because " + h.toString() + " is unavailable", e);
-                    continue;
-                } catch (OperationTimedoutException e) {
-                    logger.info("Moving on to the next host because " + h.toString() + " is unavailable", e);
+                } catch (AgentUnavailableException | OperationTimedoutException e) {
+                    logger.info("Moving on to the next host because {} is unavailable", h.toString(), e);
                     continue;
                 }
                 if (answer != null && answer.getResult()) {
@@ -115,7 +112,7 @@ public Boolean fenceOff(VirtualMachine vm, Host host) {
                             "Fencing off host " + host.getId() + " did not succeed after asking " + i + " hosts. " +
                             "Check Agent logs for more information.");
 
-        logger.error("Unable to fence off " + vm.toString() + " on " + host.toString());
+        logger.error("Unable to fence off {} on {}", vm.toString(), host.toString());
 
         return false;
     }
diff --git a/server/src/main/java/com/cloud/ha/ManagementIPSystemVMInvestigator.java b/server/src/main/java/com/cloud/ha/ManagementIPSystemVMInvestigator.java
index 0972f2451afb..d14c4baafb34 100644
--- a/server/src/main/java/com/cloud/ha/ManagementIPSystemVMInvestigator.java
+++ b/server/src/main/java/com/cloud/ha/ManagementIPSystemVMInvestigator.java
@@ -104,7 +104,7 @@ public boolean isVmAlive(VirtualMachine vm, Host host) throws UnknownVM {
     }
 
     @Override
-    public Status isAgentAlive(Host agent) {
+    public Status getHostAgentStatus(Host agent) {
         return null;
     }
 
diff --git a/server/src/main/java/com/cloud/ha/UserVmDomRInvestigator.java b/server/src/main/java/com/cloud/ha/UserVmDomRInvestigator.java
index 7d063b3088e4..82074460f2af 100644
--- a/server/src/main/java/com/cloud/ha/UserVmDomRInvestigator.java
+++ b/server/src/main/java/com/cloud/ha/UserVmDomRInvestigator.java
@@ -103,7 +103,7 @@ public boolean isVmAlive(VirtualMachine vm, Host host) throws UnknownVM {
     }
 
     @Override
-    public Status isAgentAlive(Host agent) {
+    public Status getHostAgentStatus(Host agent) {
         if (logger.isDebugEnabled()) {
             logger.debug("checking if agent ({}) is alive", agent);
         }
diff --git a/server/src/main/java/com/cloud/ha/XenServerInvestigator.java b/server/src/main/java/com/cloud/ha/XenServerInvestigator.java
index 5482a7f148e6..fea44c97ab58 100644
--- a/server/src/main/java/com/cloud/ha/XenServerInvestigator.java
+++ b/server/src/main/java/com/cloud/ha/XenServerInvestigator.java
@@ -46,7 +46,7 @@ protected XenServerInvestigator() {
     }
 
     @Override
-    public Status isAgentAlive(Host agent) {
+    public Status getHostAgentStatus(Host agent) {
         if (agent.getHypervisorType() != HypervisorType.XenServer) {
             return null;
         }
@@ -74,7 +74,7 @@ public Status isAgentAlive(Host agent) {
 
     @Override
     public boolean isVmAlive(VirtualMachine vm, Host host) throws UnknownVM {
-        Status status = isAgentAlive(host);
+        Status status = getHostAgentStatus(host);
         if (status == null) {
             throw new UnknownVM();
         }
diff --git a/server/src/main/java/org/apache/cloudstack/ha/HAManager.java b/server/src/main/java/org/apache/cloudstack/ha/HAManager.java
index 8282c621c1e3..068230c6673d 100644
--- a/server/src/main/java/org/apache/cloudstack/ha/HAManager.java
+++ b/server/src/main/java/org/apache/cloudstack/ha/HAManager.java
@@ -67,11 +67,16 @@ public interface HAManager extends HAConfigManager {
             "The number of pending fence operations per management server. This setting determines the size of the size of the FENCE queue.", true);
 
     boolean transitionHAState(final HAConfig.Event event, final HAConfig haConfig);
+
     HAProvider getHAProvider(final String name);
+
     HAResourceCounter getHACounter(final Long resourceId, final HAResource.ResourceType resourceType);
+
     void purgeHACounter(final Long resourceId, final HAResource.ResourceType resourceType);
 
     boolean isHAEligible(final HAResource resource);
+
     Boolean isVMAliveOnHost(final Host host) throws Investigator.UnknownVM;
-    Status getHostStatus(final Host host);
+
+    Status getHostStatusFromHAConfig(final Host host);
 }
diff --git a/server/src/main/java/org/apache/cloudstack/ha/HAManagerImpl.java b/server/src/main/java/org/apache/cloudstack/ha/HAManagerImpl.java
index a016be5c6e32..93b237ec20a9 100644
--- a/server/src/main/java/org/apache/cloudstack/ha/HAManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/ha/HAManagerImpl.java
@@ -139,9 +139,7 @@ public synchronized HAResourceCounter getHACounter(final Long resourceId, final
 
     public synchronized void purgeHACounter(final Long resourceId, final HAResource.ResourceType resourceType) {
         final String key = resourceCounterKey(resourceId, resourceType);
-        if (haCounterMap.containsKey(key)) {
-            haCounterMap.remove(key);
-        }
+        haCounterMap.remove(key);
     }
 
     public boolean transitionHAState(final HAConfig.Event event, final HAConfig haConfig) {
@@ -248,6 +246,7 @@ public boolean isHAEnabledForZone(final HAResource resource) {
     }
 
     private boolean isHAEnabledForCluster(final HAResource resource) {
+        // HA is enabled by default when cluster details doesn't exist
         if (resource == null || resource.getClusterId() == null) {
             return true;
         }
@@ -259,14 +258,10 @@ private boolean isHAEligibleForResource(final HAResource resource) {
         if (resource == null || resource.getId() < 1L) {
             return false;
         }
-        HAResource.ResourceType resourceType = null;
-        if (resource instanceof Host) {
-            resourceType = HAResource.ResourceType.Host;
-        }
-        if (resourceType == null) {
+        if (!(resource instanceof Host)) {
             return false;
         }
-        final HAConfig haConfig = haConfigDao.findHAResource(resource.getId(), resourceType);
+        final HAConfig haConfig = haConfigDao.findHAResource(resource.getId(), HAResource.ResourceType.Host);
         return haConfig != null && haConfig.isEnabled()
                 && haConfig.getState() != HAConfig.HAState.Disabled
                 && haConfig.getState() != HAConfig.HAState.Ineligible;
@@ -317,19 +312,23 @@ public Boolean isVMAliveOnHost(final Host host) throws Investigator.UnknownVM {
         throw new Investigator.UnknownVM();
     }
 
-    public Status getHostStatus(final Host host) {
+    public Status getHostStatusFromHAConfig(final Host host) {
         final HAConfig haConfig = haConfigDao.findHAResource(host.getId(), HAResource.ResourceType.Host);
-        if (haConfig != null) {
-            if (haConfig.getState() == HAConfig.HAState.Fenced) {
-                logger.debug("HA: Agent [{}] is available/suspect/checking Up.", host);
-                return Status.Down;
-            } else if (haConfig.getState() == HAConfig.HAState.Degraded || haConfig.getState() == HAConfig.HAState.Recovering || haConfig.getState() == HAConfig.HAState.Fencing) {
-                logger.debug("HA: Agent [{}] is disconnected. State: {}, {}.", host, haConfig.getState(), haConfig.getState().getDescription());
-                return Status.Disconnected;
-            }
-            return Status.Up;
+        if (haConfig == null) {
+            logger.warn("HA: Agent [{}] config is not available.", host);
+            return Status.Unknown;
         }
-        return Status.Unknown;
+        if (haConfig.getState() == HAConfig.HAState.Fenced) {
+            logger.debug("HA: Agent [{}] is fenced.", host);
+            return Status.Down;
+        }
+        if (haConfig.getState() == HAConfig.HAState.Degraded || haConfig.getState() == HAConfig.HAState.Recovering || haConfig.getState() == HAConfig.HAState.Fencing) {
+            logger.debug("HA: Agent [{}] is disconnected. State: {}, {}.", host, haConfig.getState(), haConfig.getState().getDescription());
+            return Status.Disconnected;
+        }
+
+        logger.debug("HA: Agent [{}] is considered Up (HA state can be Available/Suspect/Checking/Recovered). State: {}, {}.", host, haConfig.getState(), haConfig.getState().getDescription());
+        return Status.Up;
     }
 
     //////////////////////////////////////////////////////
@@ -511,9 +510,14 @@ private boolean processHAStateChange(final HAConfig haConfig, final HAConfig.HAS
 
         // Attempt recovery
         if (newState == HAConfig.HAState.Recovering) {
-            if (counter.getRecoveryCounter() >= (Long) (haProvider.getConfigValue(HAProviderConfig.MaxRecoveryAttempts, resource))) {
+            long recoveryCounter = counter.getRecoveryCounter();
+            Long maxRecoveryAttempts = (Long) (haProvider.getConfigValue(HAProviderConfig.MaxRecoveryAttempts, resource));
+            if (recoveryCounter >= maxRecoveryAttempts) {
+                logger.debug("Recovery attempts have reached the configured limit: {} for the resource [{}].", maxRecoveryAttempts, resource);
                 return false;
             }
+
+            logger.debug("Recovery attempt #{} for the resource [{}]. Max recovery attempts configured is {}.", recoveryCounter + 1, resource, maxRecoveryAttempts);
             final RecoveryTask task = ComponentContext.inject(new RecoveryTask(resource, haProvider, haConfig,
                     HAProviderConfig.RecoveryTimeout, recoveryExecutor));
             final Future<Boolean> recoveryFuture = recoveryExecutor.submit(task);
@@ -536,20 +540,20 @@ public boolean preStateTransitionEvent(final HAConfig.HAState oldState, final HA
             return false;
         }
 
-        logger.debug(String.format("HA state pre-transition:: new state=[%s], old state=[%s], for resource id=[%s], status=[%s], ha config state=[%s]." , newState, oldState, haConfig.getResourceId(), status, haConfig.getState()));
+        logger.debug("HA state pre-transition:: new state=[{}], old state=[{}], for resource id=[{}], status=[{}], ha config state=[{}].", newState, oldState, haConfig.getResourceId(), status, haConfig.getState());
 
         if (status && haConfig.getState() != newState) {
-            logger.warn(String.format("HA state pre-transition:: HA state is not equal to transition state, HA state=[%s], new state=[%s].", haConfig.getState(), newState));
+            logger.warn("HA state pre-transition:: HA state is not equal to transition state, HA state=[{}], new state=[{}].", haConfig.getState(), newState);
         }
         return processHAStateChange(haConfig, newState, status);
     }
 
     @Override
     public boolean postStateTransitionEvent(final StateMachine2.Transition<HAConfig.HAState, HAConfig.Event> transition, final HAConfig haConfig, final boolean status, final Object opaque) {
-        logger.debug(String.format("HA state post-transition:: new state=[%s], old state=[%s], for resource id=[%s], status=[%s], ha config state=[%s].", transition.getToState(), transition.getCurrentState(),  haConfig.getResourceId(), status, haConfig.getState()));
+        logger.debug("HA state post-transition:: new state=[{}], old state=[{}], for resource id=[{}], status=[{}], ha config state=[{}].", transition.getToState(), transition.getCurrentState(), haConfig.getResourceId(), status, haConfig.getState());
 
         if (status && haConfig.getState() != transition.getToState()) {
-            logger.warn(String.format("HA state post-transition:: HA state is not equal to transition state, HA state=[%s], new state=[%s].", haConfig.getState(), transition.getToState()));
+            logger.warn("HA state post-transition:: HA state is not equal to transition state, HA state=[{}], new state=[{}].", haConfig.getState(), transition.getToState());
         }
         return processHAStateChange(haConfig, transition.getToState(), status);
     }
@@ -645,7 +649,7 @@ protected void runInContext() {
             try {
                 logger.debug("HA health check task is running...");
 
-                final List<HAConfig> haConfigList = new ArrayList<HAConfig>(haConfigDao.listAll());
+                final List<HAConfig> haConfigList = new ArrayList<>(haConfigDao.listAll());
                 for (final HAConfig haConfig : haConfigList) {
                     currentHaConfig = haConfig;
 
@@ -676,8 +680,8 @@ protected void runInContext() {
                                     HAProviderConfig.HealthCheckTimeout, healthCheckExecutor));
                             healthCheckExecutor.submit(task);
                             break;
-                    default:
-                        break;
+                        default:
+                            break;
                     }
 
                     final HAResourceCounter counter = getHACounter(haConfig.getResourceId(), haConfig.getResourceType());
@@ -695,16 +699,22 @@ protected void runInContext() {
                     }
 
                     if (haConfig.getState() == HAConfig.HAState.Recovering) {
-                        if (counter.getRecoveryCounter() >= (Long) (haProvider.getConfigValue(HAProviderConfig.MaxRecoveryAttempts, resource))) {
+                        long recoveryCounter = counter.getRecoveryCounter();
+                        Long maxRecoveryAttempts = (Long) (haProvider.getConfigValue(HAProviderConfig.MaxRecoveryAttempts, resource));
+                        if (recoveryCounter >= maxRecoveryAttempts) {
+                            logger.debug("Recovery attempts have reached the max limit: {} for the resource [{}].", maxRecoveryAttempts, resource);
                             transitionHAState(HAConfig.Event.RecoveryOperationThresholdExceeded, haConfig);
                         } else {
+                            logger.debug("Retry recovery for the resource [{}]. Max recovery attempts configured is {}.", resource, maxRecoveryAttempts);
                             transitionHAState(HAConfig.Event.RetryRecovery, haConfig);
                         }
                     }
 
                     if (haConfig.getState() == HAConfig.HAState.Recovered) {
                         counter.markRecoveryStarted();
-                        if (counter.canExitRecovery((Long)(haProvider.getConfigValue(HAProviderConfig.RecoveryWaitTimeout, resource)))) {
+                        Long recoveryWaitTimeout = (Long)(haProvider.getConfigValue(HAProviderConfig.RecoveryWaitTimeout, resource));
+                        logger.debug("Recovery started for the resource [{}], wait period configured to become Available is {} secs", resource, recoveryWaitTimeout);
+                        if (counter.canExitRecovery(recoveryWaitTimeout)) {
                             if (transitionHAState(HAConfig.Event.RecoveryWaitPeriodTimeout, haConfig)) {
                                 counter.markRecoveryCompleted();
                             }
@@ -717,7 +727,7 @@ protected void runInContext() {
                 }
             } catch (Throwable t) {
                 if (currentHaConfig != null) {
-                    logger.error(String.format("Error trying to perform health checks in HA manager [%s].", currentHaConfig.getHaProvider()), t);
+                    logger.error("Error trying to perform health checks in HA manager [{}].", currentHaConfig.getHaProvider(), t);
                 } else {
                     logger.error("Error trying to perform health checks in HA manager.", t);
                 }
diff --git a/server/src/main/java/org/apache/cloudstack/ha/HAResourceCounter.java b/server/src/main/java/org/apache/cloudstack/ha/HAResourceCounter.java
index f493f6926e07..23ebbaa6a7ae 100644
--- a/server/src/main/java/org/apache/cloudstack/ha/HAResourceCounter.java
+++ b/server/src/main/java/org/apache/cloudstack/ha/HAResourceCounter.java
@@ -36,6 +36,10 @@ public long getActivityCheckCounter() {
         return activityCheckCounter.get();
     }
 
+    public long getActivityCheckFailureCounter() {
+        return activityCheckFailureCounter.get();
+    }
+
     public long getRecoveryCounter() {
         return recoveryOperationCounter.get();
     }
@@ -66,7 +70,7 @@ public synchronized void resetSuspectTimestamp() {
         firstHealthCheckFailureTimestamp = null;
     }
 
-    public boolean hasActivityThresholdExceeded(final double failureRatio) {
+    public boolean hasActivityFailureThresholdExceeded(final double failureRatio) {
         return activityCheckFailureCounter.get() > (activityCheckCounter.get() * failureRatio);
     }
 
diff --git a/server/src/main/java/org/apache/cloudstack/ha/task/ActivityCheckTask.java b/server/src/main/java/org/apache/cloudstack/ha/task/ActivityCheckTask.java
index 5ddbac626bc5..e27d039b3927 100644
--- a/server/src/main/java/org/apache/cloudstack/ha/task/ActivityCheckTask.java
+++ b/server/src/main/java/org/apache/cloudstack/ha/task/ActivityCheckTask.java
@@ -62,6 +62,8 @@ public synchronized void processResult(boolean result, Throwable t) {
             return;
         }
 
+        long activityCounter = counter.getActivityCheckCounter();
+        logger.debug("Activity check #{}, result: {} for the resource {}. Max activity checks configured is {}", activityCounter + 1, result, getResource(), maxActivityChecks);
         counter.incrActivityCounter(!result);
 
         if (counter.getActivityCheckCounter() < maxActivityChecks) {
@@ -69,7 +71,9 @@ public synchronized void processResult(boolean result, Throwable t) {
             return;
         }
 
-        if (counter.hasActivityThresholdExceeded(activityCheckFailureRatio)) {
+        long activityCheckFailureCount = counter.getActivityCheckFailureCounter();
+        logger.debug("{} activity checks failed out of {} checks performed for the resource {}. Failure threshold configured is {}", activityCheckFailureCount, maxActivityChecks, getResource(), activityCheckFailureRatio);
+        if (counter.hasActivityFailureThresholdExceeded(activityCheckFailureRatio)) {
             haManager.transitionHAState(HAConfig.Event.ActivityCheckFailureOverThresholdRatio, haConfig);
         } else {
             if (haManager.transitionHAState(HAConfig.Event.ActivityCheckFailureUnderThresholdRatio, haConfig)) {
diff --git a/server/src/main/java/org/apache/cloudstack/ha/task/BaseHATask.java b/server/src/main/java/org/apache/cloudstack/ha/task/BaseHATask.java
index 6dc7b9281ba5..bf34d3514b62 100644
--- a/server/src/main/java/org/apache/cloudstack/ha/task/BaseHATask.java
+++ b/server/src/main/java/org/apache/cloudstack/ha/task/BaseHATask.java
@@ -97,7 +97,7 @@ public Boolean call() throws HACheckerException, HAFenceException, HARecoveryExc
                 result = future.get(timeout, TimeUnit.SECONDS);
             }
         } catch (InterruptedException | ExecutionException e) {
-            logger.warn("Exception occurred while running " + getTaskType() + " on a resource: " + e.getMessage(), e.getCause());
+            logger.warn("Exception occurred while running {} on a resource: {}", getTaskType(), e.getMessage(), e.getCause());
             throwable = e.getCause();
         } catch (TimeoutException e) {
             logger.trace("{} operation timed out for resource: {}", getTaskType(), resource);
diff --git a/server/src/test/java/com/cloud/ha/HighAvailabilityManagerImplTest.java b/server/src/test/java/com/cloud/ha/HighAvailabilityManagerImplTest.java
index 9274bd1ff085..626f2cda172f 100644
--- a/server/src/test/java/com/cloud/ha/HighAvailabilityManagerImplTest.java
+++ b/server/src/test/java/com/cloud/ha/HighAvailabilityManagerImplTest.java
@@ -35,6 +35,7 @@
 import org.apache.cloudstack.engine.subsystem.api.storage.DataStoreProviderManager;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
+import org.apache.cloudstack.ha.dao.HAConfigDao;
 import org.apache.cloudstack.managed.context.ManagedContext;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
@@ -118,6 +119,8 @@ public class HighAvailabilityManagerImplTest {
     @Mock
     ConfigurationDao _configDao;
     @Mock
+    HAConfigDao _haConfigDao;
+    @Mock
     VolumeOrchestrationService volumeMgr;
     @Mock
     ConsoleProxyManager consoleProxyManager;
@@ -362,7 +365,7 @@ public void investigateHostStatusSuccess() {
         investigators.add(investigator);
         highAvailabilityManager.setInvestigators(investigators);
         // Mock isAgentAlive to return host status as Down
-        Mockito.when(investigator.isAgentAlive(hostVO)).thenReturn(Status.Down);
+        Mockito.when(investigator.getHostAgentStatus(hostVO)).thenReturn(Status.Down);
 
         ConfigKey<Boolean> haEnabled = Mockito.mock(ConfigKey.class);
         highAvailabilityManager.VmHaEnabled = haEnabled;
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/redfish/RedfishClient.java b/utils/src/main/java/org/apache/cloudstack/utils/redfish/RedfishClient.java
index f9952b2c03bb..c5567cfa2e22 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/redfish/RedfishClient.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/redfish/RedfishClient.java
@@ -231,21 +231,19 @@ private HttpResponse executeHttpRequest(String url, HttpRequestBase httpReq) {
     }
 
     protected HttpResponse retryHttpRequest(String url, HttpRequestBase httpReq, HttpClient client) {
-        logger.warn(String.format("Failed to execute HTTP %s request [URL: %s]. Executing the request again.", httpReq.getMethod(), url));
+        logger.warn("Failed to execute HTTP {} request [URL: {}]. Executing the request again.", httpReq.getMethod(), url);
         HttpResponse response = null;
         for (int attempt = 1; attempt < redfishRequestMaxRetries + 1; attempt++) {
             try {
                 TimeUnit.SECONDS.sleep(WAIT_FOR_REQUEST_RETRY);
-                logger.debug(String.format("HTTP %s request retry attempt %d/%d [URL: %s].", httpReq.getMethod(), attempt, redfishRequestMaxRetries, url));
+                logger.debug("HTTP {} request retry attempt {}/{} [URL: {}].", httpReq.getMethod(), attempt, redfishRequestMaxRetries, url);
                 response = client.execute(httpReq);
                 break;
             } catch (IOException | InterruptedException e) {
                 if (attempt == redfishRequestMaxRetries) {
                     throw new RedfishException(String.format("Failed to execute HTTP %s request retry attempt %d/%d [URL: %s] due to exception %s", httpReq.getMethod(), attempt, redfishRequestMaxRetries,url, e));
                 } else {
-                    logger.warn(
-                            String.format("Failed to execute HTTP %s request retry attempt %d/%d [URL: %s] due to exception %s", httpReq.getMethod(), attempt, redfishRequestMaxRetries,
-                                    url, e));
+                    logger.warn("Failed to execute HTTP {} request retry attempt {}/{} [URL: {}] due to exception {}", httpReq.getMethod(), attempt, redfishRequestMaxRetries, url, e);
                 }
             }
         }
@@ -312,7 +310,7 @@ public void executeComputerSystemReset(String hostAddress, RedfishResetCmd reset
             throw new RedfishException(String.format("Failed to execute System power command for host by performing '%s' request on URL '%s' and host address '%s'. The expected HTTP status code is '%s' but it got '%s'.",
                     HttpPost.METHOD_NAME, url, hostAddress, EXPECTED_HTTP_STATUS, statusCode));
         }
-        logger.debug(String.format("Sending ComputerSystem.Reset Command '%s' to host '%s' with request '%s %s'", resetCommand, hostAddress, HttpPost.METHOD_NAME, url));
+        logger.debug("Sending ComputerSystem.Reset Command '{}' to host '{}' with request '{} {}'", resetCommand, hostAddress, HttpPost.METHOD_NAME, url);
     }
 
     /**
@@ -330,7 +328,7 @@ public String getSystemId(String hostAddress) {
 
         String systemId = processGetSystemIdResponse(response);
 
-        logger.debug(String.format("Retrieved System ID '%s' with request '%s: %s'", systemId, HttpGet.METHOD_NAME, url));
+        logger.debug("Retrieved System ID '{}' with request '{}: {}'", systemId, HttpGet.METHOD_NAME, url);
 
         return systemId;
     }
@@ -384,7 +382,7 @@ public RedfishPowerState getSystemPowerState(String hostAddress) {
         }
 
         RedfishPowerState powerState = processGetSystemRequestResponse(response);
-        logger.debug(String.format("Retrieved System power state '%s' with request '%s: %s'", powerState, HttpGet.METHOD_NAME, url));
+        logger.debug("Retrieved System power state '{}' with request '{}: {}'", powerState, HttpGet.METHOD_NAME, url);
         return powerState;
     }
 

From 470e95964bc74f14787b0b9459a267977c104ef0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Jandre?=
 <48719461+JoaoJandre@users.noreply.github.com>
Date: Mon, 11 May 2026 06:47:23 -0300
Subject: [PATCH 24/64] Change disk-only VM snapshot removal message (#11182)

* fix message

* check for hypervisor

* fix function being executed once
---
 ui/public/locales/en.json        |  1 +
 ui/public/locales/pt_BR.json     |  3 ++-
 ui/src/config/section/compute.js |  7 ++++++-
 ui/src/views/AutogenView.vue     | 14 ++++++++------
 4 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index f5b7cc647dc9..4bc005c0be11 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -3037,6 +3037,7 @@
 "message.action.unmanage.volume": "Please confirm that you want to unmanage the Volume.",
 "message.action.unmanage.volumes": "Please confirm that you want to unmanage the Volumes.",
 "message.action.vmsnapshot.delete": "Please confirm that you want to delete this Instance Snapshot. <br>Please notice that the Instance will be paused before the Snapshot deletion, and resumed after deletion, if it runs on KVM.",
+"message.action.vmsnapshot.disk-only.delete": "Please confirm that you want to delete this Instance Snapshot.",
 "message.activate.project": "Are you sure you want to activate this project?",
 "message.add.custom.action.parameters": "Parameters to be made available while running the custom action.",
 "message.add.egress.rule.failed": "Adding new egress rule failed.",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index c82a9e3c952d..e827b1f05fed 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -1914,7 +1914,8 @@
 "message.action.unmanage.instance": "Por favor, confirme que voc\u00ea deseja parar de gerenciar a inst\u00e2ncia.",
 "message.action.unmanage.instances": "Por favor, confirme que voc\u00ea deseja parar de gerenciar as inst\u00e2ncias.",
 "message.action.unmanage.virtualmachine": "Por favor, confirme que voc\u00ea deseja parar de gerenciar a VM.",
-"message.action.vmsnapshot.delete": "Por favor, confirme que voc\u00ea deseja excluir esta snapshot de VM.",
+"message.action.vmsnapshot.delete": "Por favor, confirme que voc\u00ea deseja excluir esta snapshot de VM. <br>Saiba que caso a instância execute em um hypervisor KVM, ela será pausada antes da deleç\u00e3o, e continuada após a deleç\u00e3o.",
+"message.action.vmsnapshot.disk-only.delete": "Por favor, confirme que voc\u00ea deseja excluir esta snapshot de VM.",
 "message.activate.project": "Voc\u00ea tem certeza que deseja ativar este projeto?",
 "message.add.egress.rule.failed": "Falha ao adicionar uma nova regra de sa\u00edda",
 "message.add.egress.rule.processing": "Adicionando uma nova regra de sa\u00edda...",
diff --git a/ui/src/config/section/compute.js b/ui/src/config/section/compute.js
index 63d0e365db92..d8605471d197 100644
--- a/ui/src/config/section/compute.js
+++ b/ui/src/config/section/compute.js
@@ -533,7 +533,12 @@ export default {
           api: 'deleteVMSnapshot',
           icon: 'delete-outlined',
           label: 'label.action.vmsnapshot.delete',
-          message: 'message.action.vmsnapshot.delete',
+          message: (record) => {
+            if (record.hypervisor !== 'KVM' || record.type === 'Disk') {
+              return 'message.action.vmsnapshot.disk-only.delete'
+            }
+            return 'message.action.vmsnapshot.delete'
+          },
           dataView: true,
           show: (record) => { return ['Ready', 'Expunging', 'Error'].includes(record.state) },
           args: ['vmsnapshotid'],
diff --git a/ui/src/views/AutogenView.vue b/ui/src/views/AutogenView.vue
index a5c0be3d4884..c3807724b5ef 100644
--- a/ui/src/views/AutogenView.vue
+++ b/ui/src/views/AutogenView.vue
@@ -216,7 +216,7 @@
           :spinning="actionLoading"
           v-ctrl-enter="handleSubmit"
         >
-          <span v-if="currentAction.message">
+          <span v-if="currentAction.messageString">
             <div v-if="selectedRowKeys.length > 0">
               <a-alert
                 v-if="['delete-outlined', 'DeleteOutlined', 'poweroff-outlined', 'PoweroffOutlined'].includes(currentAction.icon)"
@@ -228,7 +228,7 @@
                     style="padding-left: 5px"
                     v-html="`<b>${selectedRowKeys.length} ` + $t('label.items.selected') + `. </b>`"
                   />
-                  <span v-html="currentAction.message" />
+                  <span v-html="currentAction.messageString" />
                 </template>
               </a-alert>
               <a-alert
@@ -240,14 +240,14 @@
                     v-if="selectedRowKeys.length > 0"
                     v-html="`<b>${selectedRowKeys.length} ` + $t('label.items.selected') + `. </b>`"
                   />
-                  <span v-html="currentAction.message" />
+                  <span v-html="currentAction.messageString" />
                 </template>
               </a-alert>
             </div>
             <div v-else>
               <a-alert type="warning">
                 <template #message>
-                  <span v-html="currentAction.message" />
+                  <span v-html="currentAction.messageString" />
                 </template>
               </a-alert>
             </div>
@@ -1369,9 +1369,11 @@ export default {
       this.currentAction.paramFilters = []
       if ('message' in action) {
         if (typeof action.message === 'function') {
-          action.message = action.message(action.resource)
+          action.messageString = action.message(action.resource)
+        } else {
+          action.messageString = action.message
         }
-        action.message = Array.isArray(action.message) ? this.$t(...action.message) : this.$t(action.message)
+        action.messageString = Array.isArray(action.messageString) ? this.$t(...action.messageString) : this.$t(action.messageString)
       }
       this.getArgs(action, isGroupAction, paramFields)
       this.getFilters(action, isGroupAction, paramFields)

From e1521f139b026e1459a4993b75d9425ac508956d Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Mon, 11 May 2026 16:52:54 +0530
Subject: [PATCH 25/64] systemvmtemplate-register: correctly update existing
 template name in config (#12703)

---
 .../upgrade/SystemVmTemplateRegistration.java      |  2 +-
 .../upgrade/SystemVmTemplateRegistrationTest.java  | 14 ++++++++------
 2 files changed, 9 insertions(+), 7 deletions(-)

diff --git a/engine/schema/src/main/java/com/cloud/upgrade/SystemVmTemplateRegistration.java b/engine/schema/src/main/java/com/cloud/upgrade/SystemVmTemplateRegistration.java
index 292bafefbb65..2acb4138d234 100644
--- a/engine/schema/src/main/java/com/cloud/upgrade/SystemVmTemplateRegistration.java
+++ b/engine/schema/src/main/java/com/cloud/upgrade/SystemVmTemplateRegistration.java
@@ -1073,7 +1073,7 @@ protected void updateRegisteredTemplateDetails(Long templateId, MetadataTemplate
         }
         Hypervisor.HypervisorType hypervisorType = templateDetails.getHypervisorType();
         updateSystemVMEntries(templateId, hypervisorType);
-        updateConfigurationParams(hypervisorType, templateDetails.getName(), zoneId);
+        updateConfigurationParams(hypervisorType, templateVO.getName(), zoneId);
     }
 
     protected void updateTemplateUrlChecksumAndGuestOsId(VMTemplateVO templateVO,
diff --git a/engine/schema/src/test/java/com/cloud/upgrade/SystemVmTemplateRegistrationTest.java b/engine/schema/src/test/java/com/cloud/upgrade/SystemVmTemplateRegistrationTest.java
index 8028e78c9073..51db952eb613 100644
--- a/engine/schema/src/test/java/com/cloud/upgrade/SystemVmTemplateRegistrationTest.java
+++ b/engine/schema/src/test/java/com/cloud/upgrade/SystemVmTemplateRegistrationTest.java
@@ -570,18 +570,19 @@ public void updateRegisteredTemplateDetails_UpdatesTemplateSuccessfully() {
         SystemVmTemplateRegistration.MetadataTemplateDetails templateDetails =
                 Mockito.mock(SystemVmTemplateRegistration.MetadataTemplateDetails.class);
         VMTemplateVO templateVO = Mockito.mock(VMTemplateVO.class);
+        String templateName = "templateName";
+        when(templateVO.getName()).thenReturn(templateName);
         GuestOSVO guestOS = Mockito.mock(GuestOSVO.class);
 
         when(templateDetails.getGuestOs()).thenReturn("Debian");
         when(templateDetails.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
-        when(templateDetails.getName()).thenReturn("templateName");
         when(vmTemplateDao.findById(templateId)).thenReturn(templateVO);
         when(guestOSDao.findOneByDisplayName("Debian")).thenReturn(guestOS);
         when(guestOS.getId()).thenReturn(10L);
         when(vmTemplateDao.update(templateVO.getId(), templateVO)).thenReturn(true);
         doNothing().when(systemVmTemplateRegistration).updateSystemVMEntries(templateId, Hypervisor.HypervisorType.KVM);
         doNothing().when(systemVmTemplateRegistration).updateConfigurationParams(Hypervisor.HypervisorType.KVM,
-                "templateName", zoneId);
+                templateName, zoneId);
 
         systemVmTemplateRegistration.updateRegisteredTemplateDetails(templateId, templateDetails, zoneId);
 
@@ -590,7 +591,7 @@ public void updateRegisteredTemplateDetails_UpdatesTemplateSuccessfully() {
         verify(vmTemplateDao).update(templateVO.getId(), templateVO);
         verify(systemVmTemplateRegistration).updateSystemVMEntries(templateId, Hypervisor.HypervisorType.KVM);
         verify(systemVmTemplateRegistration).updateConfigurationParams(Hypervisor.HypervisorType.KVM,
-                "templateName", zoneId);
+                templateName, zoneId);
     }
 
     @Test
@@ -620,16 +621,17 @@ public void updateRegisteredTemplateDetails_SkipsGuestOSUpdateWhenNotFound() {
         SystemVmTemplateRegistration.MetadataTemplateDetails templateDetails =
                 Mockito.mock(SystemVmTemplateRegistration.MetadataTemplateDetails.class);
         VMTemplateVO templateVO = Mockito.mock(VMTemplateVO.class);
+        String templateName = "templateName";
+        when(templateVO.getName()).thenReturn(templateName);
 
         when(templateDetails.getGuestOs()).thenReturn("NonExistentOS");
         when(templateDetails.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
-        when(templateDetails.getName()).thenReturn("templateName");
         when(vmTemplateDao.findById(templateId)).thenReturn(templateVO);
         when(guestOSDao.findOneByDisplayName("NonExistentOS")).thenReturn(null);
         when(vmTemplateDao.update(templateVO.getId(), templateVO)).thenReturn(true);
         doNothing().when(systemVmTemplateRegistration).updateSystemVMEntries(templateId, Hypervisor.HypervisorType.KVM);
         doNothing().when(systemVmTemplateRegistration).updateConfigurationParams(Hypervisor.HypervisorType.KVM,
-                "templateName", zoneId);
+                templateName, zoneId);
 
         systemVmTemplateRegistration.updateRegisteredTemplateDetails(templateId, templateDetails, zoneId);
 
@@ -637,7 +639,7 @@ public void updateRegisteredTemplateDetails_SkipsGuestOSUpdateWhenNotFound() {
         verify(vmTemplateDao).update(templateVO.getId(), templateVO);
         verify(systemVmTemplateRegistration).updateSystemVMEntries(templateId, Hypervisor.HypervisorType.KVM);
         verify(systemVmTemplateRegistration).updateConfigurationParams(Hypervisor.HypervisorType.KVM,
-                "templateName", zoneId);
+                templateName, zoneId);
     }
 
     @Test

From a289bb0e6c0dafbcb3e6dec60e5d3933f5b61a95 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Mon, 11 May 2026 20:15:16 +0530
Subject: [PATCH 26/64] Update suse15 packaging spec, use qemu-ovmf-x86_64
 package instead of edk2-ovmf for agent (#13133)

* Update qemu-ovmf-x86_64 package in agent for suse instead of edk2-ovmf for agent

* Maintain separate properties file for suse15 (UEFI properties are different for suse15)

* Maintain separate packaging spec for suse15
---
 packaging/el8/cloud.spec              |   2 +-
 packaging/suse15                      |   1 -
 packaging/suse15/cloud-ipallocator.rc |   1 +
 packaging/suse15/cloud.limits         |   1 +
 packaging/suse15/cloud.spec           | 750 ++++++++++++++++++++++++++
 packaging/suse15/cloudstack-agent.te  |   1 +
 packaging/suse15/cloudstack-sccs      |   1 +
 packaging/suse15/filelimit.conf       |   1 +
 packaging/suse15/replace.properties   |  65 +++
 9 files changed, 821 insertions(+), 2 deletions(-)
 delete mode 120000 packaging/suse15
 create mode 120000 packaging/suse15/cloud-ipallocator.rc
 create mode 120000 packaging/suse15/cloud.limits
 create mode 100644 packaging/suse15/cloud.spec
 create mode 120000 packaging/suse15/cloudstack-agent.te
 create mode 120000 packaging/suse15/cloudstack-sccs
 create mode 120000 packaging/suse15/filelimit.conf
 create mode 100644 packaging/suse15/replace.properties

diff --git a/packaging/el8/cloud.spec b/packaging/el8/cloud.spec
index 3dee161bf274..13c0a36cb106 100644
--- a/packaging/el8/cloud.spec
+++ b/packaging/el8/cloud.spec
@@ -117,7 +117,7 @@ Requires: ipset
 Requires: perl
 Requires: rsync
 Requires: cifs-utils
-Requires: edk2-ovmf
+Requires: (edk2-ovmf or qemu-ovmf-x86_64)
 Requires: swtpm
 Requires: (python3-libvirt or python3-libvirt-python)
 Requires: (qemu-img or qemu-tools)
diff --git a/packaging/suse15 b/packaging/suse15
deleted file mode 120000
index 4dad90d45e0c..000000000000
--- a/packaging/suse15
+++ /dev/null
@@ -1 +0,0 @@
-el8
\ No newline at end of file
diff --git a/packaging/suse15/cloud-ipallocator.rc b/packaging/suse15/cloud-ipallocator.rc
new file mode 120000
index 000000000000..647598e6dc41
--- /dev/null
+++ b/packaging/suse15/cloud-ipallocator.rc
@@ -0,0 +1 @@
+../el8/cloud-ipallocator.rc
\ No newline at end of file
diff --git a/packaging/suse15/cloud.limits b/packaging/suse15/cloud.limits
new file mode 120000
index 000000000000..37be77e3acf2
--- /dev/null
+++ b/packaging/suse15/cloud.limits
@@ -0,0 +1 @@
+../el8/cloud.limits
\ No newline at end of file
diff --git a/packaging/suse15/cloud.spec b/packaging/suse15/cloud.spec
new file mode 100644
index 000000000000..cdfc5a72a34e
--- /dev/null
+++ b/packaging/suse15/cloud.spec
@@ -0,0 +1,750 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+%define __os_install_post %{nil}
+%global debug_package %{nil}
+%global __requires_exclude libc\\.so\\..*|libc\\.so\\.6\\(GLIBC_.*\\)
+%define _binaries_in_noarch_packages_terminate_build   0
+
+# DISABLE the post-percentinstall java repacking and line number stripping
+# we need to find a way to just disable the java repacking and line number stripping, but not the autodeps
+
+Name:      cloudstack
+Summary:   CloudStack IaaS Platform
+#http://fedoraproject.org/wiki/PackageNamingGuidelines#Pre-Release_packages
+%define _maventag %{_fullver}
+Release:   %{_rel}
+
+Version:   %{_ver}
+License:   ASL 2.0
+Vendor:    Apache CloudStack <dev@cloudstack.apache.org>
+Packager:  Apache CloudStack <dev@cloudstack.apache.org>
+Group:     System Environment/Libraries
+# FIXME do groups for every single one of the subpackages
+Source0:   %{name}-%{_maventag}.tgz
+BuildRoot: %{_tmppath}/%{name}-%{_maventag}-%{release}-build
+BuildArch: noarch
+
+BuildRequires: (java-11-openjdk-devel or java-17-openjdk-devel or java-21-openjdk-devel)
+#BuildRequires: ws-commons-util
+BuildRequires: jpackage-utils
+BuildRequires: gcc
+BuildRequires: glibc-devel
+BuildRequires: /usr/bin/mkisofs
+BuildRequires: python3-setuptools
+BuildRequires: wget
+BuildRequires: nodejs
+
+%description
+CloudStack is a highly-scalable elastic, open source,
+intelligent IaaS cloud implementation.
+
+%package management
+Summary:   CloudStack management server UI
+Requires: (java-17-openjdk or java-21-openjdk)
+Requires: (tzdata-java or timezone-java)
+Requires: python3
+Requires: bash
+Requires: gawk
+Requires: which
+Requires: file
+Requires: tar
+Requires: bzip2
+Requires: gzip
+Requires: unzip
+Requires: (/sbin/mount.nfs or /usr/sbin/mount.nfs)
+Requires: (openssh-clients or openssh)
+Requires: (nfs-utils or nfs-client)
+Requires: iproute
+Requires: wget
+Requires: (mysql or mariadb or mysql8.4)
+Requires: sudo
+Requires: /sbin/service
+Requires: /sbin/chkconfig
+Requires: /usr/bin/ssh-keygen
+Requires: (genisoimage or mkisofs or xorrisofs)
+Requires: ipmitool
+Requires: %{name}-common = %{_ver}
+Requires: (iptables-services or iptables)
+Requires: rng-tools
+Requires: (qemu-img or qemu-tools)
+Requires: python3-pip
+Requires: python3-six
+Requires: python3-protobuf
+Requires: python3-setuptools
+Requires: (libgcrypt > 1.8.3 or libgcrypt20)
+Group:     System Environment/Libraries
+%description management
+The CloudStack management server is the central point of coordination,
+management, and intelligence in CloudStack.
+
+%package common
+Summary: Apache CloudStack common files and scripts
+Requires: python3
+Group:   System Environment/Libraries
+%description common
+The Apache CloudStack files shared between agent and management server
+%global __requires_exclude libc\\.so\\..*|libc\\.so\\.6\\(GLIBC_.*\\)|^(libuuid\\.so\\.1|/usr/bin/python)$
+
+%package agent
+Summary: CloudStack Agent for KVM hypervisors
+Requires: (openssh-clients or openssh)
+Requires: (java-17-openjdk or java-21-openjdk)
+Requires: (tzdata-java or timezone-java)
+Requires: %{name}-common = %{_ver}
+Requires: libvirt
+Requires: libvirt-daemon-driver-storage-rbd
+Requires: ebtables
+Requires: iptables
+Requires: ethtool
+Requires: (net-tools or net-tools-deprecated)
+Requires: iproute
+Requires: ipset
+Requires: perl
+Requires: rsync
+Requires: cifs-utils
+Requires: (edk2-ovmf or qemu-ovmf-x86_64)
+Requires: swtpm
+Requires: (python3-libvirt or python3-libvirt-python)
+Requires: (qemu-img or qemu-tools)
+Requires: qemu-kvm
+Requires: cryptsetup
+Requires: rng-tools
+Requires: (libgcrypt > 1.8.3 or libgcrypt20)
+Requires: (selinux-tools if selinux-tools)
+Requires: sysstat
+Provides: cloud-agent
+Group: System Environment/Libraries
+%description agent
+The CloudStack agent for KVM hypervisors
+
+%package baremetal-agent
+Summary: CloudStack baremetal agent
+Requires: tftp-server
+Requires: xinetd
+Requires: syslinux
+Requires: chkconfig
+Requires: dhcp
+Requires: httpd
+Group:     System Environment/Libraries
+%description baremetal-agent
+The CloudStack baremetal agent
+
+%package usage
+Summary: CloudStack Usage calculation server
+Requires: (java-17-openjdk or java-21-openjdk)
+Requires: (tzdata-java or timezone-java)
+Group: System Environment/Libraries
+%description usage
+The CloudStack usage calculation service
+
+%package ui
+Summary: CloudStack UI
+Group: System Environment/Libraries
+%description ui
+The CloudStack UI
+
+%package marvin
+Summary: Apache CloudStack Marvin library
+Requires: python3-pip
+Requires: gcc
+Requires: python3-devel
+Requires: libffi-devel
+Requires: openssl-devel
+Group: System Environment/Libraries
+%description marvin
+Apache CloudStack Marvin library
+
+%package integration-tests
+Summary: Apache CloudStack Marvin integration tests
+Requires: %{name}-marvin = %{_ver}
+Group: System Environment/Libraries
+%description integration-tests
+Apache CloudStack Marvin integration tests
+
+%if "%{_ossnoss}" == "noredist"
+%package mysql-ha
+Summary: Apache CloudStack Balancing Strategy for MySQL
+Group: System Environmnet/Libraries
+%description mysql-ha
+Apache CloudStack Balancing Strategy for MySQL
+
+%endif
+
+%prep
+echo Doing CloudStack build
+
+%setup -q -n %{name}-%{_maventag}
+
+%build
+
+cp packaging/suse15/replace.properties build/replace.properties
+echo VERSION=%{_maventag} >> build/replace.properties
+echo PACKAGE=%{name} >> build/replace.properties
+touch build/gitrev.txt
+echo $(git rev-parse HEAD) > build/gitrev.txt
+
+if [ "%{_ossnoss}" == "NOREDIST" -o "%{_ossnoss}" == "noredist" ] ; then
+   echo "Adding noredist flag to the maven build"
+   FLAGS="$FLAGS -Dnoredist"
+fi
+
+if [ "%{_sim}" == "SIMULATOR" -o "%{_sim}" == "simulator" ] ; then
+   echo "Adding simulator flag to the maven build"
+   FLAGS="$FLAGS -Dsimulator"
+fi
+
+if [ \"%{_temp}\" != "" ]; then
+    echo "Adding flags to package requested templates"
+    FLAGS="$FLAGS `rpm --eval %{?_temp}`"
+fi
+
+mvn -Psystemvm,developer $FLAGS clean package
+cd ui && npm install && npm run build && cd ..
+
+%install
+[ ${RPM_BUILD_ROOT} != "/" ] && rm -rf ${RPM_BUILD_ROOT}
+# Common directories
+mkdir -p ${RPM_BUILD_ROOT}%{_bindir}
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/log/%{name}/agent
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/log/%{name}/ipallocator
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/cache/%{name}/management/work
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/cache/%{name}/management/temp
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/%{name}/mnt
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/%{name}/management
+mkdir -p ${RPM_BUILD_ROOT}%{_initrddir}
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/default
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/profile.d
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/sudoers.d
+
+# Common
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/scripts
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/vms
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/python-site
+mkdir -p ${RPM_BUILD_ROOT}/usr/bin
+cp -r scripts/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/scripts
+install -D systemvm/dist/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/vms/
+install python/lib/cloud_utils.py ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/python-site/cloud_utils.py
+cp -r python/lib/cloudutils ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/python-site/
+python3 -m py_compile ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/python-site/cloud_utils.py
+python3 -m compileall ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/python-site/cloudutils
+cp build/gitrev.txt ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/scripts
+cp packaging/suse15/cloudstack-sccs ${RPM_BUILD_ROOT}/usr/bin
+
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/scripts/network/cisco
+cp -r plugins/network-elements/cisco-vnmc/src/main/scripts/network/cisco/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/scripts/network/cisco
+
+# Management
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/lib
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/setup
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/cks/conf
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/log/%{name}/management
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/management
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/systemd/system/%{name}-management.service.d
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/run
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/setup/wheel
+
+# Setup Jetty
+ln -sf /etc/%{name}/management ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/conf
+ln -sf /var/log/%{name}/management ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/logs
+
+install -D client/target/utilities/bin/cloud-migrate-databases ${RPM_BUILD_ROOT}%{_bindir}/%{name}-migrate-databases
+install -D client/target/utilities/bin/cloud-set-guest-password ${RPM_BUILD_ROOT}%{_bindir}/%{name}-set-guest-password
+install -D client/target/utilities/bin/cloud-set-guest-sshkey ${RPM_BUILD_ROOT}%{_bindir}/%{name}-set-guest-sshkey
+install -D client/target/utilities/bin/cloud-setup-databases ${RPM_BUILD_ROOT}%{_bindir}/%{name}-setup-databases
+install -D client/target/utilities/bin/cloud-setup-encryption ${RPM_BUILD_ROOT}%{_bindir}/%{name}-setup-encryption
+install -D client/target/utilities/bin/cloud-setup-management ${RPM_BUILD_ROOT}%{_bindir}/%{name}-setup-management
+install -D client/target/utilities/bin/cloud-setup-baremetal ${RPM_BUILD_ROOT}%{_bindir}/%{name}-setup-baremetal
+install -D client/target/utilities/bin/cloud-sysvmadm ${RPM_BUILD_ROOT}%{_bindir}/%{name}-sysvmadm
+install -D client/target/utilities/bin/cloud-update-xenserver-licenses ${RPM_BUILD_ROOT}%{_bindir}/%{name}-update-xenserver-licenses
+# Bundle cmk in cloudstack-management
+wget https://github.com/apache/cloudstack-cloudmonkey/releases/latest/download/cmk.linux.x86-64 -O ${RPM_BUILD_ROOT}%{_bindir}/cmk
+chmod +x ${RPM_BUILD_ROOT}%{_bindir}/cmk
+
+cp -r client/target/utilities/scripts/db/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/setup
+cp -r plugins/integrations/kubernetes-service/src/main/resources/conf/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/cks/conf
+cp -r client/target/cloud-client-ui-%{_maventag}.jar ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/
+cp -r client/target/classes/META-INF/webapp ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/webapp
+cp ui/dist/config.json ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/management/
+cp -r ui/dist/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/webapp/
+rm -f ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/webapp/config.json
+ln -sf /etc/%{name}/management/config.json ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/webapp/config.json
+mv ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/cloud-client-ui-%{_maventag}.jar ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/lib/cloudstack-%{_maventag}.jar
+cp client/target/lib/*jar ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/lib/
+
+# Don't package the scripts in the management webapp
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/webapps/client/WEB-INF/classes/scripts
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/webapps/client/WEB-INF/classes/vms
+
+for name in db.properties server.properties log4j-cloud.xml environment.properties java.security.ciphers
+do
+  cp client/target/conf/$name ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/management/$name
+done
+
+ln -sf log4j-cloud.xml  ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/management/log4j2.xml
+
+install python/bindir/cloud-external-ipallocator.py ${RPM_BUILD_ROOT}%{_bindir}/%{name}-external-ipallocator.py
+install -D client/target/pythonlibs/jasypt-1.9.3.jar ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/lib/jasypt-1.9.3.jar
+install -D utils/target/cloud-utils-%{_maventag}-bundled.jar ${RPM_BUILD_ROOT}%{_datadir}/%{name}-common/lib/%{name}-utils.jar
+
+install -D packaging/suse15/cloud-ipallocator.rc ${RPM_BUILD_ROOT}%{_initrddir}/%{name}-ipallocator
+install -D packaging/suse15/cloud.limits ${RPM_BUILD_ROOT}%{_sysconfdir}/security/limits.d/cloud
+install -D packaging/suse15/filelimit.conf ${RPM_BUILD_ROOT}%{_sysconfdir}/systemd/system/%{name}-management.service.d
+install -D packaging/systemd/cloudstack-management.service ${RPM_BUILD_ROOT}%{_unitdir}/%{name}-management.service
+install -D packaging/systemd/cloudstack-management.default ${RPM_BUILD_ROOT}%{_sysconfdir}/default/%{name}-management
+install -D server/target/conf/cloudstack-sudoers ${RPM_BUILD_ROOT}%{_sysconfdir}/sudoers.d/%{name}-management
+touch ${RPM_BUILD_ROOT}%{_localstatedir}/run/%{name}-management.pid
+#install -D server/target/conf/cloudstack-catalina.logrotate ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}-catalina
+install -D server/target/conf/cloudstack-management.logrotate ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}-management
+
+install -D plugins/integrations/kubernetes-service/src/main/resources/conf/etcd-node.yml ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/cks/conf/etcd-node.yml
+install -D plugins/integrations/kubernetes-service/src/main/resources/conf/k8s-control-node.yml ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/cks/conf/k8s-control-node.yml
+install -D plugins/integrations/kubernetes-service/src/main/resources/conf/k8s-control-node-add.yml ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/cks/conf/k8s-control-node-add.yml
+install -D plugins/integrations/kubernetes-service/src/main/resources/conf/k8s-node.yml ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/cks/conf/k8s-node.yml
+
+# SystemVM template
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/templates/systemvm
+cp -r engine/schema/dist/systemvm-templates/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/templates/systemvm
+rm -rf ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/templates/systemvm/sha512sum.txt
+
+# Sample Extensions
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/extensions
+cp -r extensions/* ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/extensions
+ln -sf %{_sysconfdir}/%{name}/extensions ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/extensions
+
+# UI
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/ui
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-ui/
+cp -r client/target/classes/META-INF/webapp/WEB-INF ${RPM_BUILD_ROOT}%{_datadir}/%{name}-ui
+cp ui/dist/config.json ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/ui/
+cp -r ui/dist/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-ui/
+rm -f ${RPM_BUILD_ROOT}%{_datadir}/%{name}-ui/config.json
+ln -sf /etc/%{name}/ui/config.json ${RPM_BUILD_ROOT}%{_datadir}/%{name}-ui/config.json
+
+# Package mysql-connector-python (bundled to avoid dependency on external community repo)
+# Version 8.0.31 is the last version supporting Python 3.6 (EL8)
+wget -P ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/setup/wheel https://files.pythonhosted.org/packages/08/1f/42d74bae9dd6dcfec67c9ed0f3fa482b1ae5ac5f117ca82ab589ecb3ca19/mysql_connector_python-8.0.31-py2.py3-none-any.whl
+# Version 8.3.0 supports Python 3.8 to 3.12 (EL9, EL10)
+wget -P ${RPM_BUILD_ROOT}%{_datadir}/%{name}-management/setup/wheel https://files.pythonhosted.org/packages/53/ed/26a4b8cacb8852c6fd97d2d58a7f2591c41989807ea82bd8d9725a4e6937/mysql_connector_python-8.3.0-py2.py3-none-any.whl
+
+chmod 440 ${RPM_BUILD_ROOT}%{_sysconfdir}/sudoers.d/%{name}-management
+chmod 770 ${RPM_BUILD_ROOT}%{_localstatedir}/%{name}/mnt
+chmod 770 ${RPM_BUILD_ROOT}%{_localstatedir}/%{name}/management
+chmod 770 ${RPM_BUILD_ROOT}%{_localstatedir}/cache/%{name}/management/work
+chmod 770 ${RPM_BUILD_ROOT}%{_localstatedir}/cache/%{name}/management/temp
+chmod 770 ${RPM_BUILD_ROOT}%{_localstatedir}/log/%{name}/management
+chmod 770 ${RPM_BUILD_ROOT}%{_localstatedir}/log/%{name}/agent
+
+# KVM Agent
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/agent
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/log/%{name}/agent
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-agent/lib
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-agent/plugins
+install -D packaging/systemd/cloudstack-agent.service ${RPM_BUILD_ROOT}%{_unitdir}/%{name}-agent.service
+install -D packaging/systemd/cloudstack-rolling-maintenance@.service ${RPM_BUILD_ROOT}%{_unitdir}/%{name}-rolling-maintenance@.service
+install -D packaging/systemd/cloudstack-agent.default ${RPM_BUILD_ROOT}%{_sysconfdir}/default/%{name}-agent
+install -D agent/target/transformed/agent.properties ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/agent/agent.properties
+install -D agent/target/transformed/uefi.properties ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/agent/uefi.properties
+install -D agent/target/transformed/environment.properties ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/agent/environment.properties
+install -D agent/target/transformed/log4j-cloud.xml ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/agent/log4j-cloud.xml
+install -D agent/target/transformed/cloud-setup-agent ${RPM_BUILD_ROOT}%{_bindir}/%{name}-setup-agent
+install -D agent/target/transformed/cloudstack-agent-upgrade ${RPM_BUILD_ROOT}%{_bindir}/%{name}-agent-upgrade
+install -D agent/target/transformed/cloud-guest-tool ${RPM_BUILD_ROOT}%{_bindir}/%{name}-guest-tool
+install -D agent/target/transformed/libvirtqemuhook ${RPM_BUILD_ROOT}%{_datadir}/%{name}-agent/lib/libvirtqemuhook
+install -D agent/target/transformed/rolling-maintenance ${RPM_BUILD_ROOT}%{_datadir}/%{name}-agent/lib/rolling-maintenance
+install -D agent/target/transformed/cloud-ssh ${RPM_BUILD_ROOT}%{_bindir}/%{name}-ssh
+install -D agent/target/transformed/cloudstack-agent-profile.sh ${RPM_BUILD_ROOT}%{_sysconfdir}/profile.d/%{name}-agent-profile.sh
+install -D agent/target/transformed/cloudstack-agent.logrotate ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}-agent
+install -D plugins/hypervisors/kvm/target/cloud-plugin-hypervisor-kvm-%{_maventag}.jar ${RPM_BUILD_ROOT}%{_datadir}/%name-agent/lib/cloud-plugin-hypervisor-kvm-%{_maventag}.jar
+cp plugins/hypervisors/kvm/target/dependencies/*  ${RPM_BUILD_ROOT}%{_datadir}/%{name}-agent/lib
+cp plugins/storage/volume/storpool/target/*.jar  ${RPM_BUILD_ROOT}%{_datadir}/%{name}-agent/lib
+cp plugins/storage/volume/linstor/target/*.jar  ${RPM_BUILD_ROOT}%{_datadir}/%{name}-agent/lib
+
+# Usage server
+mkdir -p ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/usage
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-usage/lib
+install -D usage/target/cloud-usage-%{_maventag}.jar ${RPM_BUILD_ROOT}%{_datadir}/%{name}-usage/cloud-usage-%{_maventag}.jar
+install -D usage/target/transformed/db.properties ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/usage/db.properties
+install -D usage/target/transformed/log4j-cloud_usage.xml ${RPM_BUILD_ROOT}%{_sysconfdir}/%{name}/usage/log4j-cloud.xml
+cp usage/target/dependencies/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-usage/lib/
+cp client/target/lib/mysql*jar ${RPM_BUILD_ROOT}%{_datadir}/%{name}-usage/lib/
+install -D packaging/systemd/cloudstack-usage.service ${RPM_BUILD_ROOT}%{_unitdir}/%{name}-usage.service
+install -D packaging/systemd/cloudstack-usage.default ${RPM_BUILD_ROOT}%{_sysconfdir}/default/%{name}-usage
+mkdir -p ${RPM_BUILD_ROOT}%{_localstatedir}/log/%{name}/usage/
+install -D usage/target/transformed/cloudstack-usage.logrotate ${RPM_BUILD_ROOT}%{_sysconfdir}/logrotate.d/%{name}-usage
+
+# Marvin
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-marvin
+cp tools/marvin/dist/Marvin-*.tar.gz ${RPM_BUILD_ROOT}%{_datadir}/%{name}-marvin/
+
+# integration-tests
+mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-integration-tests
+cp -r test/integration/* ${RPM_BUILD_ROOT}%{_datadir}/%{name}-integration-tests/
+
+# MYSQL HA
+if [ "x%{_ossnoss}" == "xnoredist" ] ; then
+  mkdir -p ${RPM_BUILD_ROOT}%{_datadir}/%{name}-mysql-ha/lib
+  cp -r plugins/database/mysql-ha/target/cloud-plugin-database-mysqlha-%{_maventag}.jar ${RPM_BUILD_ROOT}%{_datadir}/%{name}-mysql-ha/lib
+fi
+
+#License files from whisker
+install -D tools/whisker/NOTICE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-management-%{version}/NOTICE
+install -D tools/whisker/LICENSE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-management-%{version}/LICENSE
+install -D tools/whisker/NOTICE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-common-%{version}/NOTICE
+install -D tools/whisker/LICENSE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-common-%{version}/LICENSE
+install -D tools/whisker/NOTICE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-agent-%{version}/NOTICE
+install -D tools/whisker/LICENSE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-agent-%{version}/LICENSE
+install -D tools/whisker/NOTICE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-usage-%{version}/NOTICE
+install -D tools/whisker/LICENSE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-usage-%{version}/LICENSE
+install -D tools/whisker/NOTICE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-ui-%{version}/NOTICE
+install -D tools/whisker/LICENSE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-ui-%{version}/LICENSE
+install -D tools/whisker/NOTICE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-marvin-%{version}/NOTICE
+install -D tools/whisker/LICENSE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-marvin-%{version}/LICENSE
+install -D tools/whisker/NOTICE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-integration-tests-%{version}/NOTICE
+install -D tools/whisker/LICENSE ${RPM_BUILD_ROOT}%{_defaultdocdir}/%{name}-integration-tests-%{version}/LICENSE
+
+%clean
+[ ${RPM_BUILD_ROOT} != "/" ] && rm -rf ${RPM_BUILD_ROOT}
+
+%posttrans common
+
+unalias cp
+python_dir=$(python3 -c "from distutils.sysconfig import get_python_lib; print(get_python_lib(1))")
+if [ ! -z $python_dir ];then
+  cp -f -r /usr/share/cloudstack-common/python-site/* $python_dir/
+fi
+
+%preun management
+/usr/bin/systemctl stop cloudstack-management || true
+/usr/bin/systemctl disable cloudstack-management || true
+
+%pre management
+id cloud > /dev/null 2>&1 || /usr/sbin/useradd -M -U -c "CloudStack unprivileged user" \
+     -r -s /bin/sh -d %{_localstatedir}/cloudstack/management cloud || true
+
+rm -rf %{_localstatedir}/cache/cloudstack
+
+# in case of upgrade to 4.9+ copy commands.properties if not exists in /etc/cloudstack/management/
+if [ "$1" == "2" ] ; then
+    if [ -f "%{_datadir}/%{name}-management/webapps/client/WEB-INF/classes/commands.properties" ] && [ ! -f "%{_sysconfdir}/%{name}/management/commands.properties" ] ; then
+        cp -p %{_datadir}/%{name}-management/webapps/client/WEB-INF/classes/commands.properties %{_sysconfdir}/%{name}/management/commands.properties
+    fi
+fi
+
+# Remove old tomcat symlinks and env config file
+if [ -L "%{_datadir}/%{name}-management/lib" ]
+then
+    rm -f %{_datadir}/%{name}-management/bin
+    rm -f %{_datadir}/%{name}-management/lib
+    rm -f %{_datadir}/%{name}-management/temp
+    rm -f %{_datadir}/%{name}-management/work
+    rm -f %{_sysconfdir}/default/%{name}-management
+fi
+
+%post management
+# Install mysql-connector-python wheel
+# Detect Python version to install compatible wheel
+if python3 -c 'import sys; sys.exit(0 if sys.version_info >= (3, 7) else 1)'; then
+    pip3 install %{_datadir}/%{name}-management/setup/wheel/mysql_connector_python-8.3.0-py2.py3-none-any.whl
+else
+    pip3 install %{_datadir}/%{name}-management/setup/wheel/mysql_connector_python-8.0.31-py2.py3-none-any.whl
+fi
+
+/usr/bin/systemctl enable cloudstack-management > /dev/null 2>&1 || true
+/usr/bin/systemctl enable --now rngd > /dev/null 2>&1 || true
+
+grep -s -q "db.cloud.driver=jdbc:mysql" "%{_sysconfdir}/%{name}/management/db.properties" || sed -i -e "\$adb.cloud.driver=jdbc:mysql" "%{_sysconfdir}/%{name}/management/db.properties"
+grep -s -q "db.usage.driver=jdbc:mysql" "%{_sysconfdir}/%{name}/management/db.properties" || sed -i -e "\$adb.usage.driver=jdbc:mysql"  "%{_sysconfdir}/%{name}/management/db.properties"
+grep -s -q "db.simulator.driver=jdbc:mysql" "%{_sysconfdir}/%{name}/management/db.properties" || sed -i -e "\$adb.simulator.driver=jdbc:mysql" "%{_sysconfdir}/%{name}/management/db.properties"
+
+# Update DB properties having master and slave(s), with source and replica(s) respectively (for inclusiveness)
+grep -s -q "^db.cloud.slaves=" "%{_sysconfdir}/%{name}/management/db.properties" && sed -i "s/^db.cloud.slaves=/db.cloud.replicas=/g" "%{_sysconfdir}/%{name}/management/db.properties"
+grep -s -q "^db.cloud.secondsBeforeRetryMaster=" "%{_sysconfdir}/%{name}/management/db.properties" && sed -i "s/^db.cloud.secondsBeforeRetryMaster=/db.cloud.secondsBeforeRetrySource=/g" "%{_sysconfdir}/%{name}/management/db.properties"
+grep -s -q "^db.cloud.queriesBeforeRetryMaster=" "%{_sysconfdir}/%{name}/management/db.properties" && sed -i "s/^db.cloud.queriesBeforeRetryMaster=/db.cloud.queriesBeforeRetrySource=/g" "%{_sysconfdir}/%{name}/management/db.properties"
+grep -s -q "^db.usage.slaves=" "%{_sysconfdir}/%{name}/management/db.properties" && sed -i "s/^db.usage.slaves=/db.usage.replicas=/g" "%{_sysconfdir}/%{name}/management/db.properties"
+grep -s -q "^db.usage.secondsBeforeRetryMaster=" "%{_sysconfdir}/%{name}/management/db.properties" && sed -i "s/^db.usage.secondsBeforeRetryMaster=/db.usage.secondsBeforeRetrySource=/g" "%{_sysconfdir}/%{name}/management/db.properties"
+grep -s -q "^db.usage.queriesBeforeRetryMaster=" "%{_sysconfdir}/%{name}/management/db.properties" && sed -i "s/^db.usage.queriesBeforeRetryMaster=/db.usage.queriesBeforeRetrySource=/g" "%{_sysconfdir}/%{name}/management/db.properties"
+
+if [ ! -f %{_datadir}/cloudstack-common/scripts/vm/hypervisor/xenserver/vhd-util ] ; then
+    echo Please download vhd-util from http://download.cloudstack.org/tools/vhd-util and put it in
+    echo %{_datadir}/cloudstack-common/scripts/vm/hypervisor/xenserver/
+fi
+
+if [ -f %{_sysconfdir}/sysconfig/%{name}-management ] ; then
+    rm -f %{_sysconfdir}/sysconfig/%{name}-management
+fi
+
+chown -R cloud:cloud /var/log/cloudstack/management
+chown -R cloud:cloud /usr/share/cloudstack-management/templates
+find /usr/share/cloudstack-management/templates -type d -exec chmod 0770 {} \;
+
+systemctl daemon-reload
+
+%posttrans management
+# Print help message
+if [ -f "/usr/share/cloudstack-common/scripts/installer/cloudstack-help-text" ];then
+    sed -i "s,^ACS_VERSION=.*,ACS_VERSION=%{_maventag},g" /usr/share/cloudstack-common/scripts/installer/cloudstack-help-text
+    /usr/share/cloudstack-common/scripts/installer/cloudstack-help-text management
+fi
+
+%preun agent
+/sbin/service cloudstack-agent stop || true
+if [ "$1" == "0" ] ; then
+    /sbin/chkconfig --del cloudstack-agent > /dev/null 2>&1 || true
+fi
+
+%pre agent
+
+# save old configs if they exist (for upgrade). Otherwise we may lose them
+# when the old packages are erased. There are a lot of properties files here.
+if [ -d "%{_sysconfdir}/cloud" ] ; then
+    mv %{_sysconfdir}/cloud %{_sysconfdir}/cloud.rpmsave
+fi
+
+%posttrans agent
+
+if [ "$1" == "2" ] ; then
+    echo "Running %{_bindir}/%{name}-agent-upgrade to update bridge name for upgrade from CloudStack 4.0.x (and before) to CloudStack 4.1 (and later)"
+    %{_bindir}/%{name}-agent-upgrade
+fi
+if [ ! -d %{_sysconfdir}/libvirt/hooks ] ; then
+    mkdir %{_sysconfdir}/libvirt/hooks
+fi
+cp -a ${RPM_BUILD_ROOT}%{_datadir}/%{name}-agent/lib/libvirtqemuhook %{_sysconfdir}/libvirt/hooks/qemu
+mkdir -m 0755 -p /usr/share/cloudstack-agent/tmp
+/usr/bin/systemctl restart libvirtd
+/usr/bin/systemctl enable cloudstack-agent > /dev/null 2>&1 || true
+/usr/bin/systemctl enable cloudstack-rolling-maintenance@p > /dev/null 2>&1 || true
+/usr/bin/systemctl enable --now rngd > /dev/null 2>&1 || true
+
+# if saved agent.properties from upgrade exist, copy them over
+if [ -f "%{_sysconfdir}/cloud.rpmsave/agent/agent.properties" ]; then
+    mv %{_sysconfdir}/%{name}/agent/agent.properties  %{_sysconfdir}/%{name}/agent/agent.properties.rpmnew
+    cp -p %{_sysconfdir}/cloud.rpmsave/agent/agent.properties %{_sysconfdir}/%{name}/agent
+    # make sure we only do this on the first install of this RPM, don't want to overwrite on a reinstall
+    mv %{_sysconfdir}/cloud.rpmsave/agent/agent.properties %{_sysconfdir}/cloud.rpmsave/agent/agent.properties.rpmsave
+fi
+
+# if saved uefi.properties from upgrade exist, copy them over
+if [ -f "%{_sysconfdir}/cloud.rpmsave/agent/uefi.properties" ]; then
+    mv %{_sysconfdir}/%{name}/agent/uefi.properties  %{_sysconfdir}/%{name}/agent/uefi.properties.rpmnew
+    cp -p %{_sysconfdir}/cloud.rpmsave/agent/uefi.properties %{_sysconfdir}/%{name}/agent
+    # make sure we only do this on the first install of this RPM, don't want to overwrite on a reinstall
+    mv %{_sysconfdir}/cloud.rpmsave/agent/uefi.properties %{_sysconfdir}/cloud.rpmsave/agent/uefi.properties.rpmsave
+fi
+
+systemctl daemon-reload
+
+# Print help message
+if [ -f "/usr/share/cloudstack-common/scripts/installer/cloudstack-help-text" ];then
+    sed -i "s,^ACS_VERSION=.*,ACS_VERSION=%{_maventag},g" /usr/share/cloudstack-common/scripts/installer/cloudstack-help-text
+    /usr/share/cloudstack-common/scripts/installer/cloudstack-help-text agent
+fi
+
+%pre usage
+id cloud > /dev/null 2>&1 || /usr/sbin/useradd -M -U -c "CloudStack unprivileged user" \
+     -r -s /bin/sh -d %{_localstatedir}/cloudstack/management cloud|| true
+
+%preun usage
+/sbin/service cloudstack-usage stop || true
+if [ "$1" == "0" ] ; then
+    /sbin/chkconfig --del cloudstack-usage > /dev/null 2>&1 || true
+fi
+
+%post usage
+if [ -f "%{_sysconfdir}/%{name}/management/db.properties" ]; then
+    echo "Replacing usage server's db.properties with a link to the management server's db.properties"
+    rm -f %{_sysconfdir}/%{name}/usage/db.properties
+    ln -s %{_sysconfdir}/%{name}/management/db.properties %{_sysconfdir}/%{name}/usage/db.properties
+    /usr/bin/systemctl enable cloudstack-usage > /dev/null 2>&1 || true
+fi
+
+if [ -f "%{_sysconfdir}/%{name}/management/key" ]; then
+    echo "Replacing usage server's key with a link to the management server's key"
+    rm -f %{_sysconfdir}/%{name}/usage/key
+    ln -s %{_sysconfdir}/%{name}/management/key %{_sysconfdir}/%{name}/usage/key
+fi
+
+if [ ! -f "%{_sysconfdir}/%{name}/usage/key" ]; then
+    ln -s %{_sysconfdir}/%{name}/management/key %{_sysconfdir}/%{name}/usage/key
+fi
+
+mkdir -p /usr/local/libexec
+if [ ! -f "/usr/local/libexec/sanity-check-last-id" ]; then
+    echo 1 > /usr/local/libexec/sanity-check-last-id
+fi
+chown cloud:cloud /usr/local/libexec/sanity-check-last-id
+
+%posttrans usage
+# Print help message
+if [ -f "/usr/share/cloudstack-common/scripts/installer/cloudstack-help-text" ];then
+    sed -i "s,^ACS_VERSION=.*,ACS_VERSION=%{_maventag},g" /usr/share/cloudstack-common/scripts/installer/cloudstack-help-text
+    /usr/share/cloudstack-common/scripts/installer/cloudstack-help-text usage
+fi
+
+%post marvin
+pip3 install --upgrade https://files.pythonhosted.org/packages/08/1f/42d74bae9dd6dcfec67c9ed0f3fa482b1ae5ac5f117ca82ab589ecb3ca19/mysql_connector_python-8.0.31-py2.py3-none-any.whl
+pip3 install --upgrade /usr/share/cloudstack-marvin/Marvin-*.tar.gz
+
+#No default permission as the permission setup is complex
+%files management
+%defattr(-,root,root,-)
+%dir %{_datadir}/%{name}-management
+%dir %attr(0770,root,cloud) %{_localstatedir}/%{name}/mnt
+%dir %attr(0770,cloud,cloud) %{_localstatedir}/%{name}/management
+%dir %attr(0770,root,cloud) %{_localstatedir}/cache/%{name}/management
+%dir %attr(0770,root,cloud) %{_localstatedir}/log/%{name}/management
+%config(noreplace) %{_sysconfdir}/default/%{name}-management
+%config(noreplace) %{_sysconfdir}/sudoers.d/%{name}-management
+%config(noreplace) %{_sysconfdir}/security/limits.d/cloud
+%config(noreplace) %{_sysconfdir}/systemd/system/%{name}-management.service.d
+%config(noreplace) %attr(0640,root,cloud) %{_sysconfdir}/%{name}/management/db.properties
+%config(noreplace) %attr(0640,root,cloud) %{_sysconfdir}/%{name}/management/server.properties
+%config(noreplace) %attr(0640,root,cloud) %{_sysconfdir}/%{name}/management/config.json
+%config(noreplace) %{_sysconfdir}/%{name}/management/log4j-cloud.xml
+%config(noreplace) %{_sysconfdir}/%{name}/management/log4j2.xml
+%config(noreplace) %{_sysconfdir}/%{name}/management/environment.properties
+%config(noreplace) %{_sysconfdir}/%{name}/management/java.security.ciphers
+%config(noreplace) %attr(0644,root,root) %{_sysconfdir}/logrotate.d/%{name}-management
+%attr(0644,root,root) %{_unitdir}/%{name}-management.service
+%attr(0755,cloud,cloud) %{_localstatedir}/run/%{name}-management.pid
+%attr(0755,root,root) %{_bindir}/%{name}-setup-management
+%attr(0755,root,root) %{_bindir}/%{name}-update-xenserver-licenses
+%{_datadir}/%{name}-management/conf
+%{_datadir}/%{name}-management/lib/*.jar
+%{_datadir}/%{name}-management/logs
+%{_datadir}/%{name}-management/templates
+%{_datadir}/%{name}-management/extensions
+%attr(0755,root,root) %{_bindir}/%{name}-setup-databases
+%attr(0755,root,root) %{_bindir}/%{name}-migrate-databases
+%attr(0755,root,root) %{_bindir}/%{name}-set-guest-password
+%attr(0755,root,root) %{_bindir}/%{name}-set-guest-sshkey
+%attr(0755,root,root) %{_bindir}/%{name}-sysvmadm
+%attr(0755,root,root) %{_bindir}/%{name}-setup-encryption
+%attr(0755,root,root) %{_bindir}/cmk
+%{_datadir}/%{name}-management/cks/conf/*.yml
+%{_datadir}/%{name}-management/setup/*.sql
+%{_datadir}/%{name}-management/setup/*.sh
+%{_datadir}/%{name}-management/setup/server-setup.xml
+%{_datadir}/%{name}-management/webapp/*
+%dir %attr(0770, cloud, cloud) %{_datadir}/%{name}-management/templates
+%dir %attr(0770, cloud, cloud) %{_datadir}/%{name}-management/templates/systemvm
+%attr(0644, cloud, cloud) %{_datadir}/%{name}-management/templates/systemvm/*
+%attr(0755,root,root) %{_bindir}/%{name}-external-ipallocator.py
+%attr(0755,root,root) %{_initrddir}/%{name}-ipallocator
+%dir %attr(0770,root,root) %{_localstatedir}/log/%{name}/ipallocator
+%{_defaultdocdir}/%{name}-management-%{version}/LICENSE
+%{_defaultdocdir}/%{name}-management-%{version}/NOTICE
+%{_datadir}/%{name}-management/setup/wheel/*.whl
+%dir %attr(0755,cloud,cloud) %{_sysconfdir}/%{name}/extensions
+%attr(0755,cloud,cloud) %{_sysconfdir}/%{name}/extensions/*
+
+%files agent
+%attr(0755,root,root) %{_bindir}/%{name}-setup-agent
+%attr(0755,root,root) %{_bindir}/%{name}-agent-upgrade
+%attr(0755,root,root) %{_bindir}/%{name}-guest-tool
+%attr(0755,root,root) %{_bindir}/%{name}-ssh
+%attr(0644,root,root) %{_unitdir}/%{name}-agent.service
+%attr(0644,root,root) %{_unitdir}/%{name}-rolling-maintenance@.service
+%config(noreplace) %{_sysconfdir}/default/%{name}-agent
+%attr(0644,root,root) %{_sysconfdir}/profile.d/%{name}-agent-profile.sh
+%config(noreplace) %attr(0644,root,root) %{_sysconfdir}/logrotate.d/%{name}-agent
+%attr(0755,root,root) %{_datadir}/%{name}-common/scripts/network/cisco
+%config(noreplace) %{_sysconfdir}/%{name}/agent
+%dir %{_localstatedir}/log/%{name}/agent
+%attr(0644,root,root) %{_datadir}/%{name}-agent/lib/*.jar
+%attr(0755,root,root) %{_datadir}/%{name}-agent/lib/libvirtqemuhook
+%attr(0755,root,root) %{_datadir}/%{name}-agent/lib/rolling-maintenance
+%dir %{_datadir}/%{name}-agent/plugins
+%{_defaultdocdir}/%{name}-agent-%{version}/LICENSE
+%{_defaultdocdir}/%{name}-agent-%{version}/NOTICE
+
+%files common
+%dir %attr(0755,root,root) %{_datadir}/%{name}-common/python-site/cloudutils
+%dir %attr(0755,root,root) %{_datadir}/%{name}-common/vms
+%attr(0755,root,root) %{_datadir}/%{name}-common/scripts
+%attr(0755,root,root) /usr/bin/cloudstack-sccs
+%attr(0644, root, root) %{_datadir}/%{name}-common/vms/agent.zip
+%attr(0644, root, root) %{_datadir}/%{name}-common/vms/cloud-scripts.tgz
+%attr(0644, root, root) %{_datadir}/%{name}-common/vms/patch-sysvms.sh
+%attr(0644,root,root) %{_datadir}/%{name}-common/python-site/cloud_utils.py
+%attr(0644,root,root) %{_datadir}/%{name}-common/python-site/__pycache__/*
+%attr(0644,root,root) %{_datadir}/%{name}-common/python-site/cloudutils/*
+%attr(0644, root, root) %{_datadir}/%{name}-common/lib/jasypt-1.9.3.jar
+%attr(0644, root, root) %{_datadir}/%{name}-common/lib/%{name}-utils.jar
+%{_defaultdocdir}/%{name}-common-%{version}/LICENSE
+%{_defaultdocdir}/%{name}-common-%{version}/NOTICE
+
+%files ui
+%config(noreplace) %attr(0640,root,cloud) %{_sysconfdir}/%{name}/ui/config.json
+%{_datadir}/%{name}-ui/*
+%{_defaultdocdir}/%{name}-ui-%{version}/LICENSE
+%{_defaultdocdir}/%{name}-ui-%{version}/NOTICE
+
+%files usage
+%attr(0644,root,root) %{_unitdir}/%{name}-usage.service
+%config(noreplace) %{_sysconfdir}/default/%{name}-usage
+%config(noreplace) %attr(0644,root,root) %{_sysconfdir}/logrotate.d/%{name}-usage
+%attr(0644,root,root) %{_datadir}/%{name}-usage/*.jar
+%attr(0644,root,root) %{_datadir}/%{name}-usage/lib/*.jar
+%dir %attr(0770,root,cloud) %{_localstatedir}/log/%{name}/usage
+%attr(0644,root,root) %{_sysconfdir}/%{name}/usage/db.properties
+%attr(0644,root,root) %{_sysconfdir}/%{name}/usage/log4j-cloud.xml
+%{_defaultdocdir}/%{name}-usage-%{version}/LICENSE
+%{_defaultdocdir}/%{name}-usage-%{version}/NOTICE
+
+%files marvin
+%attr(0644,root,root) %{_datadir}/%{name}-marvin/Marvin*.tar.gz
+%{_defaultdocdir}/%{name}-marvin-%{version}/LICENSE
+%{_defaultdocdir}/%{name}-marvin-%{version}/NOTICE
+
+%files integration-tests
+%attr(0755,root,root) %{_datadir}/%{name}-integration-tests/*
+%{_defaultdocdir}/%{name}-integration-tests-%{version}/LICENSE
+%{_defaultdocdir}/%{name}-integration-tests-%{version}/NOTICE
+
+%if "%{_ossnoss}" == "noredist"
+%files mysql-ha
+%defattr(0644,cloud,cloud,0755)
+%attr(0644,root,root) %{_datadir}/%{name}-mysql-ha/lib/*
+%endif
+
+%files baremetal-agent
+%attr(0755,root,root) %{_bindir}/cloudstack-setup-baremetal
+
+%changelog
+* Thu Dec 22 2022 Rohit Yadav <rohit@apache.org> 4.18.0
+- Add support for EL9
+
+* Fri Oct 14 2022 Daan Hoogland <daan.hoogland@gmail.com> 4.18.0
+- initialising sanity check pointer file
+
+* Tue Jun 29 2021 David Jumani <dj.davidjumani1994@gmail.com> 4.16.0
+- Adding SUSE 15 support
+
+* Thu Apr 30 2015 Rohit Yadav <bhaisaab@apache.org> 4.6.0
+- Remove awsapi package
+
+* Wed Nov 19 2014 Hugo Trippaers <hugo@apache.org> 4.6.0
+- Create a specific spec for CentOS 7
+
+* Fri Jul 4 2014 Hugo Trippaers <hugo@apache.org> 4.5.0
+- Add a package for the mysql ha module
+
+* Fri Oct 5 2012 Hugo Trippaers <hugo@apache.org> 4.1.0
+- new style spec file
diff --git a/packaging/suse15/cloudstack-agent.te b/packaging/suse15/cloudstack-agent.te
new file mode 120000
index 000000000000..30e123f6cba5
--- /dev/null
+++ b/packaging/suse15/cloudstack-agent.te
@@ -0,0 +1 @@
+../el8/cloudstack-agent.te
\ No newline at end of file
diff --git a/packaging/suse15/cloudstack-sccs b/packaging/suse15/cloudstack-sccs
new file mode 120000
index 000000000000..b9e6ed9dc085
--- /dev/null
+++ b/packaging/suse15/cloudstack-sccs
@@ -0,0 +1 @@
+../el8/cloudstack-sccs
\ No newline at end of file
diff --git a/packaging/suse15/filelimit.conf b/packaging/suse15/filelimit.conf
new file mode 120000
index 000000000000..c71688ea640a
--- /dev/null
+++ b/packaging/suse15/filelimit.conf
@@ -0,0 +1 @@
+../el8/filelimit.conf
\ No newline at end of file
diff --git a/packaging/suse15/replace.properties b/packaging/suse15/replace.properties
new file mode 100644
index 000000000000..b1900af83406
--- /dev/null
+++ b/packaging/suse15/replace.properties
@@ -0,0 +1,65 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+DBUSER=cloud
+DBPW=cloud
+DBROOTPW=
+MSLOG=vmops.log
+APISERVERLOG=api.log
+DBHOST=localhost
+DBDRIVER=jdbc:mysql
+COMPONENTS-SPEC=components-premium.xml
+REMOTEHOST=localhost
+AGENTCLASSPATH=
+AGENTLOG=/var/log/cloudstack/agent/agent.log
+AGENTLOGDIR=/var/log/cloudstack/agent/
+AGENTSYSCONFDIR=/etc/cloudstack/agent
+APISERVERLOG=/var/log/cloudstack/management/apilog.log
+BINDIR=/usr/bin
+COMMONLIBDIR=/usr/share/cloudstack-common
+CONFIGUREVARS=
+DEPSCLASSPATH=
+DOCDIR=
+IPALOCATORLOG=/var/log/cloudstack/management/ipallocator.log
+JAVADIR=/usr/share/java
+LIBEXECDIR=/usr/libexec
+LOCKDIR=/var/lock
+MSCLASSPATH=
+MSCONF=/etc/cloudstack/management
+MSENVIRON=/usr/share/cloudstack-management
+MSLOG=/var/log/cloudstack/management/management-server.log
+MSLOGDIR=/var/log/cloudstack/management/
+MSMNTDIR=/var/cloudstack/mnt
+MSUSER=cloud
+PIDDIR=/var/run
+PLUGINJAVADIR=/usr/share/cloudstack-management/plugin
+PREMIUMJAVADIR=/usr/share/cloudstack-management/premium
+PYTHONDIR=/usr/share/cloudstack-common/python-site/
+SERVERSYSCONFDIR=/etc/sysconfig
+SETUPDATADIR=/usr/share/cloudstack-management/setup
+SYSCONFDIR=/etc/sysconfig
+SYSTEMCLASSPATH=
+SYSTEMJARS=
+USAGECLASSPATH=
+USAGELOG=/var/log/cloudstack/usage/usage.log
+USAGESYSCONFDIR=/etc/sysconfig
+EXTENSIONSDEPLOYMENTMODE=production
+GUESTNVRAMTEMPLATELEGACY=/usr/share/qemu/ovmf-x86_64-vars.bin
+GUESTLOADERLEGACY=/usr/share/qemu/ovmf-x86_64-code.bin
+GUESTNVRAMTEMPLATESECURE=/usr/share/qemu/ovmf-x86_64-ms-vars.bin
+GUESTLOADERSECURE=/usr/share/qemu/ovmf-x86_64-ms-code.bin
+GUESTNVRAMPATH=/var/lib/libvirt/qemu/nvram/

From 348ce953a99246a756b527994f7745a7be038234 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Mon, 11 May 2026 20:26:07 +0530
Subject: [PATCH 27/64] Updating pom.xml version numbers for release 4.22.1.0

Signed-off-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
---
 agent/pom.xml                                               | 2 +-
 api/pom.xml                                                 | 2 +-
 client/pom.xml                                              | 2 +-
 core/pom.xml                                                | 2 +-
 debian/changelog                                            | 6 ++++++
 developer/pom.xml                                           | 2 +-
 engine/api/pom.xml                                          | 2 +-
 engine/components-api/pom.xml                               | 2 +-
 engine/orchestration/pom.xml                                | 2 +-
 engine/pom.xml                                              | 2 +-
 engine/schema/pom.xml                                       | 2 +-
 engine/service/pom.xml                                      | 2 +-
 engine/storage/cache/pom.xml                                | 2 +-
 engine/storage/configdrive/pom.xml                          | 2 +-
 engine/storage/datamotion/pom.xml                           | 2 +-
 engine/storage/image/pom.xml                                | 2 +-
 engine/storage/integration-test/pom.xml                     | 2 +-
 engine/storage/object/pom.xml                               | 2 +-
 engine/storage/pom.xml                                      | 2 +-
 engine/storage/snapshot/pom.xml                             | 2 +-
 engine/storage/volume/pom.xml                               | 2 +-
 engine/userdata/cloud-init/pom.xml                          | 2 +-
 engine/userdata/pom.xml                                     | 2 +-
 framework/agent-lb/pom.xml                                  | 2 +-
 framework/ca/pom.xml                                        | 2 +-
 framework/cluster/pom.xml                                   | 2 +-
 framework/config/pom.xml                                    | 2 +-
 framework/db/pom.xml                                        | 2 +-
 framework/direct-download/pom.xml                           | 2 +-
 framework/events/pom.xml                                    | 2 +-
 framework/extensions/pom.xml                                | 6 +++---
 framework/ipc/pom.xml                                       | 2 +-
 framework/jobs/pom.xml                                      | 2 +-
 framework/managed-context/pom.xml                           | 2 +-
 framework/pom.xml                                           | 2 +-
 framework/quota/pom.xml                                     | 2 +-
 framework/rest/pom.xml                                      | 2 +-
 framework/security/pom.xml                                  | 2 +-
 framework/spring/lifecycle/pom.xml                          | 2 +-
 framework/spring/module/pom.xml                             | 2 +-
 plugins/acl/dynamic-role-based/pom.xml                      | 2 +-
 plugins/acl/project-role-based/pom.xml                      | 2 +-
 plugins/acl/static-role-based/pom.xml                       | 2 +-
 .../affinity-group-processors/explicit-dedication/pom.xml   | 2 +-
 plugins/affinity-group-processors/host-affinity/pom.xml     | 2 +-
 .../affinity-group-processors/host-anti-affinity/pom.xml    | 2 +-
 .../non-strict-host-affinity/pom.xml                        | 2 +-
 .../non-strict-host-anti-affinity/pom.xml                   | 2 +-
 plugins/alert-handlers/snmp-alerts/pom.xml                  | 2 +-
 plugins/alert-handlers/syslog-alerts/pom.xml                | 2 +-
 plugins/api/discovery/pom.xml                               | 2 +-
 plugins/api/rate-limit/pom.xml                              | 2 +-
 plugins/api/solidfire-intg-test/pom.xml                     | 2 +-
 plugins/api/vmware-sioc/pom.xml                             | 2 +-
 plugins/backup/dummy/pom.xml                                | 2 +-
 plugins/backup/nas/pom.xml                                  | 2 +-
 plugins/backup/networker/pom.xml                            | 2 +-
 plugins/backup/veeam/pom.xml                                | 2 +-
 plugins/ca/root-ca/pom.xml                                  | 2 +-
 plugins/database/mysql-ha/pom.xml                           | 2 +-
 plugins/database/quota/pom.xml                              | 2 +-
 plugins/dedicated-resources/pom.xml                         | 2 +-
 plugins/deployment-planners/implicit-dedication/pom.xml     | 2 +-
 plugins/deployment-planners/user-concentrated-pod/pom.xml   | 2 +-
 plugins/deployment-planners/user-dispersing/pom.xml         | 2 +-
 plugins/drs/cluster/balanced/pom.xml                        | 2 +-
 plugins/drs/cluster/condensed/pom.xml                       | 2 +-
 plugins/event-bus/inmemory/pom.xml                          | 2 +-
 plugins/event-bus/kafka/pom.xml                             | 2 +-
 plugins/event-bus/rabbitmq/pom.xml                          | 2 +-
 plugins/event-bus/webhook/pom.xml                           | 2 +-
 plugins/ha-planners/skip-heurestics/pom.xml                 | 2 +-
 plugins/host-allocators/random/pom.xml                      | 2 +-
 plugins/hypervisors/baremetal/pom.xml                       | 2 +-
 plugins/hypervisors/external/pom.xml                        | 2 +-
 plugins/hypervisors/hyperv/pom.xml                          | 2 +-
 plugins/hypervisors/kvm/pom.xml                             | 2 +-
 plugins/hypervisors/simulator/pom.xml                       | 2 +-
 plugins/hypervisors/ucs/pom.xml                             | 2 +-
 plugins/hypervisors/vmware/pom.xml                          | 2 +-
 plugins/hypervisors/xenserver/pom.xml                       | 2 +-
 plugins/integrations/cloudian/pom.xml                       | 2 +-
 plugins/integrations/kubernetes-service/pom.xml             | 2 +-
 plugins/integrations/prometheus/pom.xml                     | 2 +-
 plugins/maintenance/pom.xml                                 | 2 +-
 plugins/metrics/pom.xml                                     | 2 +-
 plugins/network-elements/bigswitch/pom.xml                  | 2 +-
 plugins/network-elements/brocade-vcs/pom.xml                | 2 +-
 plugins/network-elements/cisco-vnmc/pom.xml                 | 2 +-
 plugins/network-elements/dns-notifier/pom.xml               | 2 +-
 plugins/network-elements/elastic-loadbalancer/pom.xml       | 2 +-
 plugins/network-elements/globodns/pom.xml                   | 2 +-
 plugins/network-elements/internal-loadbalancer/pom.xml      | 2 +-
 plugins/network-elements/juniper-contrail/pom.xml           | 2 +-
 plugins/network-elements/netris/pom.xml                     | 2 +-
 plugins/network-elements/netscaler/pom.xml                  | 2 +-
 plugins/network-elements/nicira-nvp/pom.xml                 | 2 +-
 plugins/network-elements/nsx/pom.xml                        | 2 +-
 plugins/network-elements/opendaylight/pom.xml               | 2 +-
 plugins/network-elements/ovs/pom.xml                        | 2 +-
 plugins/network-elements/palo-alto/pom.xml                  | 2 +-
 plugins/network-elements/stratosphere-ssp/pom.xml           | 2 +-
 plugins/network-elements/tungsten/pom.xml                   | 2 +-
 plugins/network-elements/vxlan/pom.xml                      | 2 +-
 plugins/outofbandmanagement-drivers/ipmitool/pom.xml        | 2 +-
 .../outofbandmanagement-drivers/nested-cloudstack/pom.xml   | 2 +-
 plugins/outofbandmanagement-drivers/redfish/pom.xml         | 2 +-
 plugins/pom.xml                                             | 2 +-
 plugins/storage-allocators/random/pom.xml                   | 2 +-
 plugins/storage/image/default/pom.xml                       | 2 +-
 plugins/storage/image/s3/pom.xml                            | 2 +-
 plugins/storage/image/sample/pom.xml                        | 2 +-
 plugins/storage/image/swift/pom.xml                         | 2 +-
 plugins/storage/object/ceph/pom.xml                         | 2 +-
 plugins/storage/object/cloudian/pom.xml                     | 2 +-
 plugins/storage/object/minio/pom.xml                        | 2 +-
 plugins/storage/object/simulator/pom.xml                    | 2 +-
 plugins/storage/sharedfs/storagevm/pom.xml                  | 2 +-
 plugins/storage/volume/adaptive/pom.xml                     | 2 +-
 plugins/storage/volume/cloudbyte/pom.xml                    | 2 +-
 plugins/storage/volume/datera/pom.xml                       | 2 +-
 plugins/storage/volume/default/pom.xml                      | 2 +-
 plugins/storage/volume/flasharray/pom.xml                   | 2 +-
 plugins/storage/volume/linstor/pom.xml                      | 2 +-
 plugins/storage/volume/nexenta/pom.xml                      | 2 +-
 plugins/storage/volume/primera/pom.xml                      | 2 +-
 plugins/storage/volume/sample/pom.xml                       | 2 +-
 plugins/storage/volume/scaleio/pom.xml                      | 2 +-
 plugins/storage/volume/solidfire/pom.xml                    | 2 +-
 plugins/storage/volume/storpool/pom.xml                     | 2 +-
 plugins/user-authenticators/ldap/pom.xml                    | 2 +-
 plugins/user-authenticators/md5/pom.xml                     | 2 +-
 plugins/user-authenticators/oauth2/pom.xml                  | 2 +-
 plugins/user-authenticators/pbkdf2/pom.xml                  | 2 +-
 plugins/user-authenticators/plain-text/pom.xml              | 2 +-
 plugins/user-authenticators/saml2/pom.xml                   | 2 +-
 plugins/user-authenticators/sha256salted/pom.xml            | 2 +-
 plugins/user-two-factor-authenticators/static-pin/pom.xml   | 2 +-
 plugins/user-two-factor-authenticators/totp/pom.xml         | 2 +-
 pom.xml                                                     | 2 +-
 quickcloud/pom.xml                                          | 2 +-
 server/pom.xml                                              | 4 ++--
 services/console-proxy/pom.xml                              | 2 +-
 services/console-proxy/rdpconsole/pom.xml                   | 2 +-
 services/console-proxy/server/pom.xml                       | 2 +-
 services/pom.xml                                            | 2 +-
 services/secondary-storage/controller/pom.xml               | 2 +-
 services/secondary-storage/pom.xml                          | 2 +-
 services/secondary-storage/server/pom.xml                   | 2 +-
 systemvm/pom.xml                                            | 2 +-
 test/pom.xml                                                | 2 +-
 tools/apidoc/pom.xml                                        | 2 +-
 tools/checkstyle/pom.xml                                    | 2 +-
 tools/devcloud-kvm/pom.xml                                  | 2 +-
 tools/devcloud4/pom.xml                                     | 2 +-
 tools/docker/Dockerfile                                     | 2 +-
 tools/docker/Dockerfile.marvin                              | 4 ++--
 tools/marvin/pom.xml                                        | 2 +-
 tools/marvin/setup.py                                       | 2 +-
 tools/pom.xml                                               | 2 +-
 usage/pom.xml                                               | 2 +-
 utils/pom.xml                                               | 2 +-
 vmware-base/pom.xml                                         | 2 +-
 163 files changed, 172 insertions(+), 166 deletions(-)

diff --git a/agent/pom.xml b/agent/pom.xml
index 4fa30e4f78e2..70fdea6d0c59 100644
--- a/agent/pom.xml
+++ b/agent/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/api/pom.xml b/api/pom.xml
index 405365451c6f..03abe9ee30bf 100644
--- a/api/pom.xml
+++ b/api/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/client/pom.xml b/client/pom.xml
index 94d844be3c42..e97b5474d733 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/core/pom.xml b/core/pom.xml
index 1bf7c28674d6..8012f3747ada 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/debian/changelog b/debian/changelog
index 6d288afc4db0..bdd67f8f91e1 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+cloudstack (4.22.1.0) unstable; urgency=low
+
+  * Update the version to 4.22.1.0
+
+ -- the Apache CloudStack project <dev@cloudstack.apache.org>  Mon, 11 May 2026 20:26:07 +0530
+
 cloudstack (4.22.1.0-SNAPSHOT) unstable; urgency=low
 
   * Update the version to 4.22.1.0-SNAPSHOT
diff --git a/developer/pom.xml b/developer/pom.xml
index de6a8ef3d10a..b22140ea70e1 100644
--- a/developer/pom.xml
+++ b/developer/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/engine/api/pom.xml b/engine/api/pom.xml
index 2f7e15aaab05..e23593f34ff7 100644
--- a/engine/api/pom.xml
+++ b/engine/api/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/components-api/pom.xml b/engine/components-api/pom.xml
index 8caf8ccbff69..940fd8050f3e 100644
--- a/engine/components-api/pom.xml
+++ b/engine/components-api/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/orchestration/pom.xml b/engine/orchestration/pom.xml
index cd5578d245ca..44b57a821479 100755
--- a/engine/orchestration/pom.xml
+++ b/engine/orchestration/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/pom.xml b/engine/pom.xml
index 821a4f8f54ce..dcd65661f57b 100644
--- a/engine/pom.xml
+++ b/engine/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/engine/schema/pom.xml b/engine/schema/pom.xml
index 7d88f649245c..ceedce8a140d 100644
--- a/engine/schema/pom.xml
+++ b/engine/schema/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/service/pom.xml b/engine/service/pom.xml
index c429ebf5da5a..fa324fb9398d 100644
--- a/engine/service/pom.xml
+++ b/engine/service/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <artifactId>cloud-engine-service</artifactId>
     <packaging>war</packaging>
diff --git a/engine/storage/cache/pom.xml b/engine/storage/cache/pom.xml
index 2e736ad42e55..1eda5b66aaf2 100644
--- a/engine/storage/cache/pom.xml
+++ b/engine/storage/cache/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/configdrive/pom.xml b/engine/storage/configdrive/pom.xml
index d5ef49d7ef78..d176d00568d6 100644
--- a/engine/storage/configdrive/pom.xml
+++ b/engine/storage/configdrive/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/datamotion/pom.xml b/engine/storage/datamotion/pom.xml
index aa5a6d1f8f87..ff4bfa5877d1 100644
--- a/engine/storage/datamotion/pom.xml
+++ b/engine/storage/datamotion/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/image/pom.xml b/engine/storage/image/pom.xml
index 0232e404f5a7..bdb5f9e9bf87 100644
--- a/engine/storage/image/pom.xml
+++ b/engine/storage/image/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/integration-test/pom.xml b/engine/storage/integration-test/pom.xml
index 2ca31465e08d..6fccacdcb41e 100644
--- a/engine/storage/integration-test/pom.xml
+++ b/engine/storage/integration-test/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/object/pom.xml b/engine/storage/object/pom.xml
index a9e3aeac4674..6fee3d658fdc 100644
--- a/engine/storage/object/pom.xml
+++ b/engine/storage/object/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/pom.xml b/engine/storage/pom.xml
index 72e9def90a3d..7529adfd0dd4 100644
--- a/engine/storage/pom.xml
+++ b/engine/storage/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/snapshot/pom.xml b/engine/storage/snapshot/pom.xml
index 14b0ce92f8b0..7fa2d4056043 100644
--- a/engine/storage/snapshot/pom.xml
+++ b/engine/storage/snapshot/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/volume/pom.xml b/engine/storage/volume/pom.xml
index 42399bc75622..220989ddcd95 100644
--- a/engine/storage/volume/pom.xml
+++ b/engine/storage/volume/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/userdata/cloud-init/pom.xml b/engine/userdata/cloud-init/pom.xml
index 2b5d55948ede..460a18a8f206 100644
--- a/engine/userdata/cloud-init/pom.xml
+++ b/engine/userdata/cloud-init/pom.xml
@@ -23,7 +23,7 @@
 <parent>
     <artifactId>cloud-engine</artifactId>
     <groupId>org.apache.cloudstack</groupId>
-    <version>4.22.1.0-SNAPSHOT</version>
+    <version>4.22.1.0</version>
     <relativePath>../../pom.xml</relativePath>
 </parent>
 <dependencies>
diff --git a/engine/userdata/pom.xml b/engine/userdata/pom.xml
index 001825841565..7b052903d170 100644
--- a/engine/userdata/pom.xml
+++ b/engine/userdata/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/agent-lb/pom.xml b/framework/agent-lb/pom.xml
index cba750d3c7fb..c36a01aaf45d 100644
--- a/framework/agent-lb/pom.xml
+++ b/framework/agent-lb/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <artifactId>cloudstack-framework</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/framework/ca/pom.xml b/framework/ca/pom.xml
index e7d85c089bb7..49637c6f2b6b 100644
--- a/framework/ca/pom.xml
+++ b/framework/ca/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/framework/cluster/pom.xml b/framework/cluster/pom.xml
index da3de5ebf751..bd6bb84f9443 100644
--- a/framework/cluster/pom.xml
+++ b/framework/cluster/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/config/pom.xml b/framework/config/pom.xml
index 9fbbc4a0cd72..38f45870305c 100644
--- a/framework/config/pom.xml
+++ b/framework/config/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/db/pom.xml b/framework/db/pom.xml
index c03fb0654bd8..1d53484a6a90 100644
--- a/framework/db/pom.xml
+++ b/framework/db/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/direct-download/pom.xml b/framework/direct-download/pom.xml
index 913bef072a04..688f23a25cea 100644
--- a/framework/direct-download/pom.xml
+++ b/framework/direct-download/pom.xml
@@ -32,7 +32,7 @@
     <parent>
         <artifactId>cloudstack-framework</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/framework/events/pom.xml b/framework/events/pom.xml
index 173b18a4df2e..5bf3cfeea21a 100644
--- a/framework/events/pom.xml
+++ b/framework/events/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/extensions/pom.xml b/framework/extensions/pom.xml
index 76952555698a..5186d7e95b5f 100644
--- a/framework/extensions/pom.xml
+++ b/framework/extensions/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
@@ -41,13 +41,13 @@
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-engine-schema</artifactId>
-            <version>4.22.1.0-SNAPSHOT</version>
+            <version>4.22.1.0</version>
             <scope>compile</scope>
         </dependency>
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-engine-components-api</artifactId>
-            <version>4.22.1.0-SNAPSHOT</version>
+            <version>4.22.1.0</version>
             <scope>compile</scope>
         </dependency>
     </dependencies>
diff --git a/framework/ipc/pom.xml b/framework/ipc/pom.xml
index 0d13898f3f84..b05854df03a4 100644
--- a/framework/ipc/pom.xml
+++ b/framework/ipc/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/jobs/pom.xml b/framework/jobs/pom.xml
index f3249727c3a4..99206fc1a446 100644
--- a/framework/jobs/pom.xml
+++ b/framework/jobs/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/managed-context/pom.xml b/framework/managed-context/pom.xml
index c0950855ef45..dbee01e43087 100644
--- a/framework/managed-context/pom.xml
+++ b/framework/managed-context/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/pom.xml b/framework/pom.xml
index 02ce0a09b817..e2c52f643cc2 100644
--- a/framework/pom.xml
+++ b/framework/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <build>
         <plugins>
diff --git a/framework/quota/pom.xml b/framework/quota/pom.xml
index 52f0d658f009..3e0ec54790f2 100644
--- a/framework/quota/pom.xml
+++ b/framework/quota/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/rest/pom.xml b/framework/rest/pom.xml
index bb69f909ba22..b7f2e526fd38 100644
--- a/framework/rest/pom.xml
+++ b/framework/rest/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-framework-rest</artifactId>
diff --git a/framework/security/pom.xml b/framework/security/pom.xml
index a36978e4ef64..4f4b7af07e41 100644
--- a/framework/security/pom.xml
+++ b/framework/security/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/spring/lifecycle/pom.xml b/framework/spring/lifecycle/pom.xml
index ff6b59567dad..1844b803809b 100644
--- a/framework/spring/lifecycle/pom.xml
+++ b/framework/spring/lifecycle/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/spring/module/pom.xml b/framework/spring/module/pom.xml
index 77a9646a984e..6a1dbade3bf4 100644
--- a/framework/spring/module/pom.xml
+++ b/framework/spring/module/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/acl/dynamic-role-based/pom.xml b/plugins/acl/dynamic-role-based/pom.xml
index f975afc6e5fa..029fcb5e97b8 100644
--- a/plugins/acl/dynamic-role-based/pom.xml
+++ b/plugins/acl/dynamic-role-based/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/acl/project-role-based/pom.xml b/plugins/acl/project-role-based/pom.xml
index ae00e850aa7e..dd0b621b395f 100644
--- a/plugins/acl/project-role-based/pom.xml
+++ b/plugins/acl/project-role-based/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/acl/static-role-based/pom.xml b/plugins/acl/static-role-based/pom.xml
index ee088e3bd432..06996d471b59 100644
--- a/plugins/acl/static-role-based/pom.xml
+++ b/plugins/acl/static-role-based/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/explicit-dedication/pom.xml b/plugins/affinity-group-processors/explicit-dedication/pom.xml
index 1d5b5303c7e5..e134d687c892 100644
--- a/plugins/affinity-group-processors/explicit-dedication/pom.xml
+++ b/plugins/affinity-group-processors/explicit-dedication/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/host-affinity/pom.xml b/plugins/affinity-group-processors/host-affinity/pom.xml
index f0c13e050361..75aec801bee8 100644
--- a/plugins/affinity-group-processors/host-affinity/pom.xml
+++ b/plugins/affinity-group-processors/host-affinity/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/host-anti-affinity/pom.xml b/plugins/affinity-group-processors/host-anti-affinity/pom.xml
index 00895373ca94..d3d2e0b85630 100644
--- a/plugins/affinity-group-processors/host-anti-affinity/pom.xml
+++ b/plugins/affinity-group-processors/host-anti-affinity/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/non-strict-host-affinity/pom.xml b/plugins/affinity-group-processors/non-strict-host-affinity/pom.xml
index fc626289a35d..f6841ecce9c1 100644
--- a/plugins/affinity-group-processors/non-strict-host-affinity/pom.xml
+++ b/plugins/affinity-group-processors/non-strict-host-affinity/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/non-strict-host-anti-affinity/pom.xml b/plugins/affinity-group-processors/non-strict-host-anti-affinity/pom.xml
index b474f7647a9b..7222e80c3dcb 100644
--- a/plugins/affinity-group-processors/non-strict-host-anti-affinity/pom.xml
+++ b/plugins/affinity-group-processors/non-strict-host-anti-affinity/pom.xml
@@ -32,7 +32,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/alert-handlers/snmp-alerts/pom.xml b/plugins/alert-handlers/snmp-alerts/pom.xml
index 3beb2ce8d914..147e81506ec9 100644
--- a/plugins/alert-handlers/snmp-alerts/pom.xml
+++ b/plugins/alert-handlers/snmp-alerts/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/alert-handlers/syslog-alerts/pom.xml b/plugins/alert-handlers/syslog-alerts/pom.xml
index 5241ec011436..97f72217933d 100644
--- a/plugins/alert-handlers/syslog-alerts/pom.xml
+++ b/plugins/alert-handlers/syslog-alerts/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/api/discovery/pom.xml b/plugins/api/discovery/pom.xml
index 525a5583e51e..655568138cb8 100644
--- a/plugins/api/discovery/pom.xml
+++ b/plugins/api/discovery/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/api/rate-limit/pom.xml b/plugins/api/rate-limit/pom.xml
index 4d802cabac4f..4e524f32e4e9 100644
--- a/plugins/api/rate-limit/pom.xml
+++ b/plugins/api/rate-limit/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/plugins/api/solidfire-intg-test/pom.xml b/plugins/api/solidfire-intg-test/pom.xml
index ca2a0328cade..01ed3e70362c 100644
--- a/plugins/api/solidfire-intg-test/pom.xml
+++ b/plugins/api/solidfire-intg-test/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/api/vmware-sioc/pom.xml b/plugins/api/vmware-sioc/pom.xml
index 10a1853fedc1..9c6e783fb331 100644
--- a/plugins/api/vmware-sioc/pom.xml
+++ b/plugins/api/vmware-sioc/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/backup/dummy/pom.xml b/plugins/backup/dummy/pom.xml
index c15b5dcab63b..2006afc95e74 100644
--- a/plugins/backup/dummy/pom.xml
+++ b/plugins/backup/dummy/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/backup/nas/pom.xml b/plugins/backup/nas/pom.xml
index aae1e61970cc..f0c170c2aadd 100644
--- a/plugins/backup/nas/pom.xml
+++ b/plugins/backup/nas/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/backup/networker/pom.xml b/plugins/backup/networker/pom.xml
index 55b827e29d14..b52863e89ea8 100644
--- a/plugins/backup/networker/pom.xml
+++ b/plugins/backup/networker/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/backup/veeam/pom.xml b/plugins/backup/veeam/pom.xml
index dd145bc5e113..b64a68387ab1 100644
--- a/plugins/backup/veeam/pom.xml
+++ b/plugins/backup/veeam/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <artifactId>cloudstack-plugins</artifactId>
     <groupId>org.apache.cloudstack</groupId>
-    <version>4.22.1.0-SNAPSHOT</version>
+    <version>4.22.1.0</version>
     <relativePath>../../pom.xml</relativePath>
   </parent>
 
diff --git a/plugins/ca/root-ca/pom.xml b/plugins/ca/root-ca/pom.xml
index 501ba480b80e..6d9315f701a1 100644
--- a/plugins/ca/root-ca/pom.xml
+++ b/plugins/ca/root-ca/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/database/mysql-ha/pom.xml b/plugins/database/mysql-ha/pom.xml
index 518443c91e72..9ac00d1a5079 100644
--- a/plugins/database/mysql-ha/pom.xml
+++ b/plugins/database/mysql-ha/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/database/quota/pom.xml b/plugins/database/quota/pom.xml
index 5ecbefbcf2b6..56b8c0ab4ed6 100644
--- a/plugins/database/quota/pom.xml
+++ b/plugins/database/quota/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/dedicated-resources/pom.xml b/plugins/dedicated-resources/pom.xml
index 8d4c21e9cb26..a299dc77eb3e 100644
--- a/plugins/dedicated-resources/pom.xml
+++ b/plugins/dedicated-resources/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/deployment-planners/implicit-dedication/pom.xml b/plugins/deployment-planners/implicit-dedication/pom.xml
index bfc0e24a8ac8..162b3d2c84c4 100644
--- a/plugins/deployment-planners/implicit-dedication/pom.xml
+++ b/plugins/deployment-planners/implicit-dedication/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/deployment-planners/user-concentrated-pod/pom.xml b/plugins/deployment-planners/user-concentrated-pod/pom.xml
index ebbd879076c3..bba781a774a6 100644
--- a/plugins/deployment-planners/user-concentrated-pod/pom.xml
+++ b/plugins/deployment-planners/user-concentrated-pod/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/deployment-planners/user-dispersing/pom.xml b/plugins/deployment-planners/user-dispersing/pom.xml
index d811b5e88d1b..915dbede4f04 100644
--- a/plugins/deployment-planners/user-dispersing/pom.xml
+++ b/plugins/deployment-planners/user-dispersing/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/drs/cluster/balanced/pom.xml b/plugins/drs/cluster/balanced/pom.xml
index 5267d991b846..3d10f190270f 100644
--- a/plugins/drs/cluster/balanced/pom.xml
+++ b/plugins/drs/cluster/balanced/pom.xml
@@ -27,7 +27,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/drs/cluster/condensed/pom.xml b/plugins/drs/cluster/condensed/pom.xml
index d34f3564db51..a568064537c9 100644
--- a/plugins/drs/cluster/condensed/pom.xml
+++ b/plugins/drs/cluster/condensed/pom.xml
@@ -27,7 +27,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/event-bus/inmemory/pom.xml b/plugins/event-bus/inmemory/pom.xml
index 7704867bc708..e497f6dad9a9 100644
--- a/plugins/event-bus/inmemory/pom.xml
+++ b/plugins/event-bus/inmemory/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/event-bus/kafka/pom.xml b/plugins/event-bus/kafka/pom.xml
index 5231a723baab..91a78a260d24 100644
--- a/plugins/event-bus/kafka/pom.xml
+++ b/plugins/event-bus/kafka/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/event-bus/rabbitmq/pom.xml b/plugins/event-bus/rabbitmq/pom.xml
index 738cc7fce6dc..5a16ab17fe4d 100644
--- a/plugins/event-bus/rabbitmq/pom.xml
+++ b/plugins/event-bus/rabbitmq/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/event-bus/webhook/pom.xml b/plugins/event-bus/webhook/pom.xml
index 2bbd5b55c01b..83b4b77efbc0 100644
--- a/plugins/event-bus/webhook/pom.xml
+++ b/plugins/event-bus/webhook/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/ha-planners/skip-heurestics/pom.xml b/plugins/ha-planners/skip-heurestics/pom.xml
index e010e7108fc6..272a26bd3a14 100644
--- a/plugins/ha-planners/skip-heurestics/pom.xml
+++ b/plugins/ha-planners/skip-heurestics/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/host-allocators/random/pom.xml b/plugins/host-allocators/random/pom.xml
index d55436e846d3..bc1fdc55d6ed 100644
--- a/plugins/host-allocators/random/pom.xml
+++ b/plugins/host-allocators/random/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/hypervisors/baremetal/pom.xml b/plugins/hypervisors/baremetal/pom.xml
index bfdf58884a26..f5914e9b7730 100755
--- a/plugins/hypervisors/baremetal/pom.xml
+++ b/plugins/hypervisors/baremetal/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-hypervisor-baremetal</artifactId>
diff --git a/plugins/hypervisors/external/pom.xml b/plugins/hypervisors/external/pom.xml
index 8359b1de3ca3..8cc3a870221e 100644
--- a/plugins/hypervisors/external/pom.xml
+++ b/plugins/hypervisors/external/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-hypervisor-external</artifactId>
diff --git a/plugins/hypervisors/hyperv/pom.xml b/plugins/hypervisors/hyperv/pom.xml
index 758cee0ee63f..28f6c412b729 100644
--- a/plugins/hypervisors/hyperv/pom.xml
+++ b/plugins/hypervisors/hyperv/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <properties>
diff --git a/plugins/hypervisors/kvm/pom.xml b/plugins/hypervisors/kvm/pom.xml
index 7e3bd3847b19..883012d4cc54 100644
--- a/plugins/hypervisors/kvm/pom.xml
+++ b/plugins/hypervisors/kvm/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/hypervisors/simulator/pom.xml b/plugins/hypervisors/simulator/pom.xml
index f5942328e3cf..76d989edee13 100644
--- a/plugins/hypervisors/simulator/pom.xml
+++ b/plugins/hypervisors/simulator/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-hypervisor-simulator</artifactId>
diff --git a/plugins/hypervisors/ucs/pom.xml b/plugins/hypervisors/ucs/pom.xml
index 521dd7416b5c..8febcda74e0e 100644
--- a/plugins/hypervisors/ucs/pom.xml
+++ b/plugins/hypervisors/ucs/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-hypervisor-ucs</artifactId>
diff --git a/plugins/hypervisors/vmware/pom.xml b/plugins/hypervisors/vmware/pom.xml
index 355d4488ba90..3c3a38da45b4 100644
--- a/plugins/hypervisors/vmware/pom.xml
+++ b/plugins/hypervisors/vmware/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/hypervisors/xenserver/pom.xml b/plugins/hypervisors/xenserver/pom.xml
index cafa999d42dc..5eee2e47fc98 100644
--- a/plugins/hypervisors/xenserver/pom.xml
+++ b/plugins/hypervisors/xenserver/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/integrations/cloudian/pom.xml b/plugins/integrations/cloudian/pom.xml
index 69321f9e558c..7799a3e5a348 100644
--- a/plugins/integrations/cloudian/pom.xml
+++ b/plugins/integrations/cloudian/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/integrations/kubernetes-service/pom.xml b/plugins/integrations/kubernetes-service/pom.xml
index 9aad4d6d4304..24e42e15be8e 100644
--- a/plugins/integrations/kubernetes-service/pom.xml
+++ b/plugins/integrations/kubernetes-service/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/integrations/prometheus/pom.xml b/plugins/integrations/prometheus/pom.xml
index 378eab52471f..77a584c25dc7 100644
--- a/plugins/integrations/prometheus/pom.xml
+++ b/plugins/integrations/prometheus/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/maintenance/pom.xml b/plugins/maintenance/pom.xml
index 5290b5277674..65363e33b078 100644
--- a/plugins/maintenance/pom.xml
+++ b/plugins/maintenance/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/metrics/pom.xml b/plugins/metrics/pom.xml
index 6cba7d8bd043..25102cd6da5f 100644
--- a/plugins/metrics/pom.xml
+++ b/plugins/metrics/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/bigswitch/pom.xml b/plugins/network-elements/bigswitch/pom.xml
index b1a163eb3ee3..8729e12782da 100644
--- a/plugins/network-elements/bigswitch/pom.xml
+++ b/plugins/network-elements/bigswitch/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/brocade-vcs/pom.xml b/plugins/network-elements/brocade-vcs/pom.xml
index e3d7a6cf3adc..e4d29023fe98 100644
--- a/plugins/network-elements/brocade-vcs/pom.xml
+++ b/plugins/network-elements/brocade-vcs/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/plugins/network-elements/cisco-vnmc/pom.xml b/plugins/network-elements/cisco-vnmc/pom.xml
index 56ff642f549a..f29ed0a4b798 100644
--- a/plugins/network-elements/cisco-vnmc/pom.xml
+++ b/plugins/network-elements/cisco-vnmc/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/dns-notifier/pom.xml b/plugins/network-elements/dns-notifier/pom.xml
index 7f87c49a0d48..99451699621c 100644
--- a/plugins/network-elements/dns-notifier/pom.xml
+++ b/plugins/network-elements/dns-notifier/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-example-dns-notifier</artifactId>
diff --git a/plugins/network-elements/elastic-loadbalancer/pom.xml b/plugins/network-elements/elastic-loadbalancer/pom.xml
index 21ed6e32429b..1283c19bc45b 100644
--- a/plugins/network-elements/elastic-loadbalancer/pom.xml
+++ b/plugins/network-elements/elastic-loadbalancer/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/globodns/pom.xml b/plugins/network-elements/globodns/pom.xml
index a03bb1e3cd26..1f705b259278 100644
--- a/plugins/network-elements/globodns/pom.xml
+++ b/plugins/network-elements/globodns/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/internal-loadbalancer/pom.xml b/plugins/network-elements/internal-loadbalancer/pom.xml
index beb5a54f933b..fd426ae6f878 100644
--- a/plugins/network-elements/internal-loadbalancer/pom.xml
+++ b/plugins/network-elements/internal-loadbalancer/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/juniper-contrail/pom.xml b/plugins/network-elements/juniper-contrail/pom.xml
index 0b3f8bf0d203..c13c5be79121 100644
--- a/plugins/network-elements/juniper-contrail/pom.xml
+++ b/plugins/network-elements/juniper-contrail/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/netris/pom.xml b/plugins/network-elements/netris/pom.xml
index 1a3fe5d7e29b..fd3fb3fa9402 100644
--- a/plugins/network-elements/netris/pom.xml
+++ b/plugins/network-elements/netris/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/netscaler/pom.xml b/plugins/network-elements/netscaler/pom.xml
index ab51db5b4809..596e0f49ea78 100644
--- a/plugins/network-elements/netscaler/pom.xml
+++ b/plugins/network-elements/netscaler/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/nicira-nvp/pom.xml b/plugins/network-elements/nicira-nvp/pom.xml
index 40d4863decdf..cffdc20a3497 100644
--- a/plugins/network-elements/nicira-nvp/pom.xml
+++ b/plugins/network-elements/nicira-nvp/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/nsx/pom.xml b/plugins/network-elements/nsx/pom.xml
index 7dc31d625f3c..21297e7ce645 100644
--- a/plugins/network-elements/nsx/pom.xml
+++ b/plugins/network-elements/nsx/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/opendaylight/pom.xml b/plugins/network-elements/opendaylight/pom.xml
index a71b86dfecbf..a6d40c66ab42 100644
--- a/plugins/network-elements/opendaylight/pom.xml
+++ b/plugins/network-elements/opendaylight/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <profiles>
diff --git a/plugins/network-elements/ovs/pom.xml b/plugins/network-elements/ovs/pom.xml
index 24f622548c23..455078e985a2 100644
--- a/plugins/network-elements/ovs/pom.xml
+++ b/plugins/network-elements/ovs/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/palo-alto/pom.xml b/plugins/network-elements/palo-alto/pom.xml
index 3e821ec8109a..be8324a9b700 100644
--- a/plugins/network-elements/palo-alto/pom.xml
+++ b/plugins/network-elements/palo-alto/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/stratosphere-ssp/pom.xml b/plugins/network-elements/stratosphere-ssp/pom.xml
index 1703012eff36..6a6f10c49943 100644
--- a/plugins/network-elements/stratosphere-ssp/pom.xml
+++ b/plugins/network-elements/stratosphere-ssp/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/tungsten/pom.xml b/plugins/network-elements/tungsten/pom.xml
index 793d754baffc..51e8133a7832 100644
--- a/plugins/network-elements/tungsten/pom.xml
+++ b/plugins/network-elements/tungsten/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/plugins/network-elements/vxlan/pom.xml b/plugins/network-elements/vxlan/pom.xml
index 1192c98acafa..26f32d65be2f 100644
--- a/plugins/network-elements/vxlan/pom.xml
+++ b/plugins/network-elements/vxlan/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/outofbandmanagement-drivers/ipmitool/pom.xml b/plugins/outofbandmanagement-drivers/ipmitool/pom.xml
index debeb7daab29..78ab611bda05 100644
--- a/plugins/outofbandmanagement-drivers/ipmitool/pom.xml
+++ b/plugins/outofbandmanagement-drivers/ipmitool/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/outofbandmanagement-drivers/nested-cloudstack/pom.xml b/plugins/outofbandmanagement-drivers/nested-cloudstack/pom.xml
index 9c5e44195abd..67cb45c70191 100644
--- a/plugins/outofbandmanagement-drivers/nested-cloudstack/pom.xml
+++ b/plugins/outofbandmanagement-drivers/nested-cloudstack/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/outofbandmanagement-drivers/redfish/pom.xml b/plugins/outofbandmanagement-drivers/redfish/pom.xml
index 0d1b292812d7..d5f1cc19ca64 100644
--- a/plugins/outofbandmanagement-drivers/redfish/pom.xml
+++ b/plugins/outofbandmanagement-drivers/redfish/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/pom.xml b/plugins/pom.xml
index 16e5ed1d8f59..6d7f9665ed66 100755
--- a/plugins/pom.xml
+++ b/plugins/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <build>
         <plugins>
diff --git a/plugins/storage-allocators/random/pom.xml b/plugins/storage-allocators/random/pom.xml
index b1a1c2604a74..6281ba6f76a9 100644
--- a/plugins/storage-allocators/random/pom.xml
+++ b/plugins/storage-allocators/random/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/image/default/pom.xml b/plugins/storage/image/default/pom.xml
index 1bac038c6a97..2756b865aafe 100644
--- a/plugins/storage/image/default/pom.xml
+++ b/plugins/storage/image/default/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/image/s3/pom.xml b/plugins/storage/image/s3/pom.xml
index 9c3ea94130dd..0a5f5212939f 100644
--- a/plugins/storage/image/s3/pom.xml
+++ b/plugins/storage/image/s3/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/image/sample/pom.xml b/plugins/storage/image/sample/pom.xml
index 586eb10f28f8..0ba1d96507ff 100644
--- a/plugins/storage/image/sample/pom.xml
+++ b/plugins/storage/image/sample/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/image/swift/pom.xml b/plugins/storage/image/swift/pom.xml
index 407106ce935e..85319d7a81a9 100644
--- a/plugins/storage/image/swift/pom.xml
+++ b/plugins/storage/image/swift/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/object/ceph/pom.xml b/plugins/storage/object/ceph/pom.xml
index f6138add95d3..31468200641f 100644
--- a/plugins/storage/object/ceph/pom.xml
+++ b/plugins/storage/object/ceph/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/object/cloudian/pom.xml b/plugins/storage/object/cloudian/pom.xml
index 81c78a8d346a..ac08a7a7d849 100644
--- a/plugins/storage/object/cloudian/pom.xml
+++ b/plugins/storage/object/cloudian/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/object/minio/pom.xml b/plugins/storage/object/minio/pom.xml
index 61b9838de49a..15e6f44db616 100644
--- a/plugins/storage/object/minio/pom.xml
+++ b/plugins/storage/object/minio/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/object/simulator/pom.xml b/plugins/storage/object/simulator/pom.xml
index 6efbd1c41aa3..71778dffcf4b 100644
--- a/plugins/storage/object/simulator/pom.xml
+++ b/plugins/storage/object/simulator/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/sharedfs/storagevm/pom.xml b/plugins/storage/sharedfs/storagevm/pom.xml
index 34594898cc05..555b61508ade 100644
--- a/plugins/storage/sharedfs/storagevm/pom.xml
+++ b/plugins/storage/sharedfs/storagevm/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/storage/volume/adaptive/pom.xml b/plugins/storage/volume/adaptive/pom.xml
index e625cd66f53b..8cc14a192d4b 100644
--- a/plugins/storage/volume/adaptive/pom.xml
+++ b/plugins/storage/volume/adaptive/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/cloudbyte/pom.xml b/plugins/storage/volume/cloudbyte/pom.xml
index 77dadb4ec8fe..aff11e4f9712 100644
--- a/plugins/storage/volume/cloudbyte/pom.xml
+++ b/plugins/storage/volume/cloudbyte/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/datera/pom.xml b/plugins/storage/volume/datera/pom.xml
index 84a5e4c27480..91d26224a563 100644
--- a/plugins/storage/volume/datera/pom.xml
+++ b/plugins/storage/volume/datera/pom.xml
@@ -16,7 +16,7 @@
   <parent>
     <groupId>org.apache.cloudstack</groupId>
     <artifactId>cloudstack-plugins</artifactId>
-    <version>4.22.1.0-SNAPSHOT</version>
+    <version>4.22.1.0</version>
     <relativePath>../../../pom.xml</relativePath>
   </parent>
   <dependencies>
diff --git a/plugins/storage/volume/default/pom.xml b/plugins/storage/volume/default/pom.xml
index 02e2fb88b229..c79103a54d9e 100644
--- a/plugins/storage/volume/default/pom.xml
+++ b/plugins/storage/volume/default/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/flasharray/pom.xml b/plugins/storage/volume/flasharray/pom.xml
index a6da4cf9d582..fc730cd595ff 100644
--- a/plugins/storage/volume/flasharray/pom.xml
+++ b/plugins/storage/volume/flasharray/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/linstor/pom.xml b/plugins/storage/volume/linstor/pom.xml
index ee72aab66a38..a04810b91c6c 100644
--- a/plugins/storage/volume/linstor/pom.xml
+++ b/plugins/storage/volume/linstor/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/nexenta/pom.xml b/plugins/storage/volume/nexenta/pom.xml
index d9ed6fd64a49..c802d5b1e988 100644
--- a/plugins/storage/volume/nexenta/pom.xml
+++ b/plugins/storage/volume/nexenta/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/primera/pom.xml b/plugins/storage/volume/primera/pom.xml
index 4f1583a8a7b3..a55d1cda6dc3 100644
--- a/plugins/storage/volume/primera/pom.xml
+++ b/plugins/storage/volume/primera/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/sample/pom.xml b/plugins/storage/volume/sample/pom.xml
index 0a9de06ba623..5d9be3fd6eb8 100644
--- a/plugins/storage/volume/sample/pom.xml
+++ b/plugins/storage/volume/sample/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/scaleio/pom.xml b/plugins/storage/volume/scaleio/pom.xml
index 79a707ba7d54..c2ebfba29b9c 100644
--- a/plugins/storage/volume/scaleio/pom.xml
+++ b/plugins/storage/volume/scaleio/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/solidfire/pom.xml b/plugins/storage/volume/solidfire/pom.xml
index 65a91afc10e3..27cd8cd29511 100644
--- a/plugins/storage/volume/solidfire/pom.xml
+++ b/plugins/storage/volume/solidfire/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/storpool/pom.xml b/plugins/storage/volume/storpool/pom.xml
index 0829575b2295..a3913800f453 100644
--- a/plugins/storage/volume/storpool/pom.xml
+++ b/plugins/storage/volume/storpool/pom.xml
@@ -17,7 +17,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/user-authenticators/ldap/pom.xml b/plugins/user-authenticators/ldap/pom.xml
index 7f58d8fa28a7..28da0df580e6 100644
--- a/plugins/user-authenticators/ldap/pom.xml
+++ b/plugins/user-authenticators/ldap/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/plugins/user-authenticators/md5/pom.xml b/plugins/user-authenticators/md5/pom.xml
index 11f0a4272307..9c0548a7c9cc 100644
--- a/plugins/user-authenticators/md5/pom.xml
+++ b/plugins/user-authenticators/md5/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-authenticators/oauth2/pom.xml b/plugins/user-authenticators/oauth2/pom.xml
index 8caf06ff8143..ddd4b6ecd5ee 100644
--- a/plugins/user-authenticators/oauth2/pom.xml
+++ b/plugins/user-authenticators/oauth2/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/user-authenticators/pbkdf2/pom.xml b/plugins/user-authenticators/pbkdf2/pom.xml
index 75351f20f3f4..89bb93ad29cc 100644
--- a/plugins/user-authenticators/pbkdf2/pom.xml
+++ b/plugins/user-authenticators/pbkdf2/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-authenticators/plain-text/pom.xml b/plugins/user-authenticators/plain-text/pom.xml
index ceddc54e34d4..4eee43ee4010 100644
--- a/plugins/user-authenticators/plain-text/pom.xml
+++ b/plugins/user-authenticators/plain-text/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-authenticators/saml2/pom.xml b/plugins/user-authenticators/saml2/pom.xml
index 8802ab9260f0..9c56d11b55b3 100644
--- a/plugins/user-authenticators/saml2/pom.xml
+++ b/plugins/user-authenticators/saml2/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/user-authenticators/sha256salted/pom.xml b/plugins/user-authenticators/sha256salted/pom.xml
index 2938e21e2094..b59e1b6120d6 100644
--- a/plugins/user-authenticators/sha256salted/pom.xml
+++ b/plugins/user-authenticators/sha256salted/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-two-factor-authenticators/static-pin/pom.xml b/plugins/user-two-factor-authenticators/static-pin/pom.xml
index 1fe95fa3913d..781a1d97a706 100644
--- a/plugins/user-two-factor-authenticators/static-pin/pom.xml
+++ b/plugins/user-two-factor-authenticators/static-pin/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-two-factor-authenticators/totp/pom.xml b/plugins/user-two-factor-authenticators/totp/pom.xml
index dcf051f92170..87f8d9b3bf42 100644
--- a/plugins/user-two-factor-authenticators/totp/pom.xml
+++ b/plugins/user-two-factor-authenticators/totp/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/pom.xml b/pom.xml
index b4e2ec57f81b..4cc6b5914836 100644
--- a/pom.xml
+++ b/pom.xml
@@ -29,7 +29,7 @@
 
     <groupId>org.apache.cloudstack</groupId>
     <artifactId>cloudstack</artifactId>
-    <version>4.22.1.0-SNAPSHOT</version>
+    <version>4.22.1.0</version>
     <packaging>pom</packaging>
     <name>Apache CloudStack</name>
     <description>Apache CloudStack is an IaaS ("Infrastructure as a Service") cloud orchestration platform.</description>
diff --git a/quickcloud/pom.xml b/quickcloud/pom.xml
index d4d759f8986a..2130fd87aa7e 100644
--- a/quickcloud/pom.xml
+++ b/quickcloud/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/server/pom.xml b/server/pom.xml
index 3324cdb2e619..3e91e5a29061 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
 
     <dependencies>
@@ -194,7 +194,7 @@
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-framework-extensions</artifactId>
-            <version>4.22.1.0-SNAPSHOT</version>
+            <version>4.22.1.0</version>
             <scope>compile</scope>
         </dependency>
     </dependencies>
diff --git a/services/console-proxy/pom.xml b/services/console-proxy/pom.xml
index 43d32fdf61b9..7ccbe9a1a1f8 100644
--- a/services/console-proxy/pom.xml
+++ b/services/console-proxy/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-services</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/services/console-proxy/rdpconsole/pom.xml b/services/console-proxy/rdpconsole/pom.xml
index 541648827c66..ce8f587f1f1a 100644
--- a/services/console-proxy/rdpconsole/pom.xml
+++ b/services/console-proxy/rdpconsole/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-service-console-proxy</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/services/console-proxy/server/pom.xml b/services/console-proxy/server/pom.xml
index cff9ae3cfcb6..8da4335bd235 100644
--- a/services/console-proxy/server/pom.xml
+++ b/services/console-proxy/server/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-service-console-proxy</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/services/pom.xml b/services/pom.xml
index 2205e460ee0c..5e7315e347d5 100644
--- a/services/pom.xml
+++ b/services/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/services/secondary-storage/controller/pom.xml b/services/secondary-storage/controller/pom.xml
index e3847e294fc1..62c6c098ed09 100644
--- a/services/secondary-storage/controller/pom.xml
+++ b/services/secondary-storage/controller/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-service-secondary-storage</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/services/secondary-storage/pom.xml b/services/secondary-storage/pom.xml
index c1d3f9016151..f96826f02d4a 100644
--- a/services/secondary-storage/pom.xml
+++ b/services/secondary-storage/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-services</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/services/secondary-storage/server/pom.xml b/services/secondary-storage/server/pom.xml
index ca878ce9ba61..1ac2f00e8d44 100644
--- a/services/secondary-storage/server/pom.xml
+++ b/services/secondary-storage/server/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-service-secondary-storage</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/systemvm/pom.xml b/systemvm/pom.xml
index e2a0315300ba..a949df8befcb 100644
--- a/systemvm/pom.xml
+++ b/systemvm/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <properties>
diff --git a/test/pom.xml b/test/pom.xml
index dd1bdf4ceb84..605915c5defa 100644
--- a/test/pom.xml
+++ b/test/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/tools/apidoc/pom.xml b/tools/apidoc/pom.xml
index e9b81eedd5fb..67c40ddcca0b 100644
--- a/tools/apidoc/pom.xml
+++ b/tools/apidoc/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-tools</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <properties>
diff --git a/tools/checkstyle/pom.xml b/tools/checkstyle/pom.xml
index 0fb0efacd608..f5221fd67902 100644
--- a/tools/checkstyle/pom.xml
+++ b/tools/checkstyle/pom.xml
@@ -22,7 +22,7 @@
     <name>Apache CloudStack Developer Tools - Checkstyle Configuration</name>
     <groupId>org.apache.cloudstack</groupId>
     <artifactId>checkstyle</artifactId>
-    <version>4.22.1.0-SNAPSHOT</version>
+    <version>4.22.1.0</version>
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
diff --git a/tools/devcloud-kvm/pom.xml b/tools/devcloud-kvm/pom.xml
index 4990f0af8be3..ab0eeda2b547 100644
--- a/tools/devcloud-kvm/pom.xml
+++ b/tools/devcloud-kvm/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-tools</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/tools/devcloud4/pom.xml b/tools/devcloud4/pom.xml
index 1aa48c4b2d0d..ec89ae6abac7 100644
--- a/tools/devcloud4/pom.xml
+++ b/tools/devcloud4/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-tools</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
index 67a986e994ab..7cb2efb3d4df 100644
--- a/tools/docker/Dockerfile
+++ b/tools/docker/Dockerfile
@@ -19,7 +19,7 @@
 
 FROM ubuntu:22.04
 
-LABEL Vendor="Apache.org" License="ApacheV2" Version="4.22.1.0-SNAPSHOT" Author="Apache CloudStack <dev@cloudstack.apache.org>"
+LABEL Vendor="Apache.org" License="ApacheV2" Version="4.22.1.0" Author="Apache CloudStack <dev@cloudstack.apache.org>"
 
 ARG DEBIAN_FRONTEND=noninteractive
 
diff --git a/tools/docker/Dockerfile.marvin b/tools/docker/Dockerfile.marvin
index d615a78eb6bb..3e060b0f481c 100644
--- a/tools/docker/Dockerfile.marvin
+++ b/tools/docker/Dockerfile.marvin
@@ -19,11 +19,11 @@
 # build for cloudstack_home_dir not this folder
 FROM python:2
 
-LABEL Vendor="Apache.org" License="ApacheV2" Version="4.22.1.0-SNAPSHOT" Author="Apache CloudStack <dev@cloudstack.apache.org>"
+LABEL Vendor="Apache.org" License="ApacheV2" Version="4.22.1.0" Author="Apache CloudStack <dev@cloudstack.apache.org>"
 
 ENV WORK_DIR=/marvin
 
-ENV PKG_URL=https://builds.cloudstack.org/job/build-master-marvin/lastSuccessfulBuild/artifact/tools/marvin/dist/Marvin-4.22.1.0-SNAPSHOT.tar.gz
+ENV PKG_URL=https://builds.cloudstack.org/job/build-master-marvin/lastSuccessfulBuild/artifact/tools/marvin/dist/Marvin-4.22.1.0.tar.gz
 
 RUN apt-get update && apt-get install -y vim
 RUN pip install --upgrade paramiko nose requests
diff --git a/tools/marvin/pom.xml b/tools/marvin/pom.xml
index 907e9931015d..70e39a911d36 100644
--- a/tools/marvin/pom.xml
+++ b/tools/marvin/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-tools</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/tools/marvin/setup.py b/tools/marvin/setup.py
index ad0f245d68f3..66eb32111675 100644
--- a/tools/marvin/setup.py
+++ b/tools/marvin/setup.py
@@ -27,7 +27,7 @@
         raise RuntimeError("python setuptools is required to build Marvin")
 
 
-VERSION = "4.22.1.0-SNAPSHOT"
+VERSION = "4.22.1.0"
 
 setup(name="Marvin",
       version=VERSION,
diff --git a/tools/pom.xml b/tools/pom.xml
index ffa363d4a265..15335c5f2fd6 100644
--- a/tools/pom.xml
+++ b/tools/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/usage/pom.xml b/usage/pom.xml
index 7f5b0ba527d5..f51ffce2a5d7 100644
--- a/usage/pom.xml
+++ b/usage/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/utils/pom.xml b/utils/pom.xml
index ee6df9602b8f..7cb2df1deb37 100755
--- a/utils/pom.xml
+++ b/utils/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/vmware-base/pom.xml b/vmware-base/pom.xml
index 9b7b989a8901..53abed35493b 100644
--- a/vmware-base/pom.xml
+++ b/vmware-base/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.1.0</version>
     </parent>
     <dependencies>
         <dependency>

From 5893ba5a8c00aa445be252e2dd0bc557b0cec3fc Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Tue, 12 May 2026 04:07:20 -0300
Subject: [PATCH 28/64] server: Fix NPE when on findHostsForMigration when no
 suitable hosts are found (#13138)

---
 .../cloud/server/ManagementServerImpl.java    | 13 +++----
 .../server/ManagementServerImplTest.java      | 39 +++++++++++++++++--
 2 files changed, 41 insertions(+), 11 deletions(-)

diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index 70a434e4a96e..e5066b6da5cc 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -1707,16 +1707,15 @@ protected List<Host> getCapableSuitableHosts(
 
         if (CollectionUtils.isEmpty(suitableHosts)) {
             logger.warn("No suitable hosts found.");
-        } else {
-            logger.debug("Hosts having capacity and are suitable for migration: {}", suitableHosts);
+            return suitableHosts;
         }
 
+        logger.debug("Hosts having capacity and are suitable for migration: {}", suitableHosts);
+
         // Only list hosts of the same architecture as the source Host in a multi-arch zone
-        if (!suitableHosts.isEmpty()) {
-            List<CPU.CPUArch> clusterArchs = ApiDBUtils.listZoneClustersArchs(vm.getDataCenterId());
-            if (CollectionUtils.isNotEmpty(clusterArchs) && clusterArchs.size() > 1) {
-                suitableHosts = suitableHosts.stream().filter(h -> h.getArch() == srcHost.getArch()).collect(Collectors.toList());
-            }
+        List<CPU.CPUArch> clusterArchs = ApiDBUtils.listZoneClustersArchs(vm.getDataCenterId());
+        if (CollectionUtils.isNotEmpty(clusterArchs) && clusterArchs.size() > 1) {
+            suitableHosts = suitableHosts.stream().filter(h -> h.getArch() == srcHost.getArch()).collect(Collectors.toList());
         }
 
         return suitableHosts;
diff --git a/server/src/test/java/com/cloud/server/ManagementServerImplTest.java b/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
index b569368f2482..924bf1135a67 100644
--- a/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
+++ b/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
@@ -23,6 +23,10 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.when;
 
+import com.cloud.deploy.DataCenterDeployment;
+import com.cloud.deploy.DeploymentPlanner;
+import com.cloud.deploy.DeploymentPlanningManager;
+import com.cloud.vm.VirtualMachineProfile;
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -181,6 +185,24 @@ public class ManagementServerImplTest {
     @Mock
     HostAllocator hostAllocator;
 
+    @Mock
+    VirtualMachine virtualMachineMock;
+
+    @Mock
+    VirtualMachineProfile virtualMachineProfileMock;
+
+    @Mock
+    DataCenterDeployment dataCenterDeploymentMock;
+
+    @Mock
+    DeploymentPlanner.ExcludeList excludeListMock;
+
+    @Mock
+    Host hostMock;
+
+    @Mock
+    DeploymentPlanningManager deploymentPlanningManagerMock;
+
     private AutoCloseable closeable;
     private MockedStatic<ApiDBUtils> apiDBUtilsMock;
 
@@ -1053,10 +1075,19 @@ public void testListGuestOSCategoriesByCriteria_FilterById() {
 
     @Test
     public void testGetExternalVmConsole() {
-        VirtualMachine virtualMachine = Mockito.mock(VirtualMachine.class);
         Host host = Mockito.mock(Host.class);
-        Mockito.when(extensionManager.getInstanceConsole(virtualMachine, host)).thenReturn(Mockito.mock(com.cloud.agent.api.Answer.class));
-        Assert.assertNotNull(spy.getExternalVmConsole(virtualMachine, host));
-        Mockito.verify(extensionManager).getInstanceConsole(virtualMachine, host);
+        Mockito.when(extensionManager.getInstanceConsole(virtualMachineMock, host)).thenReturn(Mockito.mock(com.cloud.agent.api.Answer.class));
+        Assert.assertNotNull(spy.getExternalVmConsole(virtualMachineMock, host));
+        Mockito.verify(extensionManager).getInstanceConsole(virtualMachineMock, host);
+    }
+
+    @Test
+    public void getCapableSuitableHostsTestHostArchIsNotFilteredWhenNoSuitableHostsAreFound() {
+        List<Host> compatibleHosts = List.of(hostMock);
+        Mockito.doReturn(null).when(hostAllocator).allocateTo(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean());
+
+        spy.getCapableSuitableHosts(virtualMachineMock, virtualMachineProfileMock, dataCenterDeploymentMock, compatibleHosts, excludeListMock, hostMock);
+
+        apiDBUtilsMock.verify(() -> ApiDBUtils.listZoneClustersArchs(Mockito.anyLong()), Mockito.never());
     }
 }

From 79bb8ef1cc3c89b144f9623d638c893258438848 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Mon, 18 May 2026 17:17:25 +0530
Subject: [PATCH 29/64] Updating pom.xml version numbers for release
 4.22.2.0-SNAPSHOT

Signed-off-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
---
 agent/pom.xml                                               | 2 +-
 api/pom.xml                                                 | 2 +-
 client/pom.xml                                              | 2 +-
 core/pom.xml                                                | 2 +-
 developer/pom.xml                                           | 2 +-
 engine/api/pom.xml                                          | 2 +-
 engine/components-api/pom.xml                               | 2 +-
 engine/orchestration/pom.xml                                | 2 +-
 engine/pom.xml                                              | 2 +-
 engine/schema/pom.xml                                       | 2 +-
 engine/service/pom.xml                                      | 2 +-
 engine/storage/cache/pom.xml                                | 2 +-
 engine/storage/configdrive/pom.xml                          | 2 +-
 engine/storage/datamotion/pom.xml                           | 2 +-
 engine/storage/image/pom.xml                                | 2 +-
 engine/storage/integration-test/pom.xml                     | 2 +-
 engine/storage/object/pom.xml                               | 2 +-
 engine/storage/pom.xml                                      | 2 +-
 engine/storage/snapshot/pom.xml                             | 2 +-
 engine/storage/volume/pom.xml                               | 2 +-
 engine/userdata/cloud-init/pom.xml                          | 2 +-
 engine/userdata/pom.xml                                     | 2 +-
 framework/agent-lb/pom.xml                                  | 2 +-
 framework/ca/pom.xml                                        | 2 +-
 framework/cluster/pom.xml                                   | 2 +-
 framework/config/pom.xml                                    | 2 +-
 framework/db/pom.xml                                        | 2 +-
 framework/direct-download/pom.xml                           | 2 +-
 framework/events/pom.xml                                    | 2 +-
 framework/extensions/pom.xml                                | 6 +++---
 framework/ipc/pom.xml                                       | 2 +-
 framework/jobs/pom.xml                                      | 2 +-
 framework/managed-context/pom.xml                           | 2 +-
 framework/pom.xml                                           | 2 +-
 framework/quota/pom.xml                                     | 2 +-
 framework/rest/pom.xml                                      | 2 +-
 framework/security/pom.xml                                  | 2 +-
 framework/spring/lifecycle/pom.xml                          | 2 +-
 framework/spring/module/pom.xml                             | 2 +-
 plugins/acl/dynamic-role-based/pom.xml                      | 2 +-
 plugins/acl/project-role-based/pom.xml                      | 2 +-
 plugins/acl/static-role-based/pom.xml                       | 2 +-
 .../affinity-group-processors/explicit-dedication/pom.xml   | 2 +-
 plugins/affinity-group-processors/host-affinity/pom.xml     | 2 +-
 .../affinity-group-processors/host-anti-affinity/pom.xml    | 2 +-
 .../non-strict-host-affinity/pom.xml                        | 2 +-
 .../non-strict-host-anti-affinity/pom.xml                   | 2 +-
 plugins/alert-handlers/snmp-alerts/pom.xml                  | 2 +-
 plugins/alert-handlers/syslog-alerts/pom.xml                | 2 +-
 plugins/api/discovery/pom.xml                               | 2 +-
 plugins/api/rate-limit/pom.xml                              | 2 +-
 plugins/api/solidfire-intg-test/pom.xml                     | 2 +-
 plugins/api/vmware-sioc/pom.xml                             | 2 +-
 plugins/backup/dummy/pom.xml                                | 2 +-
 plugins/backup/nas/pom.xml                                  | 2 +-
 plugins/backup/networker/pom.xml                            | 2 +-
 plugins/backup/veeam/pom.xml                                | 2 +-
 plugins/ca/root-ca/pom.xml                                  | 2 +-
 plugins/database/mysql-ha/pom.xml                           | 2 +-
 plugins/database/quota/pom.xml                              | 2 +-
 plugins/dedicated-resources/pom.xml                         | 2 +-
 plugins/deployment-planners/implicit-dedication/pom.xml     | 2 +-
 plugins/deployment-planners/user-concentrated-pod/pom.xml   | 2 +-
 plugins/deployment-planners/user-dispersing/pom.xml         | 2 +-
 plugins/drs/cluster/balanced/pom.xml                        | 2 +-
 plugins/drs/cluster/condensed/pom.xml                       | 2 +-
 plugins/event-bus/inmemory/pom.xml                          | 2 +-
 plugins/event-bus/kafka/pom.xml                             | 2 +-
 plugins/event-bus/rabbitmq/pom.xml                          | 2 +-
 plugins/event-bus/webhook/pom.xml                           | 2 +-
 plugins/ha-planners/skip-heurestics/pom.xml                 | 2 +-
 plugins/host-allocators/random/pom.xml                      | 2 +-
 plugins/hypervisors/baremetal/pom.xml                       | 2 +-
 plugins/hypervisors/external/pom.xml                        | 2 +-
 plugins/hypervisors/hyperv/pom.xml                          | 2 +-
 plugins/hypervisors/kvm/pom.xml                             | 2 +-
 plugins/hypervisors/ovm/pom.xml                             | 2 +-
 plugins/hypervisors/ovm3/pom.xml                            | 2 +-
 plugins/hypervisors/simulator/pom.xml                       | 2 +-
 plugins/hypervisors/ucs/pom.xml                             | 2 +-
 plugins/hypervisors/vmware/pom.xml                          | 2 +-
 plugins/hypervisors/xenserver/pom.xml                       | 2 +-
 plugins/integrations/cloudian/pom.xml                       | 2 +-
 plugins/integrations/kubernetes-service/pom.xml             | 2 +-
 plugins/integrations/prometheus/pom.xml                     | 2 +-
 plugins/maintenance/pom.xml                                 | 2 +-
 plugins/metrics/pom.xml                                     | 2 +-
 plugins/network-elements/bigswitch/pom.xml                  | 2 +-
 plugins/network-elements/brocade-vcs/pom.xml                | 2 +-
 plugins/network-elements/cisco-vnmc/pom.xml                 | 2 +-
 plugins/network-elements/dns-notifier/pom.xml               | 2 +-
 plugins/network-elements/elastic-loadbalancer/pom.xml       | 2 +-
 plugins/network-elements/globodns/pom.xml                   | 2 +-
 plugins/network-elements/internal-loadbalancer/pom.xml      | 2 +-
 plugins/network-elements/juniper-contrail/pom.xml           | 2 +-
 plugins/network-elements/netris/pom.xml                     | 2 +-
 plugins/network-elements/netscaler/pom.xml                  | 2 +-
 plugins/network-elements/nicira-nvp/pom.xml                 | 2 +-
 plugins/network-elements/nsx/pom.xml                        | 2 +-
 plugins/network-elements/opendaylight/pom.xml               | 2 +-
 plugins/network-elements/ovs/pom.xml                        | 2 +-
 plugins/network-elements/palo-alto/pom.xml                  | 2 +-
 plugins/network-elements/stratosphere-ssp/pom.xml           | 2 +-
 plugins/network-elements/tungsten/pom.xml                   | 2 +-
 plugins/network-elements/vxlan/pom.xml                      | 2 +-
 plugins/outofbandmanagement-drivers/ipmitool/pom.xml        | 2 +-
 .../outofbandmanagement-drivers/nested-cloudstack/pom.xml   | 2 +-
 plugins/outofbandmanagement-drivers/redfish/pom.xml         | 2 +-
 plugins/pom.xml                                             | 2 +-
 plugins/storage-allocators/random/pom.xml                   | 2 +-
 plugins/storage/image/default/pom.xml                       | 2 +-
 plugins/storage/image/s3/pom.xml                            | 2 +-
 plugins/storage/image/sample/pom.xml                        | 2 +-
 plugins/storage/image/swift/pom.xml                         | 2 +-
 plugins/storage/object/ceph/pom.xml                         | 2 +-
 plugins/storage/object/cloudian/pom.xml                     | 2 +-
 plugins/storage/object/minio/pom.xml                        | 2 +-
 plugins/storage/object/simulator/pom.xml                    | 2 +-
 plugins/storage/sharedfs/storagevm/pom.xml                  | 2 +-
 plugins/storage/volume/adaptive/pom.xml                     | 2 +-
 plugins/storage/volume/cloudbyte/pom.xml                    | 2 +-
 plugins/storage/volume/datera/pom.xml                       | 2 +-
 plugins/storage/volume/default/pom.xml                      | 2 +-
 plugins/storage/volume/flasharray/pom.xml                   | 2 +-
 plugins/storage/volume/linstor/pom.xml                      | 2 +-
 plugins/storage/volume/nexenta/pom.xml                      | 2 +-
 plugins/storage/volume/primera/pom.xml                      | 2 +-
 plugins/storage/volume/sample/pom.xml                       | 2 +-
 plugins/storage/volume/scaleio/pom.xml                      | 2 +-
 plugins/storage/volume/solidfire/pom.xml                    | 2 +-
 plugins/storage/volume/storpool/pom.xml                     | 2 +-
 plugins/user-authenticators/ldap/pom.xml                    | 2 +-
 plugins/user-authenticators/md5/pom.xml                     | 2 +-
 plugins/user-authenticators/oauth2/pom.xml                  | 2 +-
 plugins/user-authenticators/pbkdf2/pom.xml                  | 2 +-
 plugins/user-authenticators/plain-text/pom.xml              | 2 +-
 plugins/user-authenticators/saml2/pom.xml                   | 2 +-
 plugins/user-authenticators/sha256salted/pom.xml            | 2 +-
 plugins/user-two-factor-authenticators/static-pin/pom.xml   | 2 +-
 plugins/user-two-factor-authenticators/totp/pom.xml         | 2 +-
 pom.xml                                                     | 2 +-
 quickcloud/pom.xml                                          | 2 +-
 server/pom.xml                                              | 4 ++--
 services/console-proxy/pom.xml                              | 2 +-
 services/console-proxy/rdpconsole/pom.xml                   | 2 +-
 services/console-proxy/server/pom.xml                       | 2 +-
 services/pom.xml                                            | 2 +-
 services/secondary-storage/controller/pom.xml               | 2 +-
 services/secondary-storage/pom.xml                          | 2 +-
 services/secondary-storage/server/pom.xml                   | 2 +-
 systemvm/pom.xml                                            | 2 +-
 test/pom.xml                                                | 2 +-
 tools/apidoc/pom.xml                                        | 2 +-
 tools/checkstyle/pom.xml                                    | 2 +-
 tools/devcloud-kvm/pom.xml                                  | 2 +-
 tools/devcloud4/pom.xml                                     | 2 +-
 tools/docker/Dockerfile                                     | 2 +-
 tools/docker/Dockerfile.marvin                              | 4 ++--
 tools/marvin/pom.xml                                        | 2 +-
 tools/marvin/setup.py                                       | 2 +-
 tools/pom.xml                                               | 2 +-
 usage/pom.xml                                               | 2 +-
 utils/pom.xml                                               | 2 +-
 vmware-base/pom.xml                                         | 2 +-
 164 files changed, 168 insertions(+), 168 deletions(-)

diff --git a/agent/pom.xml b/agent/pom.xml
index 70fdea6d0c59..3064fd2cab21 100644
--- a/agent/pom.xml
+++ b/agent/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/api/pom.xml b/api/pom.xml
index 03abe9ee30bf..d5791bed38e6 100644
--- a/api/pom.xml
+++ b/api/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/client/pom.xml b/client/pom.xml
index e97b5474d733..85519e16c2c5 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/core/pom.xml b/core/pom.xml
index 8012f3747ada..6324e36563fb 100644
--- a/core/pom.xml
+++ b/core/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/developer/pom.xml b/developer/pom.xml
index b22140ea70e1..69725b60fe99 100644
--- a/developer/pom.xml
+++ b/developer/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/engine/api/pom.xml b/engine/api/pom.xml
index e23593f34ff7..425c51205fa7 100644
--- a/engine/api/pom.xml
+++ b/engine/api/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/components-api/pom.xml b/engine/components-api/pom.xml
index 940fd8050f3e..1a207403c64a 100644
--- a/engine/components-api/pom.xml
+++ b/engine/components-api/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/orchestration/pom.xml b/engine/orchestration/pom.xml
index 44b57a821479..0f321be6bd60 100755
--- a/engine/orchestration/pom.xml
+++ b/engine/orchestration/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/pom.xml b/engine/pom.xml
index dcd65661f57b..ce8161ce93a8 100644
--- a/engine/pom.xml
+++ b/engine/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/engine/schema/pom.xml b/engine/schema/pom.xml
index ceedce8a140d..f740f7ee5f8a 100644
--- a/engine/schema/pom.xml
+++ b/engine/schema/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/service/pom.xml b/engine/service/pom.xml
index fa324fb9398d..6f09ce71a0e4 100644
--- a/engine/service/pom.xml
+++ b/engine/service/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <artifactId>cloud-engine-service</artifactId>
     <packaging>war</packaging>
diff --git a/engine/storage/cache/pom.xml b/engine/storage/cache/pom.xml
index 1eda5b66aaf2..7eb7ca935479 100644
--- a/engine/storage/cache/pom.xml
+++ b/engine/storage/cache/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/configdrive/pom.xml b/engine/storage/configdrive/pom.xml
index d176d00568d6..4448741a097f 100644
--- a/engine/storage/configdrive/pom.xml
+++ b/engine/storage/configdrive/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/datamotion/pom.xml b/engine/storage/datamotion/pom.xml
index ff4bfa5877d1..1b545c0c79bb 100644
--- a/engine/storage/datamotion/pom.xml
+++ b/engine/storage/datamotion/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/image/pom.xml b/engine/storage/image/pom.xml
index bdb5f9e9bf87..e07c94a5de93 100644
--- a/engine/storage/image/pom.xml
+++ b/engine/storage/image/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/integration-test/pom.xml b/engine/storage/integration-test/pom.xml
index 6fccacdcb41e..62381188331c 100644
--- a/engine/storage/integration-test/pom.xml
+++ b/engine/storage/integration-test/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/object/pom.xml b/engine/storage/object/pom.xml
index 6fee3d658fdc..e00cddce31a6 100644
--- a/engine/storage/object/pom.xml
+++ b/engine/storage/object/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/pom.xml b/engine/storage/pom.xml
index 7529adfd0dd4..71d1100b1753 100644
--- a/engine/storage/pom.xml
+++ b/engine/storage/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/snapshot/pom.xml b/engine/storage/snapshot/pom.xml
index 7fa2d4056043..3699a0ae5021 100644
--- a/engine/storage/snapshot/pom.xml
+++ b/engine/storage/snapshot/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/storage/volume/pom.xml b/engine/storage/volume/pom.xml
index 220989ddcd95..6e4f89cc3c0d 100644
--- a/engine/storage/volume/pom.xml
+++ b/engine/storage/volume/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/engine/userdata/cloud-init/pom.xml b/engine/userdata/cloud-init/pom.xml
index 460a18a8f206..87078d7f9f0c 100644
--- a/engine/userdata/cloud-init/pom.xml
+++ b/engine/userdata/cloud-init/pom.xml
@@ -23,7 +23,7 @@
 <parent>
     <artifactId>cloud-engine</artifactId>
     <groupId>org.apache.cloudstack</groupId>
-    <version>4.22.1.0</version>
+    <version>4.22.2.0-SNAPSHOT</version>
     <relativePath>../../pom.xml</relativePath>
 </parent>
 <dependencies>
diff --git a/engine/userdata/pom.xml b/engine/userdata/pom.xml
index 7b052903d170..cbb22a39f7ca 100644
--- a/engine/userdata/pom.xml
+++ b/engine/userdata/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-engine</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/agent-lb/pom.xml b/framework/agent-lb/pom.xml
index c36a01aaf45d..47f31a4626b2 100644
--- a/framework/agent-lb/pom.xml
+++ b/framework/agent-lb/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <artifactId>cloudstack-framework</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/framework/ca/pom.xml b/framework/ca/pom.xml
index 49637c6f2b6b..a0a5178b1d90 100644
--- a/framework/ca/pom.xml
+++ b/framework/ca/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/framework/cluster/pom.xml b/framework/cluster/pom.xml
index bd6bb84f9443..3c73a57d09a2 100644
--- a/framework/cluster/pom.xml
+++ b/framework/cluster/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/config/pom.xml b/framework/config/pom.xml
index 38f45870305c..a7d4262901f7 100644
--- a/framework/config/pom.xml
+++ b/framework/config/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/db/pom.xml b/framework/db/pom.xml
index 1d53484a6a90..2894342ab502 100644
--- a/framework/db/pom.xml
+++ b/framework/db/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/direct-download/pom.xml b/framework/direct-download/pom.xml
index 688f23a25cea..3b0318eb513e 100644
--- a/framework/direct-download/pom.xml
+++ b/framework/direct-download/pom.xml
@@ -32,7 +32,7 @@
     <parent>
         <artifactId>cloudstack-framework</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/framework/events/pom.xml b/framework/events/pom.xml
index 5bf3cfeea21a..0d906cb6afc1 100644
--- a/framework/events/pom.xml
+++ b/framework/events/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/extensions/pom.xml b/framework/extensions/pom.xml
index 5186d7e95b5f..3f3542aa8388 100644
--- a/framework/extensions/pom.xml
+++ b/framework/extensions/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
@@ -41,13 +41,13 @@
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-engine-schema</artifactId>
-            <version>4.22.1.0</version>
+            <version>4.22.2.0-SNAPSHOT</version>
             <scope>compile</scope>
         </dependency>
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-engine-components-api</artifactId>
-            <version>4.22.1.0</version>
+            <version>4.22.2.0-SNAPSHOT</version>
             <scope>compile</scope>
         </dependency>
     </dependencies>
diff --git a/framework/ipc/pom.xml b/framework/ipc/pom.xml
index b05854df03a4..39c36a817dd3 100644
--- a/framework/ipc/pom.xml
+++ b/framework/ipc/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/jobs/pom.xml b/framework/jobs/pom.xml
index 99206fc1a446..f584af90c6b9 100644
--- a/framework/jobs/pom.xml
+++ b/framework/jobs/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/managed-context/pom.xml b/framework/managed-context/pom.xml
index dbee01e43087..836d030cc693 100644
--- a/framework/managed-context/pom.xml
+++ b/framework/managed-context/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/pom.xml b/framework/pom.xml
index e2c52f643cc2..d3354c27af4e 100644
--- a/framework/pom.xml
+++ b/framework/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <build>
         <plugins>
diff --git a/framework/quota/pom.xml b/framework/quota/pom.xml
index 3e0ec54790f2..bf14b310b9f0 100644
--- a/framework/quota/pom.xml
+++ b/framework/quota/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/rest/pom.xml b/framework/rest/pom.xml
index b7f2e526fd38..a22b631eb5cd 100644
--- a/framework/rest/pom.xml
+++ b/framework/rest/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-framework-rest</artifactId>
diff --git a/framework/security/pom.xml b/framework/security/pom.xml
index 4f4b7af07e41..fec791b7d087 100644
--- a/framework/security/pom.xml
+++ b/framework/security/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-framework</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/spring/lifecycle/pom.xml b/framework/spring/lifecycle/pom.xml
index 1844b803809b..af3dca3047e4 100644
--- a/framework/spring/lifecycle/pom.xml
+++ b/framework/spring/lifecycle/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/framework/spring/module/pom.xml b/framework/spring/module/pom.xml
index 6a1dbade3bf4..ccd2c5efb161 100644
--- a/framework/spring/module/pom.xml
+++ b/framework/spring/module/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/acl/dynamic-role-based/pom.xml b/plugins/acl/dynamic-role-based/pom.xml
index 029fcb5e97b8..ecaa32216d38 100644
--- a/plugins/acl/dynamic-role-based/pom.xml
+++ b/plugins/acl/dynamic-role-based/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/acl/project-role-based/pom.xml b/plugins/acl/project-role-based/pom.xml
index dd0b621b395f..8266828fc970 100644
--- a/plugins/acl/project-role-based/pom.xml
+++ b/plugins/acl/project-role-based/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/acl/static-role-based/pom.xml b/plugins/acl/static-role-based/pom.xml
index 06996d471b59..1b1db7c86eeb 100644
--- a/plugins/acl/static-role-based/pom.xml
+++ b/plugins/acl/static-role-based/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/explicit-dedication/pom.xml b/plugins/affinity-group-processors/explicit-dedication/pom.xml
index e134d687c892..fa0e1c6758eb 100644
--- a/plugins/affinity-group-processors/explicit-dedication/pom.xml
+++ b/plugins/affinity-group-processors/explicit-dedication/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/host-affinity/pom.xml b/plugins/affinity-group-processors/host-affinity/pom.xml
index 75aec801bee8..5916abfb3b66 100644
--- a/plugins/affinity-group-processors/host-affinity/pom.xml
+++ b/plugins/affinity-group-processors/host-affinity/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/host-anti-affinity/pom.xml b/plugins/affinity-group-processors/host-anti-affinity/pom.xml
index d3d2e0b85630..a8ccb7636edb 100644
--- a/plugins/affinity-group-processors/host-anti-affinity/pom.xml
+++ b/plugins/affinity-group-processors/host-anti-affinity/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/non-strict-host-affinity/pom.xml b/plugins/affinity-group-processors/non-strict-host-affinity/pom.xml
index f6841ecce9c1..17008fbf8b6c 100644
--- a/plugins/affinity-group-processors/non-strict-host-affinity/pom.xml
+++ b/plugins/affinity-group-processors/non-strict-host-affinity/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/affinity-group-processors/non-strict-host-anti-affinity/pom.xml b/plugins/affinity-group-processors/non-strict-host-anti-affinity/pom.xml
index 7222e80c3dcb..71b3656e3e2b 100644
--- a/plugins/affinity-group-processors/non-strict-host-anti-affinity/pom.xml
+++ b/plugins/affinity-group-processors/non-strict-host-anti-affinity/pom.xml
@@ -32,7 +32,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/alert-handlers/snmp-alerts/pom.xml b/plugins/alert-handlers/snmp-alerts/pom.xml
index 147e81506ec9..39d937046f30 100644
--- a/plugins/alert-handlers/snmp-alerts/pom.xml
+++ b/plugins/alert-handlers/snmp-alerts/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/alert-handlers/syslog-alerts/pom.xml b/plugins/alert-handlers/syslog-alerts/pom.xml
index 97f72217933d..4c1e722fc278 100644
--- a/plugins/alert-handlers/syslog-alerts/pom.xml
+++ b/plugins/alert-handlers/syslog-alerts/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/api/discovery/pom.xml b/plugins/api/discovery/pom.xml
index 655568138cb8..0f478c228b69 100644
--- a/plugins/api/discovery/pom.xml
+++ b/plugins/api/discovery/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/api/rate-limit/pom.xml b/plugins/api/rate-limit/pom.xml
index 4e524f32e4e9..376ca61d5985 100644
--- a/plugins/api/rate-limit/pom.xml
+++ b/plugins/api/rate-limit/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/plugins/api/solidfire-intg-test/pom.xml b/plugins/api/solidfire-intg-test/pom.xml
index 01ed3e70362c..91ecee3c893a 100644
--- a/plugins/api/solidfire-intg-test/pom.xml
+++ b/plugins/api/solidfire-intg-test/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/api/vmware-sioc/pom.xml b/plugins/api/vmware-sioc/pom.xml
index 9c6e783fb331..f9596377afdc 100644
--- a/plugins/api/vmware-sioc/pom.xml
+++ b/plugins/api/vmware-sioc/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/backup/dummy/pom.xml b/plugins/backup/dummy/pom.xml
index 2006afc95e74..4893b6991a16 100644
--- a/plugins/backup/dummy/pom.xml
+++ b/plugins/backup/dummy/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/backup/nas/pom.xml b/plugins/backup/nas/pom.xml
index f0c170c2aadd..7e3daec22f79 100644
--- a/plugins/backup/nas/pom.xml
+++ b/plugins/backup/nas/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/backup/networker/pom.xml b/plugins/backup/networker/pom.xml
index b52863e89ea8..8a49f6ae1bea 100644
--- a/plugins/backup/networker/pom.xml
+++ b/plugins/backup/networker/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <artifactId>cloudstack-plugins</artifactId>
         <groupId>org.apache.cloudstack</groupId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/backup/veeam/pom.xml b/plugins/backup/veeam/pom.xml
index b64a68387ab1..9142b2e76223 100644
--- a/plugins/backup/veeam/pom.xml
+++ b/plugins/backup/veeam/pom.xml
@@ -23,7 +23,7 @@
   <parent>
     <artifactId>cloudstack-plugins</artifactId>
     <groupId>org.apache.cloudstack</groupId>
-    <version>4.22.1.0</version>
+    <version>4.22.2.0-SNAPSHOT</version>
     <relativePath>../../pom.xml</relativePath>
   </parent>
 
diff --git a/plugins/ca/root-ca/pom.xml b/plugins/ca/root-ca/pom.xml
index 6d9315f701a1..8bce2ebefd27 100644
--- a/plugins/ca/root-ca/pom.xml
+++ b/plugins/ca/root-ca/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/database/mysql-ha/pom.xml b/plugins/database/mysql-ha/pom.xml
index 9ac00d1a5079..6ecc4dccf085 100644
--- a/plugins/database/mysql-ha/pom.xml
+++ b/plugins/database/mysql-ha/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/database/quota/pom.xml b/plugins/database/quota/pom.xml
index 56b8c0ab4ed6..f5c222f276bf 100644
--- a/plugins/database/quota/pom.xml
+++ b/plugins/database/quota/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/dedicated-resources/pom.xml b/plugins/dedicated-resources/pom.xml
index a299dc77eb3e..a55c1113b884 100644
--- a/plugins/dedicated-resources/pom.xml
+++ b/plugins/dedicated-resources/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/deployment-planners/implicit-dedication/pom.xml b/plugins/deployment-planners/implicit-dedication/pom.xml
index 162b3d2c84c4..8c8a0c4ac277 100644
--- a/plugins/deployment-planners/implicit-dedication/pom.xml
+++ b/plugins/deployment-planners/implicit-dedication/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/deployment-planners/user-concentrated-pod/pom.xml b/plugins/deployment-planners/user-concentrated-pod/pom.xml
index bba781a774a6..c1d15adf0fad 100644
--- a/plugins/deployment-planners/user-concentrated-pod/pom.xml
+++ b/plugins/deployment-planners/user-concentrated-pod/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/deployment-planners/user-dispersing/pom.xml b/plugins/deployment-planners/user-dispersing/pom.xml
index 915dbede4f04..04a435d89b49 100644
--- a/plugins/deployment-planners/user-dispersing/pom.xml
+++ b/plugins/deployment-planners/user-dispersing/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/drs/cluster/balanced/pom.xml b/plugins/drs/cluster/balanced/pom.xml
index 3d10f190270f..a1c042981374 100644
--- a/plugins/drs/cluster/balanced/pom.xml
+++ b/plugins/drs/cluster/balanced/pom.xml
@@ -27,7 +27,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/drs/cluster/condensed/pom.xml b/plugins/drs/cluster/condensed/pom.xml
index a568064537c9..3aec14dc5427 100644
--- a/plugins/drs/cluster/condensed/pom.xml
+++ b/plugins/drs/cluster/condensed/pom.xml
@@ -27,7 +27,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/event-bus/inmemory/pom.xml b/plugins/event-bus/inmemory/pom.xml
index e497f6dad9a9..908bf9a88284 100644
--- a/plugins/event-bus/inmemory/pom.xml
+++ b/plugins/event-bus/inmemory/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/event-bus/kafka/pom.xml b/plugins/event-bus/kafka/pom.xml
index 91a78a260d24..36b052c0a6f4 100644
--- a/plugins/event-bus/kafka/pom.xml
+++ b/plugins/event-bus/kafka/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/event-bus/rabbitmq/pom.xml b/plugins/event-bus/rabbitmq/pom.xml
index 5a16ab17fe4d..5531209ca762 100644
--- a/plugins/event-bus/rabbitmq/pom.xml
+++ b/plugins/event-bus/rabbitmq/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/event-bus/webhook/pom.xml b/plugins/event-bus/webhook/pom.xml
index 83b4b77efbc0..e26e7cca9e2d 100644
--- a/plugins/event-bus/webhook/pom.xml
+++ b/plugins/event-bus/webhook/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/ha-planners/skip-heurestics/pom.xml b/plugins/ha-planners/skip-heurestics/pom.xml
index 272a26bd3a14..7818b9d14f3a 100644
--- a/plugins/ha-planners/skip-heurestics/pom.xml
+++ b/plugins/ha-planners/skip-heurestics/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/host-allocators/random/pom.xml b/plugins/host-allocators/random/pom.xml
index bc1fdc55d6ed..48f79d512caf 100644
--- a/plugins/host-allocators/random/pom.xml
+++ b/plugins/host-allocators/random/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/hypervisors/baremetal/pom.xml b/plugins/hypervisors/baremetal/pom.xml
index f5914e9b7730..d6fda1780e29 100755
--- a/plugins/hypervisors/baremetal/pom.xml
+++ b/plugins/hypervisors/baremetal/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-hypervisor-baremetal</artifactId>
diff --git a/plugins/hypervisors/external/pom.xml b/plugins/hypervisors/external/pom.xml
index 8cc3a870221e..85bdd7ac19fe 100644
--- a/plugins/hypervisors/external/pom.xml
+++ b/plugins/hypervisors/external/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-hypervisor-external</artifactId>
diff --git a/plugins/hypervisors/hyperv/pom.xml b/plugins/hypervisors/hyperv/pom.xml
index 28f6c412b729..dba7b5d640a1 100644
--- a/plugins/hypervisors/hyperv/pom.xml
+++ b/plugins/hypervisors/hyperv/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <properties>
diff --git a/plugins/hypervisors/kvm/pom.xml b/plugins/hypervisors/kvm/pom.xml
index 883012d4cc54..965856ec03ed 100644
--- a/plugins/hypervisors/kvm/pom.xml
+++ b/plugins/hypervisors/kvm/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/hypervisors/ovm/pom.xml b/plugins/hypervisors/ovm/pom.xml
index 2149926348ee..c31e37b522fc 100644
--- a/plugins/hypervisors/ovm/pom.xml
+++ b/plugins/hypervisors/ovm/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/hypervisors/ovm3/pom.xml b/plugins/hypervisors/ovm3/pom.xml
index c88284c8d297..55f72742e236 100644
--- a/plugins/hypervisors/ovm3/pom.xml
+++ b/plugins/hypervisors/ovm3/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0-SNAPSHOT</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/hypervisors/simulator/pom.xml b/plugins/hypervisors/simulator/pom.xml
index 76d989edee13..8d2a9949747d 100644
--- a/plugins/hypervisors/simulator/pom.xml
+++ b/plugins/hypervisors/simulator/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-hypervisor-simulator</artifactId>
diff --git a/plugins/hypervisors/ucs/pom.xml b/plugins/hypervisors/ucs/pom.xml
index 8febcda74e0e..88386ca1f636 100644
--- a/plugins/hypervisors/ucs/pom.xml
+++ b/plugins/hypervisors/ucs/pom.xml
@@ -23,7 +23,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-hypervisor-ucs</artifactId>
diff --git a/plugins/hypervisors/vmware/pom.xml b/plugins/hypervisors/vmware/pom.xml
index 3c3a38da45b4..5c4223d0f903 100644
--- a/plugins/hypervisors/vmware/pom.xml
+++ b/plugins/hypervisors/vmware/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/hypervisors/xenserver/pom.xml b/plugins/hypervisors/xenserver/pom.xml
index 5eee2e47fc98..6b4e9a635aa7 100644
--- a/plugins/hypervisors/xenserver/pom.xml
+++ b/plugins/hypervisors/xenserver/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/integrations/cloudian/pom.xml b/plugins/integrations/cloudian/pom.xml
index 7799a3e5a348..42ef0c803d78 100644
--- a/plugins/integrations/cloudian/pom.xml
+++ b/plugins/integrations/cloudian/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/integrations/kubernetes-service/pom.xml b/plugins/integrations/kubernetes-service/pom.xml
index 24e42e15be8e..4cc4413aff4b 100644
--- a/plugins/integrations/kubernetes-service/pom.xml
+++ b/plugins/integrations/kubernetes-service/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/integrations/prometheus/pom.xml b/plugins/integrations/prometheus/pom.xml
index 77a584c25dc7..ec17155ab3d3 100644
--- a/plugins/integrations/prometheus/pom.xml
+++ b/plugins/integrations/prometheus/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/maintenance/pom.xml b/plugins/maintenance/pom.xml
index 65363e33b078..a2d97f45b6ef 100644
--- a/plugins/maintenance/pom.xml
+++ b/plugins/maintenance/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/metrics/pom.xml b/plugins/metrics/pom.xml
index 25102cd6da5f..c08e56087109 100644
--- a/plugins/metrics/pom.xml
+++ b/plugins/metrics/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/bigswitch/pom.xml b/plugins/network-elements/bigswitch/pom.xml
index 8729e12782da..47e70fdc708f 100644
--- a/plugins/network-elements/bigswitch/pom.xml
+++ b/plugins/network-elements/bigswitch/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/brocade-vcs/pom.xml b/plugins/network-elements/brocade-vcs/pom.xml
index e4d29023fe98..d8eff794b59c 100644
--- a/plugins/network-elements/brocade-vcs/pom.xml
+++ b/plugins/network-elements/brocade-vcs/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/plugins/network-elements/cisco-vnmc/pom.xml b/plugins/network-elements/cisco-vnmc/pom.xml
index f29ed0a4b798..081fd005fd1c 100644
--- a/plugins/network-elements/cisco-vnmc/pom.xml
+++ b/plugins/network-elements/cisco-vnmc/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/dns-notifier/pom.xml b/plugins/network-elements/dns-notifier/pom.xml
index 99451699621c..c90ce0f1edbb 100644
--- a/plugins/network-elements/dns-notifier/pom.xml
+++ b/plugins/network-elements/dns-notifier/pom.xml
@@ -22,7 +22,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <artifactId>cloud-plugin-example-dns-notifier</artifactId>
diff --git a/plugins/network-elements/elastic-loadbalancer/pom.xml b/plugins/network-elements/elastic-loadbalancer/pom.xml
index 1283c19bc45b..9fc177a569b1 100644
--- a/plugins/network-elements/elastic-loadbalancer/pom.xml
+++ b/plugins/network-elements/elastic-loadbalancer/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/globodns/pom.xml b/plugins/network-elements/globodns/pom.xml
index 1f705b259278..e9909f8841d3 100644
--- a/plugins/network-elements/globodns/pom.xml
+++ b/plugins/network-elements/globodns/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/internal-loadbalancer/pom.xml b/plugins/network-elements/internal-loadbalancer/pom.xml
index fd426ae6f878..e94bf50860b2 100644
--- a/plugins/network-elements/internal-loadbalancer/pom.xml
+++ b/plugins/network-elements/internal-loadbalancer/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/juniper-contrail/pom.xml b/plugins/network-elements/juniper-contrail/pom.xml
index c13c5be79121..759a175a9171 100644
--- a/plugins/network-elements/juniper-contrail/pom.xml
+++ b/plugins/network-elements/juniper-contrail/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/netris/pom.xml b/plugins/network-elements/netris/pom.xml
index fd3fb3fa9402..8ec221ffa3a9 100644
--- a/plugins/network-elements/netris/pom.xml
+++ b/plugins/network-elements/netris/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/netscaler/pom.xml b/plugins/network-elements/netscaler/pom.xml
index 596e0f49ea78..3fd307e3d9ce 100644
--- a/plugins/network-elements/netscaler/pom.xml
+++ b/plugins/network-elements/netscaler/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/nicira-nvp/pom.xml b/plugins/network-elements/nicira-nvp/pom.xml
index cffdc20a3497..2f73f067497f 100644
--- a/plugins/network-elements/nicira-nvp/pom.xml
+++ b/plugins/network-elements/nicira-nvp/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/nsx/pom.xml b/plugins/network-elements/nsx/pom.xml
index 21297e7ce645..65705a63e52c 100644
--- a/plugins/network-elements/nsx/pom.xml
+++ b/plugins/network-elements/nsx/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/network-elements/opendaylight/pom.xml b/plugins/network-elements/opendaylight/pom.xml
index a6d40c66ab42..3c8f45c0f6a9 100644
--- a/plugins/network-elements/opendaylight/pom.xml
+++ b/plugins/network-elements/opendaylight/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <profiles>
diff --git a/plugins/network-elements/ovs/pom.xml b/plugins/network-elements/ovs/pom.xml
index 455078e985a2..837934d06d30 100644
--- a/plugins/network-elements/ovs/pom.xml
+++ b/plugins/network-elements/ovs/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/palo-alto/pom.xml b/plugins/network-elements/palo-alto/pom.xml
index be8324a9b700..ab13698e78cd 100644
--- a/plugins/network-elements/palo-alto/pom.xml
+++ b/plugins/network-elements/palo-alto/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/stratosphere-ssp/pom.xml b/plugins/network-elements/stratosphere-ssp/pom.xml
index 6a6f10c49943..680180c241c2 100644
--- a/plugins/network-elements/stratosphere-ssp/pom.xml
+++ b/plugins/network-elements/stratosphere-ssp/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/network-elements/tungsten/pom.xml b/plugins/network-elements/tungsten/pom.xml
index 51e8133a7832..7a97bf1bed26 100644
--- a/plugins/network-elements/tungsten/pom.xml
+++ b/plugins/network-elements/tungsten/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/plugins/network-elements/vxlan/pom.xml b/plugins/network-elements/vxlan/pom.xml
index 26f32d65be2f..244fcdc83d82 100644
--- a/plugins/network-elements/vxlan/pom.xml
+++ b/plugins/network-elements/vxlan/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/outofbandmanagement-drivers/ipmitool/pom.xml b/plugins/outofbandmanagement-drivers/ipmitool/pom.xml
index 78ab611bda05..649f99993ff7 100644
--- a/plugins/outofbandmanagement-drivers/ipmitool/pom.xml
+++ b/plugins/outofbandmanagement-drivers/ipmitool/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/outofbandmanagement-drivers/nested-cloudstack/pom.xml b/plugins/outofbandmanagement-drivers/nested-cloudstack/pom.xml
index 67cb45c70191..2d207363ca9c 100644
--- a/plugins/outofbandmanagement-drivers/nested-cloudstack/pom.xml
+++ b/plugins/outofbandmanagement-drivers/nested-cloudstack/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/outofbandmanagement-drivers/redfish/pom.xml b/plugins/outofbandmanagement-drivers/redfish/pom.xml
index d5f1cc19ca64..b95733175231 100644
--- a/plugins/outofbandmanagement-drivers/redfish/pom.xml
+++ b/plugins/outofbandmanagement-drivers/redfish/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/pom.xml b/plugins/pom.xml
index 6d7f9665ed66..b3b258e6f8a4 100755
--- a/plugins/pom.xml
+++ b/plugins/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <build>
         <plugins>
diff --git a/plugins/storage-allocators/random/pom.xml b/plugins/storage-allocators/random/pom.xml
index 6281ba6f76a9..ee860f14ebb6 100644
--- a/plugins/storage-allocators/random/pom.xml
+++ b/plugins/storage-allocators/random/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/image/default/pom.xml b/plugins/storage/image/default/pom.xml
index 2756b865aafe..ab7735a7019c 100644
--- a/plugins/storage/image/default/pom.xml
+++ b/plugins/storage/image/default/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/image/s3/pom.xml b/plugins/storage/image/s3/pom.xml
index 0a5f5212939f..cbb785bd6a6b 100644
--- a/plugins/storage/image/s3/pom.xml
+++ b/plugins/storage/image/s3/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/image/sample/pom.xml b/plugins/storage/image/sample/pom.xml
index 0ba1d96507ff..c2a127021d3a 100644
--- a/plugins/storage/image/sample/pom.xml
+++ b/plugins/storage/image/sample/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/image/swift/pom.xml b/plugins/storage/image/swift/pom.xml
index 85319d7a81a9..9638183aa937 100644
--- a/plugins/storage/image/swift/pom.xml
+++ b/plugins/storage/image/swift/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/object/ceph/pom.xml b/plugins/storage/object/ceph/pom.xml
index 31468200641f..822753e86e69 100644
--- a/plugins/storage/object/ceph/pom.xml
+++ b/plugins/storage/object/ceph/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/object/cloudian/pom.xml b/plugins/storage/object/cloudian/pom.xml
index ac08a7a7d849..d0320ae9c928 100644
--- a/plugins/storage/object/cloudian/pom.xml
+++ b/plugins/storage/object/cloudian/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/object/minio/pom.xml b/plugins/storage/object/minio/pom.xml
index 15e6f44db616..2fe6eaf6645f 100644
--- a/plugins/storage/object/minio/pom.xml
+++ b/plugins/storage/object/minio/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/object/simulator/pom.xml b/plugins/storage/object/simulator/pom.xml
index 71778dffcf4b..cfaf6fd65013 100644
--- a/plugins/storage/object/simulator/pom.xml
+++ b/plugins/storage/object/simulator/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/sharedfs/storagevm/pom.xml b/plugins/storage/sharedfs/storagevm/pom.xml
index 555b61508ade..3ab3e8c75d01 100644
--- a/plugins/storage/sharedfs/storagevm/pom.xml
+++ b/plugins/storage/sharedfs/storagevm/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/storage/volume/adaptive/pom.xml b/plugins/storage/volume/adaptive/pom.xml
index 8cc14a192d4b..483ca48f7725 100644
--- a/plugins/storage/volume/adaptive/pom.xml
+++ b/plugins/storage/volume/adaptive/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/cloudbyte/pom.xml b/plugins/storage/volume/cloudbyte/pom.xml
index aff11e4f9712..82f65e0fbf78 100644
--- a/plugins/storage/volume/cloudbyte/pom.xml
+++ b/plugins/storage/volume/cloudbyte/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/datera/pom.xml b/plugins/storage/volume/datera/pom.xml
index 91d26224a563..fbbd38b75d9c 100644
--- a/plugins/storage/volume/datera/pom.xml
+++ b/plugins/storage/volume/datera/pom.xml
@@ -16,7 +16,7 @@
   <parent>
     <groupId>org.apache.cloudstack</groupId>
     <artifactId>cloudstack-plugins</artifactId>
-    <version>4.22.1.0</version>
+    <version>4.22.2.0-SNAPSHOT</version>
     <relativePath>../../../pom.xml</relativePath>
   </parent>
   <dependencies>
diff --git a/plugins/storage/volume/default/pom.xml b/plugins/storage/volume/default/pom.xml
index c79103a54d9e..65d356bd797d 100644
--- a/plugins/storage/volume/default/pom.xml
+++ b/plugins/storage/volume/default/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/flasharray/pom.xml b/plugins/storage/volume/flasharray/pom.xml
index fc730cd595ff..69f85a0a8f69 100644
--- a/plugins/storage/volume/flasharray/pom.xml
+++ b/plugins/storage/volume/flasharray/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/linstor/pom.xml b/plugins/storage/volume/linstor/pom.xml
index a04810b91c6c..b09c7e336d97 100644
--- a/plugins/storage/volume/linstor/pom.xml
+++ b/plugins/storage/volume/linstor/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/nexenta/pom.xml b/plugins/storage/volume/nexenta/pom.xml
index c802d5b1e988..245f9c782121 100644
--- a/plugins/storage/volume/nexenta/pom.xml
+++ b/plugins/storage/volume/nexenta/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/primera/pom.xml b/plugins/storage/volume/primera/pom.xml
index a55d1cda6dc3..9cf82dcab950 100644
--- a/plugins/storage/volume/primera/pom.xml
+++ b/plugins/storage/volume/primera/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/sample/pom.xml b/plugins/storage/volume/sample/pom.xml
index 5d9be3fd6eb8..9f39512f131d 100644
--- a/plugins/storage/volume/sample/pom.xml
+++ b/plugins/storage/volume/sample/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/scaleio/pom.xml b/plugins/storage/volume/scaleio/pom.xml
index c2ebfba29b9c..e65d2c29aee6 100644
--- a/plugins/storage/volume/scaleio/pom.xml
+++ b/plugins/storage/volume/scaleio/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/solidfire/pom.xml b/plugins/storage/volume/solidfire/pom.xml
index 27cd8cd29511..e04cf48b55a2 100644
--- a/plugins/storage/volume/solidfire/pom.xml
+++ b/plugins/storage/volume/solidfire/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/storage/volume/storpool/pom.xml b/plugins/storage/volume/storpool/pom.xml
index a3913800f453..97d85ff8a110 100644
--- a/plugins/storage/volume/storpool/pom.xml
+++ b/plugins/storage/volume/storpool/pom.xml
@@ -17,7 +17,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/user-authenticators/ldap/pom.xml b/plugins/user-authenticators/ldap/pom.xml
index 28da0df580e6..014b8ddbc7bb 100644
--- a/plugins/user-authenticators/ldap/pom.xml
+++ b/plugins/user-authenticators/ldap/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 
diff --git a/plugins/user-authenticators/md5/pom.xml b/plugins/user-authenticators/md5/pom.xml
index 9c0548a7c9cc..6d23714a3dd4 100644
--- a/plugins/user-authenticators/md5/pom.xml
+++ b/plugins/user-authenticators/md5/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-authenticators/oauth2/pom.xml b/plugins/user-authenticators/oauth2/pom.xml
index ddd4b6ecd5ee..4048c50074dd 100644
--- a/plugins/user-authenticators/oauth2/pom.xml
+++ b/plugins/user-authenticators/oauth2/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/user-authenticators/pbkdf2/pom.xml b/plugins/user-authenticators/pbkdf2/pom.xml
index 89bb93ad29cc..94b072def0f0 100644
--- a/plugins/user-authenticators/pbkdf2/pom.xml
+++ b/plugins/user-authenticators/pbkdf2/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-authenticators/plain-text/pom.xml b/plugins/user-authenticators/plain-text/pom.xml
index 4eee43ee4010..e9211e129557 100644
--- a/plugins/user-authenticators/plain-text/pom.xml
+++ b/plugins/user-authenticators/plain-text/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-authenticators/saml2/pom.xml b/plugins/user-authenticators/saml2/pom.xml
index 9c56d11b55b3..6cb6da49bc4c 100644
--- a/plugins/user-authenticators/saml2/pom.xml
+++ b/plugins/user-authenticators/saml2/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/plugins/user-authenticators/sha256salted/pom.xml b/plugins/user-authenticators/sha256salted/pom.xml
index b59e1b6120d6..3195a57e40ee 100644
--- a/plugins/user-authenticators/sha256salted/pom.xml
+++ b/plugins/user-authenticators/sha256salted/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-two-factor-authenticators/static-pin/pom.xml b/plugins/user-two-factor-authenticators/static-pin/pom.xml
index 781a1d97a706..140d4ec01ce4 100644
--- a/plugins/user-two-factor-authenticators/static-pin/pom.xml
+++ b/plugins/user-two-factor-authenticators/static-pin/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/plugins/user-two-factor-authenticators/totp/pom.xml b/plugins/user-two-factor-authenticators/totp/pom.xml
index 87f8d9b3bf42..21758b86cf06 100644
--- a/plugins/user-two-factor-authenticators/totp/pom.xml
+++ b/plugins/user-two-factor-authenticators/totp/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-plugins</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/pom.xml b/pom.xml
index 4cc6b5914836..8ba7a161e67b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -29,7 +29,7 @@
 
     <groupId>org.apache.cloudstack</groupId>
     <artifactId>cloudstack</artifactId>
-    <version>4.22.1.0</version>
+    <version>4.22.2.0-SNAPSHOT</version>
     <packaging>pom</packaging>
     <name>Apache CloudStack</name>
     <description>Apache CloudStack is an IaaS ("Infrastructure as a Service") cloud orchestration platform.</description>
diff --git a/quickcloud/pom.xml b/quickcloud/pom.xml
index 2130fd87aa7e..b6aa4b04a500 100644
--- a/quickcloud/pom.xml
+++ b/quickcloud/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
 </project>
diff --git a/server/pom.xml b/server/pom.xml
index 3e91e5a29061..c7f4d24d68b8 100644
--- a/server/pom.xml
+++ b/server/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
 
     <dependencies>
@@ -194,7 +194,7 @@
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-framework-extensions</artifactId>
-            <version>4.22.1.0</version>
+            <version>4.22.2.0-SNAPSHOT</version>
             <scope>compile</scope>
         </dependency>
     </dependencies>
diff --git a/services/console-proxy/pom.xml b/services/console-proxy/pom.xml
index 7ccbe9a1a1f8..772623b43051 100644
--- a/services/console-proxy/pom.xml
+++ b/services/console-proxy/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-services</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/services/console-proxy/rdpconsole/pom.xml b/services/console-proxy/rdpconsole/pom.xml
index ce8f587f1f1a..6422f0a4b770 100644
--- a/services/console-proxy/rdpconsole/pom.xml
+++ b/services/console-proxy/rdpconsole/pom.xml
@@ -26,7 +26,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-service-console-proxy</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/services/console-proxy/server/pom.xml b/services/console-proxy/server/pom.xml
index 8da4335bd235..2ed31d1c4463 100644
--- a/services/console-proxy/server/pom.xml
+++ b/services/console-proxy/server/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-service-console-proxy</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/services/pom.xml b/services/pom.xml
index 5e7315e347d5..ceb9898418cc 100644
--- a/services/pom.xml
+++ b/services/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/services/secondary-storage/controller/pom.xml b/services/secondary-storage/controller/pom.xml
index 62c6c098ed09..e159b650f3d0 100644
--- a/services/secondary-storage/controller/pom.xml
+++ b/services/secondary-storage/controller/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-service-secondary-storage</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/services/secondary-storage/pom.xml b/services/secondary-storage/pom.xml
index f96826f02d4a..ff3023588df3 100644
--- a/services/secondary-storage/pom.xml
+++ b/services/secondary-storage/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-services</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/services/secondary-storage/server/pom.xml b/services/secondary-storage/server/pom.xml
index 1ac2f00e8d44..3b4c30871946 100644
--- a/services/secondary-storage/server/pom.xml
+++ b/services/secondary-storage/server/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack-service-secondary-storage</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/systemvm/pom.xml b/systemvm/pom.xml
index a949df8befcb..0ea722eba80b 100644
--- a/systemvm/pom.xml
+++ b/systemvm/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <properties>
diff --git a/test/pom.xml b/test/pom.xml
index 605915c5defa..861b7ee5d725 100644
--- a/test/pom.xml
+++ b/test/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/tools/apidoc/pom.xml b/tools/apidoc/pom.xml
index 67c40ddcca0b..6fb584398c6d 100644
--- a/tools/apidoc/pom.xml
+++ b/tools/apidoc/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-tools</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <properties>
diff --git a/tools/checkstyle/pom.xml b/tools/checkstyle/pom.xml
index f5221fd67902..10f4568c4d87 100644
--- a/tools/checkstyle/pom.xml
+++ b/tools/checkstyle/pom.xml
@@ -22,7 +22,7 @@
     <name>Apache CloudStack Developer Tools - Checkstyle Configuration</name>
     <groupId>org.apache.cloudstack</groupId>
     <artifactId>checkstyle</artifactId>
-    <version>4.22.1.0</version>
+    <version>4.22.2.0-SNAPSHOT</version>
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
diff --git a/tools/devcloud-kvm/pom.xml b/tools/devcloud-kvm/pom.xml
index ab0eeda2b547..49927c120a2c 100644
--- a/tools/devcloud-kvm/pom.xml
+++ b/tools/devcloud-kvm/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-tools</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/tools/devcloud4/pom.xml b/tools/devcloud4/pom.xml
index ec89ae6abac7..40c5eb184566 100644
--- a/tools/devcloud4/pom.xml
+++ b/tools/devcloud4/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-tools</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/tools/docker/Dockerfile b/tools/docker/Dockerfile
index 7cb2efb3d4df..a0516299f052 100644
--- a/tools/docker/Dockerfile
+++ b/tools/docker/Dockerfile
@@ -19,7 +19,7 @@
 
 FROM ubuntu:22.04
 
-LABEL Vendor="Apache.org" License="ApacheV2" Version="4.22.1.0" Author="Apache CloudStack <dev@cloudstack.apache.org>"
+LABEL Vendor="Apache.org" License="ApacheV2" Version="4.22.2.0-SNAPSHOT" Author="Apache CloudStack <dev@cloudstack.apache.org>"
 
 ARG DEBIAN_FRONTEND=noninteractive
 
diff --git a/tools/docker/Dockerfile.marvin b/tools/docker/Dockerfile.marvin
index 3e060b0f481c..fe5a0b0519ed 100644
--- a/tools/docker/Dockerfile.marvin
+++ b/tools/docker/Dockerfile.marvin
@@ -19,11 +19,11 @@
 # build for cloudstack_home_dir not this folder
 FROM python:2
 
-LABEL Vendor="Apache.org" License="ApacheV2" Version="4.22.1.0" Author="Apache CloudStack <dev@cloudstack.apache.org>"
+LABEL Vendor="Apache.org" License="ApacheV2" Version="4.22.2.0-SNAPSHOT" Author="Apache CloudStack <dev@cloudstack.apache.org>"
 
 ENV WORK_DIR=/marvin
 
-ENV PKG_URL=https://builds.cloudstack.org/job/build-master-marvin/lastSuccessfulBuild/artifact/tools/marvin/dist/Marvin-4.22.1.0.tar.gz
+ENV PKG_URL=https://builds.cloudstack.org/job/build-master-marvin/lastSuccessfulBuild/artifact/tools/marvin/dist/Marvin-4.22.2.0-SNAPSHOT.tar.gz
 
 RUN apt-get update && apt-get install -y vim
 RUN pip install --upgrade paramiko nose requests
diff --git a/tools/marvin/pom.xml b/tools/marvin/pom.xml
index 70e39a911d36..1f64cff5e68d 100644
--- a/tools/marvin/pom.xml
+++ b/tools/marvin/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloud-tools</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/tools/marvin/setup.py b/tools/marvin/setup.py
index 66eb32111675..941617c1562c 100644
--- a/tools/marvin/setup.py
+++ b/tools/marvin/setup.py
@@ -27,7 +27,7 @@
         raise RuntimeError("python setuptools is required to build Marvin")
 
 
-VERSION = "4.22.1.0"
+VERSION = "4.22.2.0-SNAPSHOT"
 
 setup(name="Marvin",
       version=VERSION,
diff --git a/tools/pom.xml b/tools/pom.xml
index 15335c5f2fd6..f1826fce0e96 100644
--- a/tools/pom.xml
+++ b/tools/pom.xml
@@ -25,7 +25,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <build>
diff --git a/usage/pom.xml b/usage/pom.xml
index f51ffce2a5d7..9df18923d0ac 100644
--- a/usage/pom.xml
+++ b/usage/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>
diff --git a/utils/pom.xml b/utils/pom.xml
index 7cb2df1deb37..def3a6818b13 100755
--- a/utils/pom.xml
+++ b/utils/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
         <relativePath>../pom.xml</relativePath>
     </parent>
     <dependencies>
diff --git a/vmware-base/pom.xml b/vmware-base/pom.xml
index 53abed35493b..f96601d8ca0c 100644
--- a/vmware-base/pom.xml
+++ b/vmware-base/pom.xml
@@ -24,7 +24,7 @@
     <parent>
         <groupId>org.apache.cloudstack</groupId>
         <artifactId>cloudstack</artifactId>
-        <version>4.22.1.0</version>
+        <version>4.22.2.0-SNAPSHOT</version>
     </parent>
     <dependencies>
         <dependency>

From 4a49ffa9aa281b207ca5350ae697c6469be0c367 Mon Sep 17 00:00:00 2001
From: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
Date: Mon, 18 May 2026 17:24:14 +0530
Subject: [PATCH 30/64] update debian change log

---
 debian/changelog | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index bdd67f8f91e1..c0f1255b33cb 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,3 +1,9 @@
+cloudstack (4.22.2.0-SNAPSHOT) unstable; urgency=low
+
+  * Update the version to 4.22.2.0-SNAPSHOT
+
+ -- the Apache CloudStack project <dev@cloudstack.apache.org>  Mon, 18 May 2026 17:17:25 +0530
+
 cloudstack (4.22.1.0) unstable; urgency=low
 
   * Update the version to 4.22.1.0

From 94d911be9aebc4c2a56a1a0c17aeaf163515cfbe Mon Sep 17 00:00:00 2001
From: Tonitzpp <134986282+Tonitzpp@users.noreply.github.com>
Date: Tue, 19 May 2026 04:52:36 -0300
Subject: [PATCH 31/64] Translation of missing labels to Portuguese (#12947)

Co-authored-by: toni.zamparetti <toni.zamparetti@scclouds.com.br>
---
 ui/public/locales/pt_BR.json | 1254 +++++++++++++++++++++++++++++++++-
 1 file changed, 1234 insertions(+), 20 deletions(-)

diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index d2910a3a2b98..4b446eccff32 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -1,27 +1,35 @@
 {
 "alert.service.domainrouter": "Roteador do dom\u00ednio",
+"error.dedicate.bgp.peer.failed": "Falha ao dedicar o par BGP",
+"error.dedicate.ipv4.subnet.failed": "Falha ao dedicar a sub-rede IPv4",
 "error.dedicate.cluster.failed": "Falha ao dedicar cluster",
 "error.dedicate.host.failed": "Falha ao dedicar host",
 "error.dedicate.pod.failed": "Falha ao dedicar pod",
 "error.dedicate.zone.failed": "Falha ao dedicar zona",
+"error.empty.counter.operator.threshold": "Contador, Operador ou Limite est\u00e1 vazio",
 "error.execute.api.failed": "Falha ao executar API",
 "error.fetching.async.job.result": "Foi encontrado um erro ao buscar o resultado do job ass\u00edncrono",
-"error.form.message": "H\u00e1 problemas no formul\u00e1rio. Por favor, corrija-os.",
+"error.form.message": "H\u00e1 problemas no formul\u00e1rio. Por favor, corrija-os",
 "error.password.not.match": "Os campos de senha n\u00e3o coincidem",
+"error.release.dedicate.bgp.peer": "Falha ao liberar o par BGP dedicado",
 "error.release.dedicate.cluster": "Falha ao liberar cluster dedicado.",
 "error.release.dedicate.host": "Falha ao liberar host dedicado.",
+"error.release.dedicate.ipv4.subnet": "Falha ao liberar a sub-rede IPv4 dedicada",
 "error.release.dedicate.pod": "Falha ao liberar pod dedicado.",
 "error.release.dedicate.zone": "Falha ao liberar zona dedicada.",
+"error.unable.to.add.setting.extraconfig": "N\u00e3o \u00e9 permitido adicionar configura\u00e7\u00e3o para extraconfig. Por favor, habilite o par\u00e2metro extraconfig para a m\u00e1quina virtual",
 "error.unable.to.proceed": "N\u00e3o foi poss\u00edvel proceder. Por favor, contate um administrador.",
 "firewall.close": "Firewall",
-"icmp.code.desc": "Informe -1 para permitir todos os c\u00f3digos ICMP.",
-"icmp.type.desc": "Informe -1 para permitir todos os tipos ICMP.",
+"icmp.code.desc": "Informe -1 para permitir todos os c\u00f3digos ICMP",
+"icmp.type.desc": "Informe -1 para permitir todos os tipos ICMP",
 "inline": "Inline",
 "label.about": "Sobre",
 "label.about.app": "Sobre o CloudStack",
 "label.accept": "Aceitar",
-"label.accept.project.invitation": "Aceitar convite de projeto.",
+"label.accept.project.invitation": "Aceitar convite de projeto",
 "label.access": "Acesso",
+"label.access.key": "Chave de acesso",
+"label.access.kubernetes.nodes": "Acessar n\u00f3s Kubernetes",
 "label.accesskey": "Chave de acesso",
 "label.account": "Conta",
 "label.account.and.security.group": "Contas e grupos de seguran\u00e7a",
@@ -45,19 +53,27 @@
 "label.action.attach.iso": "Anexar ISO",
 "label.action.bulk.delete.egress.firewall.rules": "Apagar em massa as regras de sa\u00edda do firewall.",
 "label.action.bulk.delete.firewall.rules": "Apagar em massa as regras do firewall.",
+"label.action.bulk.delete.ip.v6.firewall.rules": "Apagar em massa as regras de firewall IPv6.",
 "label.action.bulk.delete.isos": "Apagar em massa as ISOs.",
 "label.action.bulk.delete.load.balancer.rules": "Apagar em massa as regras de balanceamento de carga.",
 "label.action.bulk.delete.portforward.rules": "Apagar em massa as regras de encaminhamento de porta.",
+"label.action.bulk.delete.routing.firewall.rules": "Remover em massa regras de firewall de Roteamento IPv4",
+"label.action.bulk.delete.snapshots": "Excluir snapshots em massa",
 "label.action.bulk.delete.templates": "Apagar em massa as regras de template.",
 "label.action.bulk.release.public.ip.address": "Liberar em massa os enderec\u0327os de IPs P\u00fablicos.",
 "label.action.cancel.maintenance.mode": "Cancelar modo de manuten\u00e7\u00e3o",
 "label.action.change.password": "Trocar de senha",
+"label.action.change.primary.storage.scope": "Alterar escopo do armazenamento prim\u00e1rio",
+"label.action.clear.webhook.deliveries": "Limpar entregas do webhook",
+"label.action.delete.webhook.deliveries": "Excluir entregas do webhook",
 "label.action.configure.stickiness": "Ader\u00eancia",
 "label.action.copy.iso": "Copiar ISO",
+"label.action.copy.snapshot": "Copiar Snapshot",
 "label.action.copy.template": "Copiar template",
 "label.action.create.snapshot.from.vmsnapshot": "Criar snapshot a partir de uma snapshot de VM",
 "label.action.create.template.from.volume": "Criar template a partir do disco",
 "label.action.create.volume": "Criar disco",
+"label.action.create.volume.add": "Criar e Adicionar Volume",
 "label.action.delete.account": "Remover conta",
 "label.action.delete.backup.offering": "Remover oferta de backup",
 "label.action.delete.cluster": "Remover cluster",
@@ -65,20 +81,29 @@
 "label.action.delete.domain": "Remover dom\u00ednio",
 "label.action.delete.egress.firewall": "Remover regra de sa\u00edda do firewall",
 "label.action.delete.firewall": "Remover regra de firewall",
+"label.action.delete.guest.os": "Excluir Guest OS",
+"label.action.delete.guest.os.hypervisor.mapping": "Excluir mapeamento de virtualizador do Guest OS",
+"label.action.delete.interface.static.route": "Remover rota est\u00e1tica da interface Tungsten Fabric",
 "label.action.delete.ip.range": "Remover intervalo de IPs",
 "label.action.delete.iso": "Remover ISO",
 "label.action.delete.load.balancer": "Remover regra do balanceador de carga",
 "label.action.delete.network": "Remover rede",
+"label.action.delete.network.permission": "Excluir permiss\u00e3o de Rede",
+"label.action.delete.network.static.route": "Remover rota est\u00e1tica de Rede Tungsten Fabric",
 "label.action.delete.node": "Remover nodo",
+"label.action.delete.oauth.provider": "Excluir provedor OAuth",
+"message.action.delete.object.storage": "Por favor, confirme que voc\u00ea deseja excluir este Object Storage",
 "label.action.delete.physical.network": "Remover rede f\u00edsica",
 "label.action.delete.pod": "Remover pod",
 "label.action.delete.primary.storage": "Remover armazenamento prim\u00e1rio",
+"label.action.delete.routing.firewall.rule": "Excluir regra de firewall de Roteamento IPv4",
 "label.action.delete.secondary.storage": "Remover armazenamento secund\u00e1rio",
 "label.action.delete.security.group": "Remover grupo de seguran\u00e7a",
 "label.action.delete.service.offering": "Remover plano",
 "label.action.delete.snapshot": "Remover snapshot",
 "label.action.delete.system.service.offering": "Remover oferta de servi\u00e7o de sistema",
 "label.action.delete.template": "Remover template",
+"label.action.delete.tungsten.router.table": "Remover tabela de rotas Tungsten Fabric da Rede",
 "label.action.delete.user": "Remover usu\u00e1rio",
 "label.action.delete.volume": "Remover disco",
 "label.action.delete.zone": "Remover zona",
@@ -87,11 +112,16 @@
 "label.action.destroy.volume": "Destruindo volume",
 "label.action.detach.disk": "Desanexar disco",
 "label.action.detach.iso": "Desanexar ISO",
+"label.action.disable.2FA.user.auth": "Desativar Autentica\u00e7\u00e3o de dois fatores do usu\u00e1rio",
 "label.action.disable.account": "Desativar conta",
 "label.action.disable.cluster": "Desativar cluster",
+"label.action.disable.disk.offering": "Desativar oferta de disco",
 "label.action.disable.physical.network": "Desabilitar rede f\u00edsica",
 "label.action.disable.pod": "Desativar pod",
+"label.action.disable.role": "Desativar Fun\u00e7\u00e3o",
 "label.action.disable.static.nat": "Desativar NAT est\u00e1tico",
+"label.action.disable.service.offering": "Desativar oferta de servi\u00e7o",
+"label.action.disable.system.service.offering": "Desativar oferta de servi\u00e7o do sistema",
 "label.action.disable.user": "Desativar usu\u00e1rio",
 "label.action.disable.zone": "Desativar zona",
 "label.action.download.iso": "Baixar ISO",
@@ -102,22 +132,33 @@
 "label.action.edit.domain": "Editar dom\u00ednio",
 "label.action.edit.instance": "Editar inst\u00e2ncia",
 "label.action.edit.iso": "Editar ISO",
+"label.action.edit.nfs.options": "Editar op\u00e7\u00f5es de montagem NFS",
+"label.action.edit.template": "Editar Template",
 "label.action.edit.zone": "Editar zona",
 "label.action.enable.account": "Ativar conta",
 "label.action.enable.cluster": "Ativar cluster",
+"label.action.enable.disk.offering": "Ativar oferta de disco",
 "label.action.enable.maintenance.mode": "Ativar modo de manuten\u00e7\u00e3o",
 "label.action.enable.physical.network": "Habilitar rede f\u00edsica",
 "label.action.enable.pod": "Ativar pod",
+"label.action.enable.role": "Ativar role",
 "label.action.enable.static.nat": "Ativar NAT est\u00e1tico",
+"label.action.enable.service.offering": "Ativar oferta de servi\u00e7o",
+"label.action.enable.system.service.offering": "Ativar oferta de servi\u00e7o do sistema",
+"label.action.enable.two.factor.authentication": "Autentica\u00e7\u00e3o de dois fatores ativada",
 "label.action.enable.user": "Habilitar usu\u00e1rio",
 "label.action.enable.zone": "Ativar zona",
 "label.action.expunge.instance": "Eliminar inst\u00e2ncia",
 "label.action.force.reconnect": "Forc\u0327ar reconex\u00e3o",
 "label.action.generate.keys": "Gerar chaves",
+"label.action.generate.api.secret.keys": "Gerar novos pares de chave de API",
 "label.action.get.diagnostics": "Obter diagn\u00f3stico",
+"label.action.health.monitor": "Monitor de sa\u00fade",
 "label.action.image.store.read.only": "Colocar armazenamento secund\u00e1rio em modo somente leitura",
 "label.action.image.store.read.write": "Colocar armazenamento secund\u00e1rio em modo leitura-escrita",
 "label.action.import.export.instances": "Importar-exportar inst\u00e2ncias",
+"label.action.import.unmanage.volumes": "Importar volumes de dados",
+"label.action.ingest.instances": "Ingerir inst\u00e2ncias",
 "label.action.iso.permission": "Atualizar permiss\u00f5es da ISO",
 "label.action.iso.share": "Atualizar compartilhamento da ISO",
 "label.action.lock.account": "Bloquear conta",
@@ -126,6 +167,9 @@
 "label.action.migrate.router": "Migrar roteador",
 "label.action.migrate.systemvm": "Migrar VM de sistema",
 "label.action.migrate.systemvm.to.ps": "Migrar VM de sistema para outro armazenamento prim\u00e1rio",
+"label.action.patch.systemvm": "Aplicar patch na VM de sistema",
+"label.action.patch.systemvm.vpc": "Aplicar patch na VM de Sistema - Roteador Virtual de VPCs",
+"label.action.patch.systemvm.processing": "Aplicando patch na VM de sistema....",
 "label.action.project.add.account": "Adicionar conta ao projeto",
 "label.action.project.add.user": "Adicionar usu\u00e1rio a um projeto",
 "label.action.quota.tariff.create": "Criar tarifa",
@@ -136,21 +180,36 @@
 "label.action.reboot.systemvm": "Reiniciar VM de sistema",
 "label.action.recover.volume": "Recuperar volume",
 "label.action.recurring.snapshot": "Snapshots recorrentes",
+"label.action.resize.sharedfs": "Redimensionar Sistema de Arquivos Compartilhado",
+"label.action.restart.sharedfs": "Reiniciar Sistema de Arquivos Compartilhado",
 "label.action.register.iso": "Registrar ISO",
 "label.action.register.template": "Registrar template a partir da URL",
+"label.action.release.asnumber": "Liberar N\u00famero AS",
 "label.action.release.ip": "Liberar IP",
+"label.action.release.reserved.ip": "Liberar IP reservado",
 "label.action.remove.host": "Remover host",
+"label.action.remove.logical.router": "Remover Roteador L\u00f3gico",
+"label.action.remove.network.policy": "Remover Pol\u00edtica de Rede",
+"label.action.remove.nic": "Remover NIC",
+"label.action.remove.router.table.from.interface": "Remover tabela de rotas Tungsten Fabric da interface",
+"label.action.remove.tungsten.routing.policy": "Remover pol\u00edtica de roteamento Tungsten Fabric da Rede",
+"label.action.reserve.ip": "Reservar IP P\u00fablico",
+"label.action.reset.network.permissions": "Redefinir permiss\u00f5es de Rede",
 "label.action.reset.password": "Recuperar senha",
 "label.action.resize.volume": "Redimensionar volume",
 "label.action.revert.snapshot": "Reverter para snapshot",
 "label.action.router.health.checks": "Obter resultado das checagens de sa\u00fade",
 "label.action.run.diagnostics": "Executar diagn\u00f3sticos",
 "label.action.secure.host": "Propagar certificado de seguran\u00e7a para o host",
+"label.action.set.as.source.nat.ip": "Tornar source NAT",
+"label.action.setup.2FA.user.auth": "Configurar Autentica\u00e7\u00e3o de Dois Fatores do Usu\u00e1rio",
 "label.action.start.instance": "Iniciar inst\u00e2ncia",
 "label.action.start.router": "Iniciar roteador",
 "label.action.start.systemvm": "Iniciar VM de sistema",
+"label.action.start.sharedfs": "Iniciar Sistema de Arquivos Compartilhado",
 "label.action.stop.instance": "Parar inst\u00e2ncia",
 "label.action.stop.router": "Parar roteador",
+"label.action.stop.sharedfs": "Parar Sistema de Arquivos Compartilhado",
 "label.action.stop.systemvm": "Parar VM de sistema",
 "label.action.take.snapshot": "Criar snapshot",
 "label.action.template.permission": "Atualizar permiss\u00f5es do template",
@@ -159,8 +218,15 @@
 "label.action.unmanage.instance": "Parar de gerenciar inst\u00e2ncia",
 "label.action.unmanage.instances": "Parar de gerenciar inst\u00e2ncias",
 "label.action.unmanage.virtualmachine": "Parar de gerenciar VM",
+"label.action.unmanage.volume": "Parar de gerenciar Volume",
+"label.action.unmanage.volumes": "Parar de gerenciar Volumes",
+"label.action.update.host": "Atualizar host",
 "label.action.update.offering.access": "Atualizar acesso \u00e0 oferta",
+"label.action.update.security.groups": "Atualizar grupos de seguran\u00e7a",
 "label.action.update.resource.count": "Atualizar contagem de recursos",
+"label.action.userdata.reset": "Redefinir Userdata",
+"label.action.value": "A\u00e7\u00e3o/Valor",
+"label.action.verify.two.factor.authentication": "Autentica\u00e7\u00e3o de dois fatores verificada",
 "label.action.vmsnapshot.create": "Criar snapshot de VM",
 "label.action.vmsnapshot.delete": "Remover snapshot de VM",
 "label.action.vmsnapshot.revert": "Reverter snapshot de VM",
@@ -175,6 +241,7 @@
 "label.add.acl": "Adiciona lista ACL",
 "label.add.affinity.group": "Adicionar um grupo de afinidade",
 "label.add.baremetal.dhcp.device": "Adicionar dispositivo DHCP baremetal",
+"label.add.bgp.peer": "Adicionar par BGP",
 "label.add.bigswitchbcf.device": "Adicionar controlador BigSwitch BCF",
 "label.add.brocadevcs.device": "Adicionar switch Brocade Vcs",
 "label.add.by": "Adicionado por",
@@ -182,40 +249,56 @@
 "label.add.ciscoasa1000v": "Adicionar recurso CiscoASA1000v",
 "label.add.cluster": "Adicionar cluster",
 "label.add.compute.offering": "Adicionar oferta de computa\u00e7\u00e3o",
+"label.add.condition": "Adicionar condi\u00e7\u00e3o",
 "label.add.disk.offering": "Adicionar oferta de disco",
 "label.add.domain": "Adicionar dom\u00ednio",
 "label.add.egress.rule": "Adicionar regra de sa\u00edda",
 "label.add.f5.device": "Adicionar dispositivo F5",
 "label.add.firewall": "Adicionar regra de firewall",
+"label.add.firewallrule": "Adicionar Regra de Firewall",
 "label.add.guest.network": "Adicionar rede guest",
+"label.add.guest.os": "Adicionar SO convidado",
+"label.add.guest.os.hypervisor.mapping": "Adicionar mapeamento de hypervisor do Guest OS",
+"label.add.gui.theme": "Adicionar tema da GUI",
 "label.add.host": "Adicionar host",
 "label.add.ingress.rule": "Adicionar regra de entrada",
 "label.add.intermediate.certificate": "Adicionar certificado intermedi\u00e1rio",
 "label.add.internal.lb": "Adicionar LB interno",
 "label.add.ip.range": "Adicionar intervalo de IPs",
+"label.add.ip.v6.prefix": "Adicionar prefixo IPv6",
+"label.add.ipv4.subnet": "Adicionar sub-rede IPv4 para redes Roteadas",
 "label.add.isolated.network": "Adiciona rede isolada",
+"label.add.key.value": "Adicionar par de chaves valor",
 "label.add.kubernetes.cluster": "Adicionar cluster Kubernetes",
 "label.add.ldap.account": "Adicionar conta LDAP",
 "label.add.acl.name": "Nome da lista ACL",
+  "label.add.logical.router": "Adicionar Roteador L\u00f3gico a esta Rede",
 "label.add.more": "Adicionar mais",
 "label.add.netscaler.device": "Adicionar dispositivo Netscaler",
 "label.add.network": "Adicionar rede",
 "label.add.network.acl": "Adicione ACL de rede",
 "label.add.network.acl": "Adicionar lista de ACL de rede",
 "label.add.network.offering": "Adicionar oferta de rede",
+"label.add.network.permission": "Adicionar permiss\u00e3o de Rede",
 "label.add.new.gateway": "Adicionar novo gateway",
 "label.add.new.tier": "Adicionar nova camada",
 "label.add.niciranvp.device": "Adicionar controlador Nvp",
 "label.add.note": "Adicionar coment\u00e1rio",
+"label.add.object.storage" : "Adicionar Object Storage",
 "label.add.opendaylight.device": "Adiciona controlador OpenDaylight",
 "label.add.pa.device": "Adicionar dispositivo Palo Alto",
+"label.add.param": "Adicionar par\u00c2metro",
 "label.add.physical.network": "Adicionar rede f\u00edsica",
 "label.add.pod": "Adicionar pod",
+"label.add.policy": "Adicionar pol\u00edtica",
+"label.add.prefix": "Adicionar prefixo",
 "label.add.primary.storage": "Adicionar armazenamento prim\u00e1rio",
 "label.add.private.gateway": "Adicionar gateway privado",
 "label.add.resources": "Adicionar recursos",
 "label.add.role": "Adicionar fun\u00e7\u00e3o",
 "label.add.route": "Adicionar rota",
+"label.add.router.table.to.instance": "Adicionar tabela de roteamento a esta Inst\u00e2ncia",
+"label.add.routing.policy": "Adicionar pol\u00edtica de roteamento",
 "label.add.rule": "Adicionar regra",
 "label.add.secondary.ip": "Adicionar IP secund\u00e1rio",
 "label.add.secondary.storage": "Adicionar armazenamento secund\u00e1rio",
@@ -224,8 +307,26 @@
 "label.add.srx.device": "Adicionar dispositivo SRX",
 "label.add.static.route": "Adicionar rota est\u00e1tica",
 "label.add.system.service.offering": "Adicionar oferta de servi\u00e7o para VMs de sistema",
+"label.add.term.then": "Adicionar termo",
 "label.add.traffic": "Adicionar tr\u00e1fego",
 "label.add.traffic.type": "Adicionar tipo de tr\u00e1fego",
+"label.add.tungsten.address.group": "Adicionar Grupo de Endere\u00e7os",
+"label.add.tungsten.fabric.route": "Adicionar tabela de roteamento de Rede Tungsten Fabric",
+"label.add.tungsten.firewall.policy": "Adicionar Pol\u00edtica de Firewall",
+"label.add.tungsten.firewall.rule": "Adicionar Regra de Firewall",
+"label.add.tungsten.interface.route": "Adicionar tabela de roteamento de interface Tungsten Fabric",
+"label.add.tungsten.interface.static.route": "Adicionar rota est\u00e1tica de interface Tungsten Fabric",
+"label.add.tungsten.logical.route": "Adicionar Roteador L\u00f3gico",
+"label.add.tungsten.network.static.route": "Adicionar rota est\u00e1tica de Rede Tungsten Fabric",
+"label.add.tungsten.policy": "Adicionar Pol\u00edtica",
+"label.add.tungsten.policy.set": "Adicionar Conjunto de Pol\u00edticas de Aplica\u00e7\u00e3o",
+"label.add.tungsten.router.table": "Adicionar tabela de roteamento a esta Rede",
+"label.add.tungsten.routing.policy": "Adicionar pol\u00edtica de roteamento a esta Rede",
+"label.add.tungsten.service.group": "Adicionar Grupo de Servi\u00e7os",
+"label.add.tungsten.tag": "Adicionar Tag",
+"label.add.tungsten.tag.type": "Adicionar Tipo de Tag",
+"label.add.upstream.ipv4.routes": "Adicionar roteamento upstream IPv4",
+"label.add.upstream.ipv6.routes": "Adicionar roteamento upstream IPv6",
 "label.add.user": "Adicionar usu\u00e1rio",
 "label.add.vm": "Adicionar VM",
 "label.add.vms": "Adicionar VMs",
@@ -240,7 +341,9 @@
 "label.adding": "Adicionando",
 "label.adding.user": "Adicionando usu\u00e1rio",
 "label.address": "Endere\u00e7o",
+"label.address.group": "Grupo de endere\u00e7os",
 "label.admin": "Administrador",
+"label.adminsonly": "Vis\u00edvel apenas para administradores",
 "label.advanced": "Avan\u00e7ado",
 "label.advanced.mode": "Modo avan\u00e7ado",
 "label.affinity": "Afinidade",
@@ -248,6 +351,7 @@
 "label.affinitygroup": "Grupo de afinidade",
 "label.agent.password": "Senha do agente",
 "label.agent.username": "Usu\u00e1rio do agente",
+"label.agentcount": "N\u00famero de agentes conectados",
 "label.agentport": "Porta do agente",
 "label.agentstate": "Estado do agente",
 "label.agree": "Concordo",
@@ -257,49 +361,85 @@
 "label.algorithm": "Algoritmo",
 "label.all": "Todos",
 "label.all.available.data": "Todos os dados dispon\u00edveis",
+"label.all.ipv6": "Todos IPv6",
 "label.all.zone": "Todas as zonas",
 "label.allocated": "Alocado",
+"label.allocatedonly": "Alocado",
 "label.allocationstate": "Estado da aloca\u00e7\u00e3o",
 "label.allow": "Permitir",
+"label.allow.duplicate.macaddresses": "Permitir endere\u00e7os MAC duplicados",
 "label.allowuserdrivenbackups": "Permitir backups manuais pelos usu\u00e1rios",
 "label.annotation": "Coment\u00e1rio",
 "label.annotations": "Coment\u00e1rios",
 "label.annotation.everyone": "Vis\u00edvel a todos",
 "label.anti.affinity": "Anti-afinidade",
 "label.anti.affinity.group": "Grupo de anti-afinidade",
+"label.api.docs": "Documenta\u00e7\u00c3o da API",
+"label.api.docs.description": "Para informa\u00e7\u00f5es sobre como as APIs funcionam e dicas de como us\u00e1-las, clique aqui para ver o Guia do Desenvolvedor",
+"label.api.docs.count": "APIs dispon\u00edveis para sua conta",
 "label.api.version": "Vers\u00e3o da API",
 "label.apikey": "Chave da API",
 "label.app.cookie": "AppCookie",
 "label.app.name": "CloudStack",
+"label.application.policy.set": "Conjunto de Pol\u00edticas de Aplica\u00e7\u00e3o",
 "label.apply": "Aplicar",
+"label.apply.tungsten.firewall.policy": "Aplicar Pol\u00edtica de Firewall",
+"label.apply.tungsten.network.policy": "Aplicar Pol\u00edtica de Rede",
+"label.apply.tungsten.tag": "Aplicar tag",
+"label.arch": "Arquitetura",
+"label.archived": "Arquivado",
 "label.archive": "Arquivo",
 "label.archive.alerts": "Arquivar alertas",
 "label.archive.events": "Arquivar eventos",
 "label.as.default": "como padr\u00e3o",
+"label.asnumber": "N\u00famero AS",
+"label.asnumbers": "N\u00fameros AS",
+"label.asnrange": "Faixa AS",
 "label.assign": "Atribuir",
 "label.assign.instance.another": "Atribuir inst\u00e2ncia para outra conta",
 "label.assign.vms": "Atribuir VMs",
 "label.assigning.vms": "Atribuindo VMs",
+"label.associated.resource": "Recurso associado",
 "label.associatednetwork": "Rede associada",
 "label.associatednetworkid": "ID de rede associado",
 "label.associatednetworkname": "Nome da rede",
 "label.asyncbackup": "Backup ass\u00edncrono",
+"label.attaching": "Anexando",
+"label.authentication.method": "M\u00e9todo de Autentica\u00e7\u00e3o",
+"label.authentication.sshkey": "Chave SSH do Sistema",
+"label.autoscale": "AutoScale",
+"label.autoscalevmgroupname": "Grupo de AutoScale",
 "label.author.email": "E-mail do autor",
 "label.author.name": "Nome do autor",
+"label.auto.assign": "Atribuir automaticamente",
 "label.auto.assign.diskoffering.disk.size": "Atribuir automaticamente a oferta correspondente ao tamanho do disco",
 "label.auto.assign.random.ip": "Atribuir automaticamente um enderec\u0327o de IP aleat\u00f3rio",
 "label.auto.refresh.statistics": "Tempo entre atualiza\u00e7\u00f5es autom\u00e1ticas",
 "label.auto.refresh.statistics.none": "Nenhum",
+"label.automigrate.volume": "Migrar volume automaticamente para outro pool de armazenamento, se neces\u00e1rio",
+"label.autoscale.vm.groups": "Grupos de AutoScale",
+"label.autoscale.vm.profile": "Perfil de Inst\u00e2ncia de AutoScale",
 "label.autoscalingenabled": "Escalonamento autom\u00e1tico",
 "label.availability": "Disponibilidade",
 "label.available": "Dispon\u00edvel",
+"label.availableprocessors": "N\u00facleos de processador dispon\u00edveis",
+"label.availablevirtualmachinecount": "Inst\u00e2ncias Dispon\u00edveis",
 "label.back": "Voltar",
 "label.backup": "Backup",
 "label.backups": "Backups",
+"label.back.login": "Voltar à página de login",
+"label.backup": "Backups",
 "label.backup.attach.restore": "Restaurar e anexar volume de backup",
+"label.backuplimit": "Limite de backups",
+"label.backup.storage": "Armazenamento de backup",
+"label.backupstoragelimit": "Limite de armazenamento de backup (GiB)",
+"label.backup.configure.schedule": "Configurar Agendamento de Backup",
 "label.backup.offering.assign": "Atribuir VM a oferta de backup",
 "label.backup.offering.remove": "Remover VM de oferta de backup",
 "label.backup.offerings": "Ofertas de backup",
+"label.backup.repository": "Reposit\u00f3rio de Backup",
+"label.backup.repository.add": "Adicionar reposit\u00f3rio de backup",
+"label.backup.repository.remove": "Remover reposit\u00f3rio de backup",
 "label.backup.restore": "Restaurar backup da VM",
 "label.backupofferingid": "Oferta de backup",
 "label.backupofferingname": "Oferta de backup",
@@ -316,6 +456,8 @@
 "label.based.on.role.id.or.type": "Criar uma fun\u00e7\u00e3o baseado no ID da fun\u00e7\u00e3o ou no seu tipo",
 "label.basic": "B\u00e1sico",
 "label.bcfdeviceid": "ID",
+"label.bgp.peers": "Pares BGP",
+"label.bgp.peer.set.reservation.desc": "Voc\u00ea pode tornar o par BGP p\u00fablico, ou pode dedic\u00e1-lo/reserv\u00e1-lo para um Dom\u00ednio ou uma Conta",
 "label.bigswitch.controller.address": "Endere\u00e7o do controlador BigSwitch BCF",
 "label.bladeid": "ID da l\u00e2mina",
 "label.blades": "L\u00e2minas",
@@ -327,7 +469,13 @@
 "label.broadcastdomaintype": "Tipo de dom\u00ednio broadcast",
 "label.broadcasturi": "URI de broadcast",
 "label.brocade.vcs.address": "Endere\u00e7o do switch Vcs",
+"label.browser": "Navegador",
 "label.bucket": "Bucket",
+"label.bucket.delete": "Excluir Bucket",
+"label.bucket.policy": "Pol\u00edtica do Bucket",
+"label.bucket.update": "Atualizar Bucket",
+"label.bucketlimit": "Limite de Bucket",
+"label.buckets": "Buckets",
 "label.by.account": "por conta",
 "label.by.domain": "por dom\u00ednio",
 "label.by.level": "por n\u00edvel",
@@ -338,6 +486,9 @@
 "label.bypassvlanoverlapcheck": "Ignorar a sobreposi\u00e7\u00e3o de ID/intervalo de VLAN",
 "label.cachemode": "Tipo do cache de escrita",
 "label.cancel": "Cancelar",
+"label.cancel.host.as.degraded": "Cancelar host como degradado",
+"label.cancel.shutdown": "Cancelar Desligamento",
+"label.cancelmaintenance": "Cancelar manuten\u00e7\u00e3o",
 "label.capacity": "Capacidade",
 "label.capacitybytes": "Capacidade de bytes",
 "label.capacityiops": "IOPS total",
@@ -348,9 +499,13 @@
 "label.certificate.upload.failed": "Falha ao carregar certificado",
 "label.certificate.upload.failed.description": "Falha ao atualizar certificado SSL. Falha na verifica\u00e7\u00e3o do certificado.",
 "label.certificateid": "ID do certificado",
+"label.change": "Alterar",
 "label.change.affinity": "Mudar afinidade",
+"label.change.bgp.peers": "Alterar pares BGP",
+"label.change.disk.offering": "Alterar oferta de disco",
 "label.change.ip.address": "Trocar endere\u00e7o IP",
 "label.change.ipaddress": "Mudan\u00e7a de endere\u00e7o IP para NIC",
+"label.change.offering.for.volume": "Alterar oferta de disco para o volume",
 "label.change.service.offering": "Alterar oferta de servi\u00e7o",
 "label.character": "Caracter",
 "label.checksum": "Checksum",
@@ -359,6 +514,7 @@
 "label.cidr": "CIDR",
 "label.cidr.destination.network": "CIDR da rede de destino",
 "label.cidrlist": "Lista de CIDRs",
+"label.cidrsize": "Tamanho do CIDR",
 "label.cisco.nexus1000v.ip.address": "Endere\u00e7o IP do Nexus 1000v",
 "label.cisco.nexus1000v.password": "Senha do Nexus 1000v",
 "label.cisco.nexus1000v.username": "Usu\u00e1rio do Nexus 1000v",
@@ -369,42 +525,75 @@
 "label.cleanup": "Limpar",
 "label.clear": "Limpar",
 "label.clear.list": "Limpar lista",
+"label.clear.notification": "Limpar notifica\u00e7\u00e3o",
+"label.clientid": "ID do Cliente Provedor",
 "label.close": "Fechar",
+"label.cloud.managed": "Gerenciado pela Nuvem",
 "label.cloudian.storage": "Armazenamento Cloudian",
 "label.cluster": "Cluster",
 "label.cluster.name": "Nome do cluster",
 "label.cluster.size": "Tamanho do cluster",
 "label.clusterid": "Cluster",
 "label.clustername": "Nome do cluster",
+"label.clusternamelabel": "Nome do cluster",
 "label.clusters": "Clusters",
 "label.clustertype": "Tipo de cluster",
 "label.clvm": "CLVM",
 "label.code": "C\u00f3digo",
+"label.collectiontime": "Tempo de coleta",
+"label.columns": "Colunas",
 "label.comma.separated.list.description": "Insira uma lista de comandos separados por v\u00edrgulas",
+"label.command": "Comando",
 "label.comments": "Coment\u00e1rios",
+"label.commonnames": "Nomes Comuns (CN)",
+"label.communities": "Comunidades",
 "label.community": "Comunidade",
 "label.complete": "Complete",
+"label.compressionstatus": "Estado de compress\u00e3o",
 "label.compute": "Computa\u00e7\u00e3o",
 "label.compute.offerings": "Oferta de computa\u00e7\u00e3o",
+"label.compute.offering.for.sharedfs.instance": "Oferta de computa\u00e7\u00e3o para Inst\u00e2ncia",
+"label.computeonly.offering": "Oferta de disco apenas para computa\u00e7\u00e3o",
+"label.computeonly.offering.tooltip": "Op\u00e7\u00e3o para especificar informa\u00e7\u00f5es relacionadas ao disco ROOT na oferta de computa\u00e7\u00e3o ou para vincular diretamente uma oferta de disco \u00e0 oferta de computa\u00e7\u00e3o",
+"label.conditions": "Condi\u00e7\u00f5es",
 "label.configuration": "Configura\u00e7\u00e3o",
 "label.configure": "Configurar",
+"label.configure.app": "Configurar o App",
+"label.configure.instance": "Configurar inst\u00e2ncia",
+"label.configure.health.monitor": "Configurar Monitor de Sa\u00fade",
 "label.configure.ldap": "Configurar LDAP",
 "label.configure.ovs": "Configure Ovs",
 "label.configure.sticky.policy": "Configurar sticky policy",
 "label.confirm.delete.egress.firewall.rules": "Por favor, confirme se deseja apagar as regras de firewall de sa\u00edda selecionadas",
 "label.confirm.delete.firewall.rules": "Por favor, confirme se deseja apagar as regras de firewall selecionadas",
+"label.confirm.delete.ip.v6.firewall.rules": "Por favor, confirme que deseja excluir as regras de firewall IPv6 selecionadas",
 "label.confirm.delete.isos": "Por favor, confirme se deseja apagar as ISOs selecionadas",
 "label.confirm.delete.loadbalancer.rules": "Por favor, confirme se deseja apagar as regras de balanceamento de carga selecionadas",
 "label.confirm.delete.portforward.rules": "Por favor, confirme se deseja apagar as regras de encaminhamento de porta selecionadas",
+"label.confirm.delete.routing.firewall.rules": "Por favor, confirme que deseja excluir as regras de firewall de Roteamento IPv4 selecionadas",
+"label.confirm.delete.snapshot.zones": "Por favor, confirme que deseja excluir o Snapshot nas zonas selecionadas",
 "label.confirm.delete.templates": "Por favor, confirme se deseja apagar os templates selecionados",
+"label.confirm.delete.tungsten.address.group": "Por favor, confirme que deseja excluir este Grupo de Endere\u00e7os",
+"label.confirm.delete.tungsten.firewall.policy": "Por favor, confirme que deseja excluir esta Pol\u00edtica de Firewall",
+"label.confirm.delete.tungsten.policy": "Por favor, confirme que deseja excluir esta Pol\u00edtica",
+"label.confirm.delete.tungsten.policy.set": "Por favor, confirme que deseja excluir este Conjunto de Pol\u00edticas de Aplica\u00e7\u00e3o",
+"label.confirm.delete.tungsten.service.group": "Por favor, confirme que deseja excluir este Grupo de Servi\u00e7os",
+"label.confirm.delete.tungsten.tag": "Por favor, confirme que deseja excluir esta Tag",
+"label.confirm.delete.tungsten.tag.type": "Por favor, confirme que deseja excluir este Tipo de Tag",
+"label.confirm.remove.logical.router": "Por favor, confirme que deseja excluir este Roteador L\u00f3gico",
 "label.confirm.release.public.ip.addresses": "Por favor, confirme se deseja liberar os endere\u00e7os IPs selecionados",
+"label.confirm.remove.network.route.table": "Por favor, confirme que deseja excluir esta Tabela de Rotas de Rede",
+"label.confirm.remove.route.table": "Por favor, confirme que deseja excluir esta Tabela de Rotas de Interface",
 "label.confirmacceptinvitation": "Por favor, confirme se deseja participar deste projeto",
 "label.confirmation": "Confirma\u00e7\u00e3o",
 "label.confirmdeclineinvitation": "Voc\u00ea tem certeza que quer rejeitar este convite de projeto?",
 "label.confirmpassword": "Confirme a senha",
 "label.confirmpassword.description": "Por favor, digite a mesma senha novamente",
+"label.connect": "Conectar",
 "label.connectiontimeout": "Tempo limite de conex\u00e3o",
 "label.conservemode": "Modo conservativo",
+"label.considerlasthost": "Considerar \u00faltimo Host",
+"label.consoleproxy": "Console proxy",
 "label.console.proxy": "Console proxy",
 "label.console.proxy.vm": "VM da console proxy",
 "label.continue": "Continuar",
@@ -413,13 +602,19 @@
 "label.copied.clipboard": "Copiado para a \u00c1rea de transfer\u00eancia",
 "label.copy": "Copiar",
 "label.copy.clipboard": "Copiar para \u00c1rea de transfer\u00eancia",
+"label.copy.password": "Copiar senha",
 "label.copyid": "Copiar ID",
+"label.core": "Core",
+"label.core.zone.type": "Tipo de zona Core",
+"label.counter": "Contador",
+"label.counter.name": "Nome do contador para o qual a pol\u00edtica ser\u00e1 avaliada",
 "label.cpu": "CPU",
 "label.cpu.sockets": "Sockets da CPU",
 "label.cpu.usage.info": "Informa\u00e7\u00f5es sobre o uso de CPU",
 "label.cpuallocated": "CPU alocada por VMs",
 "label.cpuallocatedghz": "Alocado",
 "label.cpulimit": "Limite de CPU",
+"label.cpuload": "% de CPU em uso",
 "label.cpumaxdeviation": "Desvio",
 "label.cpunumber": "N\u00facleos da CPU",
 "label.cpusockets": "O n\u00famero de sockets de CPU",
@@ -429,13 +624,17 @@
 "label.cpuused": "CPU utilizada",
 "label.cpuusedghz": "CPU utilizada",
 "label.create": "Criar",
-"label.create.instance": "Criar nova instância",
 "label.create.account": "Criar conta",
+"label.create.asnrange": "Criar faixa de número AS",
 "label.create.backup": "Iniciar backup",
+"label.create.bucket": "Criar Bucket",
+"label.create.instance": "Criar inst\u00e2ncia na nuvem",
+"label.create.instance.from.backup": "Criar nova inst\u00e2ncia a partir de backup",
 "label.create.network": "Criar nova rede",
 "label.create.nfs.secondary.staging.storage": "Criar armazenamento secund\u00e1rio tempor\u00e1rio",
 "label.create.project": "Criar um projeto",
 "label.create.project.role": "Criar fun\u00e7\u00e3o para o projeto",
+"label.create.routing.policy": "Criar Pol\u00edtica de Roteamento",
 "label.create.site.vpn.connection": "Criar conex\u00e3o VPN site-to-site",
 "label.create.site.vpn.gateway": "Criar gateway de VPN site-to-site",
 "label.create.snapshot.for.volume": "Criar snapshot para volume",
@@ -447,11 +646,19 @@
 "label.create.tier.name.description": "Um nome \u00fanico para a camada",
 "label.create.tier.netmask.description": "M\u00e1scara de rede da camada. Por exemplo: 255.255.255.0",
 "label.create.tier.networkofferingid.description": "A oferta de rede da camada",
+"label.create.tungsten.routing.policy": "Criar pol\u00edtica de roteamento Tungsten-Fabric",
+"label.create.sharedfs": "Criar Sistema de Arquivos Compartilhado",
 "label.create.user": "Criar usu\u00e1rio",
+"label.create.vm": "Criar Inst\u00e2ncia",
+"label.create.vm.and.stay": "Criar Inst\u00e2ncia e permanecer nesta p\u00e1gina",
 "label.create.vpn.connection": "Criar uma conex\u00e3o VPN",
+"label.create.webhook": "Criar Webhook",
 "label.created": "Criado",
+"label.creating": "Criando",
 "label.creating.iprange": "Criando intervalos de IP",
 "label.credit": "Cr\u00e9dito",
+"label.cron": "Express\u00e3o Cron",
+"label.cron.mode": "Modo Cron",
 "label.crosszones": "Inter zonas",
 "label.currency": "Moeda",
 "label.current": "Atual",
@@ -469,14 +676,22 @@
 "label.data.pool": "Data pool",
 "label.data.pool.description": "\u00c9 necess\u00e1rio informar um data pool ao utilizar um Ceph pool com erasure code",
 "label.date": "Data",
+"label.datetime.filter.period": "De <b>{startDate}</b> at\u00e9 <b>{endDate}</b>",
+"label.datetime.filter.starting": "Iniciando <b>{startDate}</b>",
+"label.datetime.filter.up.to": "At\u00e9 <b>{endDate}</b>",
 "label.day": "Dia",
 "label.day.of.month": "Dia do m\u00eas",
 "label.day.of.week": "Dia da semana",
+"label.db.usage.metrics": "Servidor de BD/Uso",
+"label.dbislocal": "O banco de dados roda localmente",
 "label.dc.name": "Nome do DC",
+"label.declare.host.as.degraded": "Declarar host como degradado",
 "label.decline.invitation": "Rejeitar convite",
 "label.dedicate": "Dedicado",
+"label.dedicate.bgp.peer": "Dedicar par BGP",
 "label.dedicate.cluster": "Cluster dedicado",
 "label.dedicate.host": "Dedicar host",
+"label.dedicate.ipv4.subnet": "Dedicar sub-rede IPv4",
 "label.dedicate.pod": "Pod dedicado",
 "label.dedicate.vlan.vni.range": "Intervalo de VLAN/VNI dedicado",
 "label.dedicate.zone": "Zona dedicada",
@@ -484,6 +699,9 @@
 "label.dedicated.vlan.vni.ranges": "Intervalo(s) de VLAN/VNI dedicados",
 "label.dedicatedresources": "Recursos dedicados",
 "label.default": "Padr\u00e3o",
+"label.default.network.domain.isolated.network": "Dom\u00ednio de rede padr\u00e3o para redes Isoladas",
+"label.default.network.guestcidraddress.isolated.network": "CIDR guest padr\u00e3o para Redes Isoladas",
+"label.default.project": "Projeto padr\u00e3o",
 "label.default.use": "Uso padr\u00e3o",
 "label.default.view": "Visualiza\u00e7\u00e3o padr\u00e3o",
 "label.defaultnetwork": "Rede padr\u00e3o",
@@ -491,12 +709,17 @@
 "label.delete.acl": "Apagar lista ACL",
 "label.delete.affinity.group": "Apagar grupo de afinidade",
 "label.delete.alerts": "Remover alertas",
+"label.delete.asnrange": "Excluir Faixa AS",
+"label.delete.autoscale.vmgroup": "Excluir grupo de auto escalonamento horizontal",
 "label.delete.backup": "Apagar backup",
+"label.delete.backup.schedule": "Remover agendamento de backup",
+"label.delete.bgp.peer": "Excluir par BGP",
 "label.delete.bigswitchbcf": "Remover controlador BigSwitch BCF",
 "label.delete.brocadevcs": "Remover switch Brocade Vcs",
 "label.delete.certificate": "Apagar certificado",
 "label.delete.ciscoasa1000v": "Apagar CiscoASA1000v",
 "label.delete.ciscovnmc.resource": "Apagar recurso CiscoVNMC",
+"label.delete.condition": "Excluir condi\u00e7\u00e3o",
 "label.delete.dedicated.vlan.range": "Apagar intervalo de VLAN/VNI dedicado",
 "label.delete.domain": "Apagar dom\u00ednio",
 "label.delete.events": "Remover eventos",
@@ -505,6 +728,8 @@
 "label.delete.icon": "Remover \u00edcone",
 "label.delete.instance.group": "Apagar grupo de inst\u00e2ncias",
 "label.delete.internal.lb": "Apagar LB interno",
+"label.delete.ipv4.subnet": "Excluir sub-rede IPv4",
+"label.delete.ip.v6.prefix": "Excluir prefixo IPv6",
 "label.delete.netscaler": "Remover NetScaler",
 "label.delete.niciranvp": "Remover controlador Nvp",
 "label.delete.opendaylight.device": "Apagar controladora OpenDaylight",
@@ -518,28 +743,68 @@
 "label.delete.snapshot.policy": "Apagar pol\u00edtica de snapshot",
 "label.delete.srx": "Remover SRX",
 "label.delete.sslcertificate": "Apagar certificado SSL",
+"label.delete.tag": "Remover tag",
+"label.delete.term": "Excluir termo",
+"label.delete.traffic.type": "Excluir tipo de tr\u00e1fego",
+"label.delete.tungsten.address.group": "Excluir Grupo de Endere\u00e7os",
+"label.delete.tungsten.fabric.tag": "Excluir Tag",
+"label.delete.tungsten.fabric.tag.type": "Excluir Tipo de Tag",
+"label.delete.tungsten.firewall.policy": "Excluir Pol\u00edtica de Firewall",
+"label.delete.tungsten.policy": "Excluir Pol\u00edtica",
+"label.delete.tungsten.policy.set": "Excluir Conjunto de Pol\u00edticas",
+"label.delete.tungsten.service.group": "Excluir Grupo de Servi\u00e7os",
 "label.delete.volumes": "Volumes a serem apagados",
 "label.delete.vpn.connection": "Remover conex\u00e3o VPN",
 "label.delete.vpn.customer.gateway": "Remover gateway de VPN de usu\u00e1rio",
 "label.delete.vpn.gateway": "Remover gateway de VPN",
 "label.delete.vpn.user": "Apagar usu\u00e1rio VPN",
+"label.delete.webhook": "Excluir Webhook",
+"label.delete.webhook.delivery": "Excluir Entrega de Webhook",
 "label.deleteconfirm": "Por favor, confirme que voc\u00ea deseja apagar isto",
 "label.deleting": "Removendo",
 "label.deleting.failed": "Falha ao remover",
 "label.deleting.iso": "Removendo ISO",
 "label.deleting.template": "Remover template",
+"label.deleting.snapshot": "Excluindo Snapshot",
+"label.deleteprotection": "Prote\u00e7\u00e3o contra exclus\u00e3o",
 "label.demote.project.owner": "Rebaixar conta para fun\u00e7\u00e3o regular",
 "label.demote.project.owner.user": "Rebaixar usu\u00e1rio para fun\u00e7\u00e3o regular",
 "label.deny": "Negar",
 "label.deployasis": "Ler configura\u00e7\u00f5es da VM do OVA",
 "label.deploymentplanner": "Planejador de implanta\u00e7\u00e3o",
+"label.desc.db.stats": "Estat\u00edsticas do Banco de Dados",
+"label.desc.import.ext.kvm.wizard": "Importar Inst\u00e2ncia de host KVM remoto",
+"label.desc.import.local.kvm.wizard": "Importar imagem QCOW2 do Armazenamento Local",
+"label.desc.import.shared.kvm.wizard": "Importar imagem QCOW2 do Armazenamento Compartilhado",
+"label.desc.import.unmanage.volume": "Importar e parar de gerenciar volume em Pools de Armazenamento",
 "label.desc.importexportinstancewizard": "Importar e exportar inst\u00e2ncias para/de um cluster VMWare existente",
+"label.desc.importmigratefromvmwarewizard": "Importar inst\u00e2ncias do VMware para um cluster KVM",
+"label.desc.ingesttinstancewizard": "Ingerir inst\u00e2ncias de um host KVM externo",
+"label.desc.usage.stats": "Estat\u00edsticas do Usage Server",
 "label.description": "Descri\u00e7\u00e3o",
+"label.destaddressgroupuuid": "Grupo de Endere\u00e7os de Destino",
 "label.destcidr": "CIDR de destino",
+"label.destendport": "Porta Final de Destino",
+"label.desthost": "Host de destino",
 "label.destination": "Destino",
+"label.destination.cluster":  "Cluster de Destino",
+"label.destination.hypervisor":  "Hypervisor de Destino",
+"label.destination.pod":  "Pod de Destino",
+"label.destination.zone":  "Zona de Destino",
 "label.destinationphysicalnetworkid": "ID de destino da rede f\u00edsica",
+"label.destinationtype": "Tipo de Destino",
+"label.destipprefix": "Endere\u00e7o de Rede de Destino",
+"label.destipprefixlen": "Comprimento do Prefixo de Destino",
+"label.destnetwork": "Rede de Destino",
+"label.destnetworkuuid": "Rede",
+"label.destport": "Portas de Destino",
 "label.destroy": "Apagar",
 "label.destroy.router": "Destruir roteador",
+"label.destroy.sharedfs": "Destruir Sistema de Arquivos Compartilhado",
+"label.destroying": "Destruindo",
+"label.destroyed": "Destru\u00eddo",
+"label.deststartport": "Porta Inicial de Destino",
+"label.desttaguuid": "Tag de Destino",
 "label.details": "Detalhes",
 "label.deviceid": "ID do dispositivo",
 "label.devices": "Dispositivos",
@@ -547,16 +812,21 @@
 "label.direct.attached.public.ip": "IP p\u00fablico conectado diretamente",
 "label.direct.ips": "IPs diretos",
 "label.directdownload": "Download direto",
+"label.direction": "Dire\u00e7\u00e3o",
+"label.disable.autoscale.vmgroup": "Desativar grupo de auto escalonamento horizontal",
 "label.disable.host": "Desabilitar host",
 "label.disable.network.offering": "Desabilitar oferta de rede",
 "label.disable.provider": "Desabilitar provedor",
 "label.disable.storage": "Desabilitar pool de armazenamento",
 "label.disable.vpc.offering": "Desabilitar oferta VPC",
 "label.disable.vpn": "Desabilitar VPN",
+"label.disable.webhook": "Desativar Webhook",
 "label.disabled": "Desativado",
 "label.disconnected": "\u00daltima desconex\u00e3o",
 "label.disk": "Disco",
 "label.disk.offerings": "Ofertas de disco",
+"label.disk.path": "Caminho do Disco",
+"label.disk.tooltip": "Nome do arquivo de Imagem de Disco no Pool de Armazenamento selecionado",
 "label.disk.selection": "Sele\u00e7\u00e3o de disco",
 "label.disk.size": "Tamanho do disco",
 "label.disk.usage.info": "Informa\u00e7\u00f5es sobre o uso de disco",
@@ -581,6 +851,7 @@
 "label.disksize": "Tamanho (em GB)",
 "label.disksizeallocated": "Disco alocado",
 "label.disksizeallocatedgb": "Alocado",
+"label.disksizefree": "Disco livre",
 "label.disksizetotal": "Disco total",
 "label.disksizetotalgb": "Total",
 "label.disksizeunallocatedgb": "N\u00e3o alocado",
@@ -602,27 +873,46 @@
 "label.domainid": "ID do dom\u00ednio",
 "label.domainname": "Dom\u00ednio",
 "label.domainpath": "Dom\u00ednio",
+"label.domainrouter": "Roteador Virtual",
 "label.domains": "Dom\u00ednios",
 "label.done": "Pronto",
+"label.down": "Baixo",
 "label.download": "Download",
+"label.download.csv": "Baixar CSV",
 "label.download.kubeconfig.cluster": "Baixar kubeconfig para o cluster <br><br> A ferramenta de linha de comando <code><b>kubectl</b></code> usa os arquivos kubeconfig para encontrar informa\u00e7\u00f5es necess\u00e1rias para escolher o cluster e se comunicar com o servidor da API do cluster.",
 "label.download.kubectl": "Baixar a ferramenta <code><b>kubectl</b></code> para a vers\u00e3o Kubernetes do cluster",
 "label.download.kubernetes.cluster.config": "Baixar a configura\u00e7\u00e3o do cluster Kubernetes",
 "label.download.percent": "Porcentagem do download",
+"label.download.setting": "Baixar configura\u00e7\u00e3o",
 "label.download.state": "Estado do download",
 "label.dpd": "Detec\u00e7\u00e3o de correspondente morto",
 "label.driver": "Driver",
+"label.drs": "DRS",
+"label.drsimbalance": "Desequil\u00edbrio DRS",
+"label.drs.generate.plan": "Gerar plano DRS",
+"label.drs.no.plan.generated": "Nenhum plano DRS foi gerado pois o cluster n\u00e3o est\u00e1 desequilibrado",
+"label.drs.plan": "Plano DRS",
+"label.duration": "Dura\u00e7\u00e3o (em segundos)",
 "label.duration.custom": "Personalizado",
 "label.duration.1hour": "1 hora",
 "label.duration.6hours": "6 horas",
 "label.duration.12hours": "12 horas",
 "label.duration.24hours": "24 horas",
 "label.duration.7days": "7 dias",
+"label.dynamic": "Din\u00e2mico",
 "label.dynamicscalingenabled": "Escalonamento din\u00e2mico habilitado",
 "label.dynamicscalingenabled.tooltip": "VM s\u00f3 pode ser dinamicamente escalonada quando o escalonamento din\u00e2mico estiver habilitado no template, oferta de computa\u00e7\u00e3o e nas configura\u00e7\u00e3oes globais",
+"label.diskofferingstrictness": "Rigor da oferta de disco",
+"label.disksizestrictness": "Rigor do tamanho do disco",
+"label.edge": "Borda",
+"label.edge.zone": "Zona de Borda",
+"label.enable.autoscale.vmgroup": "Ativar Grupo de AutoScaleAutoScaleAutoScale",
 "label.edit": "Editar",
 "label.edit.acl": "Editar lista ACL",
+"label.edit.account": "Editar conta",
+"label.edit.acl.list": "Editar lista ACL",
 "label.edit.acl.rule": "Editar regra ACL",
+"label.edit.autoscale.vmprofile": "Editar Perfil de Inst\u00e2ncia de AutoScale",
 "label.edit.nic": "Editar NIC",
 "label.edit.project.details": "Editar detalhes do projeto",
 "label.edit.project.role": "Editar fun\u00e7\u00e3o do projeto",
@@ -640,11 +930,18 @@
 "label.email": "Email",
 "label.enable.host": "Habilita host",
 "label.enable.network.offering": "Habilita oferta de rede",
+"label.enable.oauth": "Ativar Login OAuth",
 "label.enable.provider": "Habilitar provedor",
 "label.enable.storage": "Habilitar pool de armazenamento",
 "label.enable.vpc.offering": "Habilitar oferta VPC",
 "label.enable.vpn": "Habilitar VPN",
+"label.enable.webhook": "Ativar Webhook",
+"label.enabled": "Ativado",
+"label.encrypt": "Criptografar",
+"label.encryption": "Criptografia",
+"label.encryptroot": "Criptografar Disco ROOT",
 "label.end": "Fim",
+"label.endasn": "Fim Como N\u00famero",
 "label.end.date": "Data de término",
 "label.end.date.and.time": "Data e hor\u00e1rio final",
 "label.end.ip": "IP final",
@@ -656,7 +953,11 @@
 "label.endipv6": "IP final IPv6",
 "label.endpoint": "Ponto de acesso",
 "label.endport": "Porta final",
+"label.enter.code": "Insira o c\u00f3digo 2FA para verificar",
+"label.enter.static.pin": "Insira o PIN est\u00e1tico para verificar",
 "label.enter.token": "Digite o token",
+"label.entityid": "Entidade",
+"label.entitytype": "Tipo de Entidade",
 "label.error": "Erro",
 "label.error.caught": "Erro detectado",
 "label.error.code": "C\u00f3digo de erro",
@@ -666,10 +967,14 @@
 "label.error.setting": "Erro de configura\u00e7\u00e3o",
 "label.error.something.went.wrong.please.correct.the.following": "Alguma coisa est\u00e1 errada; por favor corrija abaixo",
 "label.error.upper": "ERRO",
+"label.errorinmaintenance": "Erro na manuten\u00e7\u00e3o",
 "label.espencryption": "Encripta\u00e7\u00e3o ESP",
 "label.esphash": "Hash ESP",
 "label.esplifetime": "Tempo de vida do ESP (segundos)",
 "label.esppolicy": "Pol\u00edtica ESP",
+"label.estimatedcost": "Custo estimado",
+"label.eventid": "Evento",
+"label.eventtype": "Tipo de evento",
 "label.esx.host": "ESX/ESXi host",
 "label.event": "Eventos",
 "label.event.archived": "Evento arquivado",
@@ -679,10 +984,21 @@
 "label.every": "Cada",
 "label.example": "Exemplo",
 "label.example.plugin": "PluginDeExemplo",
+"label.execute": "Executar",
+"label.existing": "Existente",
 "label.expunge": "Eliminar",
+"label.export.data.csv": "Exportar dados como CSV",
+"label.export.details.csv": "Exportar detalhes como CSV",
+"label.export.resources.csv": "Exportar recursos como CSV",
+"label.export.rules": "Exportar Regras",
+"label.expunge.sharedfs": "Expurgar Sistema de Arquivos Compartilhado",
+"label.expungevmgraceperiod": "Per\u00edodo de car\u00eancia para expurgar Inst\u00e2ncia (em seg)",
 "label.expunged": "Eliminado",
 "label.expunging": "Eliminando",
+"label.ext.hostname.tooltip": "Nome do Host Externo ou Endere\u00e7o IP",
 "label.external.link": "Link externo",
+"label.external": "Externo",
+"label.external.managed": "Gerenciado Externamente",
 "label.externalid": "ID externo",
 "label.externalloadbalanceripaddress": "Endere\u00e7o externo do balanceador de carga",
 "label.extra": "Argumentos extras",
@@ -690,25 +1006,43 @@
 "label.f5.ip.loadbalancer": "Balanceador de carga F5 Big Ip",
 "label.failed": "Falhou",
 "label.featured": "Em destaque",
+"label.fetch.from.backup": "Buscar do backup",
+"label.fetch.instances": "Buscar Inst\u00e2ncias",
 "label.fetch.latest": "Atualizar",
+"label.fetched": "Buscado",
+"label.filename": "Nome do Arquivo",
 "label.files": "Alterar arquivos a serem recuperados",
+"label.filesystem": "Sistema de Arquivos",
 "label.filter": "Filtro",
 "label.filter.annotations.self": "Criado por mim",
 "label.filter.annotations.all": "Todos os coment\u00e1rios",
 "label.filterby": "Filtrar por",
 "label.fingerprint": "Impress\u00e3o digital",
+"label.finish": "Finalizar",
 "label.firewall": "Firewall",
+"label.firewall.policy": "Pol\u00edtica de Firewall",
+"label.firewallpolicy": "Pol\u00edtica de Firewall",
 "label.firewallrule": "Regra de firewall",
+"label.firewallruleuuid": "Regra de Firewall",
 "label.firstname": "Primeiro nome",
+"label.firstname.lower": "primeiro nome",
 "label.fix.errors": "Corrija os erros",
 "label.fixed": "Fixa",
 "label.for": "para",
 "label.forbidden": "Proibido",
+"label.force.ms.to.import.vm.files": "For\u00e7ar MS a importar arquivo(s) da VM para armazenamento tempor\u00e1rio",
+"label.force.reboot": "For\u00e7ar reinicializa\u00e7\u00e3o",
+"label.force.stop": "For\u00e7ar parada",
 "label.forced": "For\u00e7ar",
 "label.forceencap": "For\u00e7ar encapsulamento UDP de pacotes ESP",
 "label.forgedtransmits": "Transmiss\u00f5es forjadas",
+"label.forgot.password": "Esqueceu a senha?",
+"label.fornsx": "NSX",
+"label.forvpc": "VPC",
+"label.fsprovidername": "Provedor de Sistema de Arquivos Compartilhado",
 "label.format": "Formato",
 "label.free": "Livre",
+"label.french.azerty.keyboard": "Teclado franc\u00eas AZERTY",
 "label.friday": "Sexta-feira",
 "label.from": "de",
 "label.from.lb": "de LB",
@@ -717,6 +1051,7 @@
 "label.fwdeviceid": "ID",
 "label.fwdevicestate": "Estado",
 "label.gateway": "Gateway",
+"label.global": "Global",
 "label.global.settings": "Configura\u00e7\u00f5es globais",
 "label.globo.dns": "GloboDNS",
 "label.globo.dns.configuration": "Configurar GloboDNS",
@@ -741,8 +1076,11 @@
 "label.guest.ip.range": "Intervalo da rede guest",
 "label.guest.netmask": "M\u00e1scara da rede guest",
 "label.guest.networks": "Redes guest",
+"label.guest.os": "SO Convidado",
+"label.guest.os.hypervisor.mappings": "Mapeamentos de SO convidado",
 "label.guest.start.ip": "IP de in\u00edcio do guest",
 "label.guest.traffic": "Tr\u00e1fego da redes guest",
+"label.guest.vlan": "VLAN Guest",
 "label.guestcidraddress": "CIDR da rede guest",
 "label.guestendip": "IP do fim do guest",
 "label.guestgateway": "Gateway da rede guest",
@@ -762,11 +1100,15 @@
 "label.haenable": "HA ativado",
 "label.haprovider": "Provedor HA",
 "label.hardware": "Hardware",
+"label.hasrules":"Regras de FW definidas",
 "label.hastate": "Estado do HA",
 "label.header.backup.schedule": "Voc\u00ea pode definir cronogramas de backup recorrentes selecionando dentre as op\u00e7\u00f5es dispon\u00edveis abaixo e aplicando suas pol\u00edticas preferenciais",
 "label.header.volume.snapshot": "Voc\u00ea pode configurar snapshots recorrentes selecionando as op\u00e7\u00f5es dispon\u00edveis abaixo e aplicando suas pol\u00edticas preferenciais",
 "label.header.volume.take.snapshot": "Por favor confirme que voc\u00ea deseja criar uma snapshot para este volume.",
+"label.headers": "Cabe\u00e7alhos",
 "label.health.check": "Checagem de sa\u00fade",
+"label.heapmemoryused": "Mem\u00f3ria heap usada",
+"label.heapmemorytotal": "Mem\u00f3ria heap dispon\u00edvel",
 "label.help": "Ajuda",
 "label.hideipaddressusage": "Ocultar uso do endere\u00e7o IP",
 "label.home": "In\u00edcio",
@@ -774,11 +1116,19 @@
 "label.host.alerts": "Hosts em estado de alerta",
 "label.host.name": "Nome do host",
 "label.host.tag": "Tag de host",
+"label.hostcontrolstate": "Status do Recurso de Computa\u00e7\u00e3o",
 "label.hostid": "Host",
 "label.hostname": "Host",
+"label.hostname.tooltip": "Host de Destino. O volume deve estar localizado no armazenamento local deste Host",
 "label.hostnamelabel": "Nome do host",
 "label.hosts": "Hosts",
 "label.hosttags": "Tags de host",
+"label.hosttags.explicit": "Tags de Host definidas pela API",
+"label.hosttags.explicit.abbr": "definido pela api",
+"label.hosttags.explicit.description": "As tags de host definidas pelas APIs do CloudStack",
+"label.hosttags.implicit": "Tags de Host definidas pelo Agente",
+"label.hosttags.implicit.abbr": "definido pelo agente",
+"label.hosttags.implicit.description": "As tags de host definidas pelo Agente CloudStack",
 "label.hourly": "A cada hora",
 "label.hypervisor": "Virtualizador",
 "label.hypervisor.capabilities": "Recursos do virtualizador",
@@ -803,22 +1153,31 @@
 "label.ikepolicy": "Pol\u00edtica IKE",
 "label.ikeversion": "Vers\u00e3o do IKE",
 "label.images": "Imagens",
+"label.imagestoreid": "Armazenamento Secun\u00e1rio",
 "label.import.backup.offering": "Importar oferta de backup",
 "label.import.instance": "Importar inst\u00e2ncia",
 "label.import.offering": "Importar oferta",
 "label.import.role": "Importar fun\u00e7\u00e3o",
+"label.import.volume": "Importar Volume",
+"label.inactive": "Inativo",
 "label.in.progress": "em progresso",
 "label.in.progress.for": "em progresso para",
 "label.info": "Info",
 "label.info.upper": "INFO",
 "label.infrastructure": "Infraestrutura",
+"label.ingest.instance": "Ingerir Inst\u00e2ncia",
 "label.ingress": "Entrada",
 "label.ingress.rule": "Regra de entrada",
+"label.initial": "Inicial",
+"label.initialized": "Inicializado",
+"label.interface.route.table": "Tabela de Rotas de Interface",
+"label.interface.router.table": "Tabela de Rotas de Interface",
 "label.insideportprofile": "Perfil de porta interna",
 "label.installwizard.addzoneintro.title": "Vamos adicionar uma zona",
 "label.installwizard.subtitle": "Este tour vai auxiliar voc\u00ea na configura\u00e7\u00e3o da sua instala\u00e7\u00e3o do CloudStack&#8482",
 "label.installwizard.title": "Ol\u00e1, seja bem vindo ao CloudStack&#8482",
 "label.instance": "Inst\u00e2ncia",
+"label.instance.conversion.support": "Convers\u00e3o de Inst\u00e2ncia Suportada",
 "label.instance.groups": "Grupos de inst\u00e2ncia",
 "label.instance.name": "Nome da inst\u00e2ncia",
 "label.instancename": "Nome interno",
@@ -834,35 +1193,61 @@
 "label.internallb.name.description": "Nome \u00fanico para o LB interno",
 "label.internallb.sourceip.description": "Descri\u00e7\u00e3o do LB interno",
 "label.internallbvm": "LbVm interno",
+"label.internetprotocol": "Protocolo de internet",
+"label.invalid.number": "N\u00famero inv\u00e1lido",
+"label.iodriverpolicy" : "Pol\u00edtica de driver de IO",
+"label.iodriverpolicy.tooltip" : "A pol\u00edtica de driver de IO pode ser nativa, io_uring ou threads. Escolher a pol\u00edtica de IO para uma Inst\u00e2ncia substituir\u00e1 a op\u00e7\u00e3o do pool de armazenamento 'kvm.storage.pool.io.policy' se definida (apenas se iothreads estiver ativado)",
+"label.iops": "IOPS",
+"label.iothreadsenabled" : "IOThreads",
+"label.iothreadsenabled.tooltip" : "Ativar aloca\u00e7\u00e3o de iothreads para hypervisor KVM",
 "label.interval": "Intervalo de verifica\u00e7\u00e3o (em seg)",
 "label.intervaltype": "Tipo de intervalo",
 "label.introduction.to.cloudstack": "Introdu\u00e7\u00e3o ao CloudStack&#8482",
 "label.invitations": "Convites",
 "label.invite": "Convidar",
 "label.ip": "IP",
+"label.ip.addresses": "Endere\u00e7os IP",
+"label.ip.range.type": "Tipo de intervalo de IP",
 "label.ip.range": "Intervalo de IP",
 "label.ip.ranges": "Intervalos de IP",
+"label.ip.v4": "IPv4",
+"label.ip.v4.v6": "IPv4 + IPv6 (Pilha Dupla)",
+"label.ip.v6": "IPv6",
+"label.ip.v6.firewall": "Firewall IPv6",
 "label.ip4gateway": "Gateway IPV4",
 "label.ip4netmask": "M\u00e1scara de rede IPv4",
+"label.ip4routes": "Rotas IPv6",
+"label.ip4routing": "Roteamento IPv4",
 "label.ip6address": "Endere\u00e7o IPv6",
 "label.ip6cidr": "CIDR IPv6",
 "label.ip6dns1": "IPv6 DNS1",
 "label.ip6dns2": "IPv6 DNS2",
 "label.ip6gateway": "Gateway IPv6",
+"label.ip6firewall": "Firewall IPv6",
+"label.ip6routes": "Rotas IPv6",
+"label.ip6routing": "Roteamento IPv6",
+"label.ipv6.subnets": "Sub-redes IPv6",
 "label.ipaddress": "Endere\u00e7o IP",
 "label.iplimit": "Limites de IP p\u00fablico",
+"label.ipprefix": "Prefixo IP",
+"label.ipprefixlen": "Comprimento do Prefixo IP",
 "label.ips": "IPs",
 "label.ipsecpsk": "Chave IPSec pr\u00e9 compartilhada",
 "label.iptotal": "Total de endere\u00e7os IPs",
 "label.ipv4.cidr": "CIDR IPv4",
 "label.ipv4.dns1": "IPv4 DNS1",
 "label.ipv4.dns2": "IPv4 DNS2",
+"label.ipv4.subnet.set.reservation.desc": "(opcional) Por favor, especifique um dom\u00ednio ou uma Conta para ser associada a esta sub-rede IPv4",
+"label.ipv4.subnets": "Sub-redes IPv4",
 "label.ipv6.dns1": "IPv6 DNS1",
 "label.ipv6.dns2": "IPv6 DNS2",
 "label.iqn": "Alvo IQN",
+"label.is.base64.encoded": "Codificado em Base64",
 "label.is.in.progress": "est\u00e1 em progresso",
 "label.is.shared": "\u00c9 compartilhado",
+"label.is2faenabled": "2FA est\u00e1 ativado",
 "label.isadvanced": "Mostra ajustes avan\u00e7ados",
+"label.isallocated": "Alocado",
 "label.iscsi": "iSCSI",
 "label.iscustomized": "Tamanho customizado",
 "label.iscustomizeddiskiops": "IOPS personalizado",
@@ -870,6 +1255,8 @@
 "label.isdedicated": "Dedicado",
 "label.isdefault": "\u00c9\u0089 padr\u00e3o",
 "label.isdynamicallyscalable": "Dinamicamente escal\u00e1vel",
+"label.isencrypted": "Criptografado",
+"label.isuserdefined": "Definido pelo us\u00e1rio",
 "label.istagarule": "Tag como regra JS",
 "label.isextractable": "Extra\u00edvel",
 "label.isfeatured": "Em destaque",
@@ -903,14 +1290,20 @@
 "label.items": "itens",
 "label.items.selected": "item(ns) selecionados",
 "label.japanese.keyboard": "Teclado japon\u00eas",
+"label.javadistribution": "Distribui\u00e7\u00e3o Java Runtime",
+"label.javaversion": "Vers\u00e3o Java Runtime",
+"label.jsonconfiguration": "Configura\u00e7\u00e3o JSON",
 "label.keep": "Manter",
+"label.kernelversion": "Vers\u00e3o do Kernel",
 "label.keep.mac.address.on.public.nic": "Utilizar o mesmo endere\u00e7o MAC para a NIC p\u00fablica dos VRs",
 "label.key": "Chave",
 "label.keyboard": "Linguagem do teclado",
 "label.keyboardtype": "Tipo de teclado",
 "label.keypair": "Par de chaves SSH",
+"label.keypairs": "Par(es) de chaves SSH",
 "label.kubeconfig.cluster": "Configura\u00e7\u00e3o do cluster Kubernetes",
 "label.kubernetes": "Kubernetes",
+"label.kubernetes.access.details": "Os n\u00f3s Kubernetes podem ser acessados via SSH usando: <br> <code><b> ssh -i [ssh_key] -p [port_number] cloud@[public_ip_address] </b></code> <br><br> onde, <br> <code><b>ssh_key:</b></code> aponta para o arquivo de chave privada SSH correspondente \u00e0 chave que foi associada durante a cria\u00e7\u00e3o do cluster Kubernetes. Se nenhuma chave SSH foi fornecida durante a cria\u00e7\u00e3o do cluster, use a chave privada SSH do Management Server. <br> <code><b>port_number:</b></code> pode ser obtido na Aba de Encaminhamento de Porta (coluna Porta P\u00fablica)",
 "label.kubernetes.cluster": "Cluster Kubernetes",
 "label.kubernetes.cluster.create": "Criar cluster Kubernetes",
 "label.kubernetes.cluster.delete": "Remover cluster Kubernetes",
@@ -919,6 +1312,8 @@
 "label.kubernetes.cluster.stop": "Parar cluster Kubernetes",
 "label.kubernetes.cluster.upgrade": "Atualizar cluster Kubernetes",
 "label.kubernetes.dashboard": "Dashboard da UI do Kubernetes",
+"label.kubernetes.dashboard.create.token": "Criar token para dashboard Kubernetes",
+"label.kubernetes.dashboard.create.token.desc": "Desde o Kubernetes v1.24.0, n\u00e3o h\u00e1 gera\u00e7\u00e3o autom\u00e1tica de token de conta de servi\u00e7o baseado em segredo por motivo de seguran\u00e7a. Voc\u00ea precisa criar uma conta de servi\u00e7o e um Token Bearer opcional de longa dura\u00e7\u00e3o para a conta de servi\u00e7o",
 "label.kubernetes.isos": "ISOs Kubernetes",
 "label.kubernetes.service": "Servi\u00e7o Kubernetes",
 "label.kubernetes.version.add": "Adicionar vers\u00e3o do Kubernetes",
@@ -926,6 +1321,7 @@
 "label.kubernetes.version.update": "Gerenciar vers\u00e3o do Kubernetes",
 "label.kubernetesversionid": "Vers\u00e3o do Kubernetes",
 "label.kubernetesversionname": "Vers\u00e3o do Kubernetes",
+"label.kvm": "KVM",
 "label.kvmnetworklabel": "Etiqueta de tr\u00e1fego KVM",
 "label.l2": "L2",
 "label.l2gatewayserviceuuid": "UUID do servi\u00e7o de gateway L2",
@@ -933,11 +1329,18 @@
 "label.label": "Etiqueta",
 "label.last.updated": "\u00daltima atualiza\u00e7\u00e3o",
 "label.lastannotated": "Data da \u00faltima anota\u00e7\u00e3o",
+"label.lastboottime": "Hora de inicializa\u00e7\u00e3o da m\u00e1quina do Management Server",
+"label.lastheartbeat": "\u00daltimo heartbeat",
 "label.lastname": "Sobrenome",
 "label.lastname.lower": "sobrenome",
+"label.lastserverstart": "\u00daltima vez que o Management Server foi inicializado",
+"label.lastserverstop": "Hora da \u00faltima parada para este Management Server",
+"label.lastsuccessfuljob": "\u00daltimo job bem-sucedido",
 "label.launch": "Executar",
 "label.launch.vm": "Executar VM",
 "label.launch.vm.and.stay": "Iniciar VM e permanecer na p\u00e1gina",
+"label.launch.vnf.appliance": "Lan\u00e7ar appliance VNF",
+"label.launch.vnf.appliance.and.stay": "Lan\u00e7ar appliance VNF & permanecer nesta p\u00e1gina",
 "label.launch.zone": "Executar zona.",
 "label.lb.algorithm.leastconn": "Conex\u00f5es m\u00ednimas",
 "label.lb.algorithm.roundrobin": "Round-robin",
@@ -948,6 +1351,8 @@
 "label.lbdevicededicated": "Dedicado",
 "label.lbdeviceid": "ID",
 "label.lbdevicestate": "Estado",
+"label.lbprovider": "Provedor de balanceador de carga",
+"label.lbruleid": "ID do Balanceador de carga",
 "label.lbtype": "Tipo de balanceamento de carga",
 "label.ldap.configuration": "Configura\u00e7\u00e3o do LDAP",
 "label.ldap.group.name": "Grupo LDAP",
@@ -956,6 +1361,8 @@
 "label.limit": "Limitar",
 "label.limitcpuuse": "Limite da CPU",
 "label.limits": "Configurar limites",
+"label.limits.configure": "Configurar limites",
+"label.link": "Link",
 "label.link.domain.to.ldap": "Link dom\u00ednio para LDAP",
 "label.linklocalip": "Endere\u00e7o IP do Control",
 "label.linux": "Linux",
@@ -964,6 +1371,8 @@
 "label.list.nodes": "Listar nodos",
 "label.list.pods": "Listar pods",
 "label.list.services": "Listar servi\u00e7os",
+"label.list.vmware.vcenter.vms": "Listar Inst\u00e2ncias VMware",
+"label.livepatch": "Aplicar patch ao vivo no(s) roteador(es) da Rede",
 "label.load.balancer": "Balanceador de carga",
 "label.loadbalancerinstance": "VMs designadas",
 "label.loadbalancerrule": "Regra de balanceamento de carga",
@@ -975,18 +1384,23 @@
 "label.local.storage.enabled.system.vms": "Habilitar armazenamento local para VMs de sistema",
 "label.localstorageenabled": "Habilitar armazenamento local para VMs de usu\u00e1rios",
 "label.localstorageenabledforsystemvm": "Habilitar armazenamento local para VMs de sistema",
+"label.locked": "Bloqueado",
 "label.login": "Entrar",
+"label.loginfo": "Informa\u00e7\u00e3o do arquivo de log",
 "label.login.portal": "Entrar no portal",
 "label.login.single.signon": "Single Sign-On",
 "label.logout": "Sair",
 "label.lun": "LUN",
 "label.lun.number": "LUN #",
+"label.lxc": "LXC",
 "label.lxcnetworklabel": "R\u00f3tulo de tr\u00e1fego LXC",
 "label.macaddress": "Endere\u00e7o MAC",
 "label.macaddress.example": "O endere\u00e7o MAC. Exemplo: 01:23:45:67:89:ab",
 "label.macaddresschanges": "Mudan\u00e7as no endere\u00e7o MAC",
 "label.maclearning": "MAC learning",
 "label.macos": "MacOS",
+"label.maintenance": "Manuten\u00e7\u00e3o",
+"label.majorsequence": "Sequ\u00eancia Maior",
 "label.make": "Tornar",
 "label.make.project.owner": "Criar propriet\u00e1rio de conta de projeto",
 "label.make.user.project.owner": "Tornar usu\u00e1rio dono do projeto",
@@ -994,16 +1408,28 @@
 "label.manage": "Gerenciar",
 "label.manage.vpn.user": "Gerenciar usu\u00e1rios da VPN",
 "label.managed.instances": "Inst\u00e2ncias gerenciadas",
+"label.managed.volumes": "Volumes Gerenciados",
+"label.managementserverid": "Management Server",
+"label.managementservername": "Management Server",
 "label.managedstate": "Estados gerenciados",
 "label.management": "Gerenciamento",
 "label.management.ips": "Gerenciamento de endere\u00e7os IP",
-"label.management.server": "Servidor de gerenciamento",
+"label.management.server": "Management Server",
 "label.management.servers": "Servidores de ger\u00eancia",
 "label.managementservers": "N\u00famero de servidores de ger\u00eancia",
+"label.matchall": "Corresponder a todos",
+"label.max": "M\u00e1x.",
+"label.max.migrations": "M\u00e1x. de migra\u00e7\u00f5es",
+"label.maxbackup": "M\u00e1x. de Backups",
+"label.maxbackupstorage": "M\u00e1x. de Armazenamento de Backup (GiB)",
+"label.maxbackups.to.retain": "M\u00e1x. de Backups para manter",
+"label.maxbucket": "M\u00e1x. de Buckets",
+"label.maxmembers": "M\u00e1x de membros",
+"label.maxbackups": "Backups M\u00e1x.",
 "label.max.primary.storage": "M\u00e1x. de armazenamento prim\u00e1rio (GiB)",
 "label.max.secondary.storage": "M\u00e1x. de armazenamento secund\u00e1rio (GiB)",
-"label.maxcpu": "N\u00famerom\u00e1ximo de cores de CPU",
-"label.maxcpunumber": "N\u00famerom\u00e1ximo de cores de CPU",
+"label.maxcpu": "N\u00famero m\u00e1ximo de cores de CPU",
+"label.maxcpunumber": "N\u00famero m\u00e1ximo de n\u00facleos  de CPU",
 "label.maxdatavolumeslimit": "Limite m\u00e1ximo de volume de dados",
 "label.maxerrorretry": "Limite de tentativas de recupera\u00e7\u00e3o de erro",
 "label.maxguestslimit": "Limite m\u00e1x. de guest",
@@ -1011,8 +1437,9 @@
 "label.maximum": "M\u00e1ximo",
 "label.maxinstance": "Inst\u00e2ncias m\u00e1x",
 "label.maxiops": "M\u00e1x IOPS",
-"label.maxmemory": "M\u00e1x. de mem\u00f3ria (MiB)",
+"label.maxmemory": "M\u00e1ximo de mem\u00f3ria (MiB)",
 "label.maxnetwork": "M\u00e1x. de redes",
+"label.maxobjectstorage": "M\u00e1x. de Object Storage (GiB)",
 "label.maxprimarystorage": "M\u00e1x. armazenamento prim\u00e1rio (GiB)",
 "label.maxproject": "Projetos m\u00e1x.",
 "label.maxpublicip": "M\u00e1x. IPs P\u00fablicos",
@@ -1027,6 +1454,7 @@
 "label.mb.memory": "MB de mem\u00f3ria",
 "label.memory": "Mem\u00f3ria (em MB)",
 "label.memory.free": "Mem\u00f3ria livre",
+"label.memory.maximum.mb": "Mem\u00f3ria m\u00e1x (em MB)",
 "label.memory.total": "Mem\u00f3ria total",
 "label.memory.usage.info": "Informa\u00e7\u00f5es sobre o uso de mem\u00f3ria",
 "label.memory.used": "Mem\u00f3ria usada",
@@ -1042,6 +1470,16 @@
 "label.memused": "Uso de mem\u00f3ria",
 "label.menu.security.groups": "Grupos de seguran\u00e7a",
 "label.menu.service.offerings": "Oferta de servi\u00e7os",
+"label.metadata": "Metadados",
+"label.metadata.description": "Metadados do Objeto",
+"label.metadata.upload.description": "Definir metadados para o objeto",
+"label.migrate.instance.single.storage": "Migrar todo(s) o(s) volume(s) da Inst\u00e2ncia para um \u00fanico armazenamento prim\u00e1rio",
+"label.migrate.instance.specific.storages": "Migrar volume(s) da Inst\u00e2ncia para armazenamentos prim\u00e1rios espec\u00edficos",
+"label.migrate.with.storage": "Migrar com armazenamento",
+"label.min_balance": "Saldo m\u00edn",
+"label.minimumsemanticversion": "Vers\u00e3o sem\u00e2ntica m\u00ednima",
+"label.minmembers": "M\u00edn membros",
+"label.minorsequence": "Sequ\u00eancia Menor",
 "label.metrics": "M\u00e9tricas",
 "label.migrate.allowed": "Migra\u00e7\u00e3o permitida",
 "label.migrate.data.from.image.store": "Migrar dados para o armazenamento de imagens",
@@ -1054,21 +1492,31 @@
 "label.migrating.data": "Migrando dados",
 "label.min.balance": "Saldo m\u00ednimo",
 "label.min.past.hour": "minutos passados da \u00faltima hora",
-"label.mincpunumber": "N\u00famero m\u00edn de n\u00facleos de CPU",
+"label.mincpunumber": "N\u00famero m\u00ednimo de n\u00facleos de CPU",
 "label.minimum": "M\u00ed\u00adnimo",
 "label.miniops": "M\u00edn IOPS",
 "label.minmaxiops": "M\u00edn IOPS /m\u00e1x IOPS",
-"label.minmemory": "M\u00edn mem\u00f3ria (em MB)",
+"label.minmemory": "M\u00ednimo de mem\u00f3ria (em MB)",
 "label.minsize": "Tamanho m\u00ednimo",
 "label.minute.past.hour": "minuto(s) passado(s) da \u00faltima hora",
+"label.mode": "Modo",
 "label.monday": "Segunda",
 "label.monitor": "Monitor",
+"label.monitor.expected.code": "C\u00f3digo de Status HTTP Esperado",
+"label.monitor.http.method": "M\u00e9todo HTTP",
+"label.monitor.interval": "Intervalo de verifica\u00e7\u00e3o de sa\u00fade (seg)",
+"label.monitor.retry": "Contagem de tentativas antes de marcar como inativo",
+"label.monitor.timeout": "Timeout (seg)",
+"label.monitor.type": "Tipo de Monitor",
+"label.monitor.url": "Caminho da URL",
 "label.monthly": "Mensal",
 "label.more.access.dashboard.ui": "Mais sobre como acessar a UI da Dashboard",
+"label.mount.sharedfs": "Montar Sistema de Arquivos Compartilhado via NFS",
 "label.move.down.row": "Mover uma c\u00e9lula para baixo",
 "label.move.to.bottom": "Mover para baixo",
 "label.move.to.top": "Mover para o topo",
 "label.move.up.row": "Mover uma c\u00e9lula para cima",
+"label.my.isos": "Minhas ISOs",
 "label.my.templates": "Meus templates",
 "label.na": "N/D",
 "label.name": "Nome",
@@ -1090,6 +1538,11 @@
 "label.network.name": "Nome da rede",
 "label.network.offering": "Oferta de rede",
 "label.network.offerings": "Oferta de rede",
+"label.network.permissions": "Permiss\u00f5es de rede",
+"label.network.policy": "Pol\u00edtica de Rede",
+"label.network.restart.required": "Reinicializa\u00e7\u00e3o de rede necess\u00e1ria",
+"label.network.route.table": "Tabela de roteamento de rede",
+"label.network.routing.policy": "Pol\u00edtica de roteamento de rede",
 "label.network.selection": "Sele\u00e7\u00e3o da rede",
 "label.network.service.providers": "Provedores de servi\u00e7os de rede",
 "label.network.usage.info": "Informa\u00e7\u00f5es sobre o uso de rede",
@@ -1099,6 +1552,7 @@
 "label.networkkbsread": "Leitura da rede",
 "label.networkkbswrite": "Escrita da rede",
 "label.networklimit": "Limites de rede",
+"label.networkmode": "Modo de Rede",
 "label.networkname": "Nome da rede",
 "label.networkofferingdisplaytext": "Oferta de rede",
 "label.networkofferingid": "Oferta de rede",
@@ -1110,26 +1564,35 @@
 "label.networktype": "Tipo de rede",
 "label.networkwrite": "Escrita da rede",
 "label.new": "Novo",
+"label.new.autoscale.vmgroup": "Novo Grupo de AutoScale",
 "label.new.instance.group": "Novo grupo de inst\u00e2ncia",
 "label.new.password": "Nova senha",
 "label.new.project": "Novo projeto",
 "label.new.secondaryip.description": "Insira um novo endere\u00e7o IP secund\u00e1rio",
 "label.new.tag": "Nova etiqueta",
+"label.new.version.available": "Nova vers\u00e3o dispon\u00edvel",
 "label.new.vm": "Nova VM",
 "label.newdiskoffering": "Nova oferta",
 "label.newinstance": "Nova inst\u00e2ncia",
 "label.newname": "Novo nome",
 "label.next": "Pr\u00f3ximo",
 "label.nfs": "NFS",
+"label.nfsmountopts": "Op\u00e7\u00f5es de montagem NFS",
 "label.nfsserver": "Servidor NFS",
 "label.nic": "NIC",
 "label.nicadaptertype": "Tipo de adaptador de rede",
+"label.nicmultiqueuenumber" : "N\u00famero de multiqueues da NIC",
+"label.nicmultiqueuenumber.tooltip" : "N\u00famero de multiqueues da NIC. Apenas suportado para KVM. O valor \"-1\" indica que o n\u00famero de multiqueues da NIC ser\u00e1 definido como o n\u00famero de vCPUs da Inst\u00e2ncia.",
+"label.nicpackedvirtqueuesenabled" : "Virtqueues empacotadas da NIC ativadas",
+"label.nicpackedvirtqueuesenabled.tooltip" : "Ativar ou n\u00e3o virtqueues empacotadas da NIC. Apenas suportado para KVM com QEMU >= 4.2.0 e Libvirt >=6.3.0.",
 "label.nics": "Adaptadores de rede",
 "label.no": "N\u00e3o",
 "label.no.data": "Sem dados para mostrar",
 "label.no.errors": "Sem erros recentes",
 "label.no.items": "Sem itens dispon\u00edveis",
 "label.no.matching.offering": "Nenhuma oferta correspondente encontrada",
+"label.no.matching.network": "Nenhuma Rede correspondente encontrada",
+"label.no.usage.records": "Nenhum registro de uso encontrado",
 "label.noderootdisksize": "Tamanho do disco ra\u00edz do nodo (em GB)",
 "label.nodiskcache": "Sem cache de disco",
 "label.none": "Nenhum",
@@ -1137,14 +1600,38 @@
 "label.not.found": "N\u00e3o encontrado",
 "label.not.suitable": "N\u00e3o apropriado",
 "label.notifications": "Notifica\u00e7\u00f5es",
+"label.nsx": "NSX",
+"label.nsx.provider": "Provedor NSX",
+"label.nsx.provider.edgecluster": "Cluster de borda do provedor NSX",
+"label.nsx.provider.hostname": "Hostname do provedor NSX",
+"label.nsx.provider.name": "Nome do provedor NSX",
+"label.nsx.provider.password": "Senha do provedor NSX",
+"label.nsx.provider.port": "Porta do provedor NSX",
+"label.nsx.provider.tier0gateway": "Gateway tier-0 do provedor NSX",
+"label.nsx.provider.transportzone": "Zona de transporte do provedor NSX",
+"label.nsx.provider.username": "Nome de usu\u00e1rio do provedor NSX",
+"label.nsx.supports.internal.lb": "Ativar servi\u00e7o de LB interno NSX",
+"label.nsx.supports.lb": "Ativar servi\u00e7o de LB NSX",
 "label.num.cpu.cores": "# de n\u00facleos da CPU",
 "label.number": "#Regra",
 "label.numretries": "N\u00famero de tentativas",
 "label.nvpdeviceid": "ID",
+"label.oauth.configuration": "Configura\u00e7\u00e3o OAuth",
+"label.oauth.verification": "Verifica\u00e7\u00e3o OAuth",
+"label.object.storage" : "Armazenamento de Objetos (Object Storage)",
+"label.object.presigned.url": "URL pr\u00e9-assinada",
+"label.object.presigned.url.description" : "URL pr\u00e9-assinada do objeto para acess\u00e1-lo sem autentica\u00e7\u00e3o.",
+"label.object.url.description" : "URL do objeto",
+"label.objectlocking": "Bloqueio de Objeto",
+"label.objectstoragelimit": "Limite de Armazenamento de Objetos (GiB)",
+"label.objectstore" : "Armazenamento de Objetos",
+"label.objectstore.search" : "Busca baseada em prefixo no diret\u00f3rio atual",
+"label.objectstorageid": "Pool de Armazenamento de Objetos",
 "label.ocfs2": "OCFS2",
 "label.of": "de(a)",
 "label.of.month": "do m\u00eas",
 "label.offerha": "Oferta HA",
+"label.offeringid": "ID da Oferta",
 "label.offeringtype": "Tipo da oferta de computa\u00e7\u00e3o",
 "label.ok": "OK",
 "label.only.end.date.and.time": "Apenas data e hor\u00e1rio final",
@@ -1156,9 +1643,20 @@
 "label.opendaylight.controllers": "Controladores OpenDaylight",
 "label.operation": "Opera\u00e7\u00e3o",
 "label.operation.status": "Estado da opera\u00e7\u00e3o",
+"label.operator.greater": "Maior que",
+"label.operator.greater.or.equal": "Maior ou igual a",
+"label.operator.less": "Menor que",
+"label.operator.less.or.equal": "Menor ou igual a",
+"label.operator.equal": "Igual a",
 "label.optional": "Opcional",
 "label.order": "Ordenar",
 "label.oscategoryid": "Prefer\u00eancia de SO",
+"label.oscategoryname": "Nome da categoria do SO",
+"label.osdisplayname": "Nome do SO",
+"label.osdistribution": "Distribui\u00e7\u00e3o do SO",
+"label.osmappingcheckenabled": "Verificar nome do SO com hypervisor",
+"label.osname": "Nome do SO",
+"label.osnameforhypervisor": "Nome de mapeamento do hypervisor",
 "label.ostypeid": "Tipo de SO",
 "label.ostypename": "Tipo de SO",
 "label.other": "Outro",
@@ -1172,9 +1670,11 @@
 "label.override.guest.traffic": "Sobrescrever tr\u00e1fego guest",
 "label.override.public.traffic": "Sobrescrever tr\u00e1fego p\u00fablico",
 "label.override.rootdisk.size": "Sobrescrever tamanho do disco ra\u00edz",
+"label.override.root.diskoffering": "Substituir oferta de disco root",
 "label.overrideguesttraffic": "Sobrescrever tr\u00e1fego guest",
 "label.overridepublictraffic": "Sobrescrever tr\u00e1fego p\u00fablico",
 "label.ovf.properties": "Propriedades vApp",
+"label.ovm3": "OVM3",
 "label.ovm3cluster": "Clustering nativo",
 "label.ovm3networklabel": "Label de trafego OVM3",
 "label.ovm3pool": "Pooling nativo",
@@ -1188,27 +1688,36 @@
 "label.page": "p\u00e1gina",
 "label.palo.alto.firewall": "Firewall Palo Alto",
 "label.palp": "Perfil de log Palo Alto",
+"label.param.name": "Nome do par\u00e2metro",
+"label.param.value": "Valor do par\u00e2metro",
 "label.params": "Par\u00e2metros",
 "label.parentdomainname": "Dom\u00ednio pai",
 "label.parentname": "Pai",
+"label.parentsubnet": "Sub-rede Pai",
 "label.passive": "Passivo",
 "label.password": "Senha",
+"label.password.default": "Senha Padr\u00e3o",
 "label.password.reset.confirm": "A senha foi recuperada para",
+"label.password.tooltip": "A senha para o Host",
 "label.passwordenabled": "Habilitar troca de senha",
 "label.path": "Caminho (Path)",
 "label.patp": "Perfil de amea\u00e7a Palo Alto",
 "label.pavr": "Roteador virtual",
 "label.payload": "Payload",
+"label.payloadurl": "URL de Payload",
 "label.pcidevice": "GPU",
+"label.pending.jobs": "Jobs pendentes",
 "label.per.account": "Por conta",
 "label.per.zone": "Por zona",
 "label.percentage": "Porcentagem",
+"label.performfreshchecks": "Executar novas verifica\u00e7\u00f5es",
 "label.perfectforwardsecrecy": "Perfect Forward secrecy",
 "label.perform.fresh.checks": "Realizar novas verifica\u00e7\u00f5es",
 "label.permission": "Permiss\u00e3o",
 "label.permissions": "permiss\u00e3o",
 "label.physical.network": "Rede f\u00edsica",
 "label.physicalnetworkid": "Rede f\u00edsica",
+"label.physicalnetworkname": "Nome da Rede F\u00edsica",
 "label.physicalsize": "Tamanho f\u00edsico",
 "label.ping.path": "Caminho do ping",
 "label.pkcs.private.certificate": "Certificado privado PKCS#8",
@@ -1222,6 +1731,8 @@
 "label.podid": "Pod",
 "label.podname": "Nome do pod",
 "label.pods": "Pods",
+"label.policy": "Pol\u00edtica",
+"label.policyuuid": "Pol\u00edtica de Rede",
 "label.port": "Porta",
 "label.port.range": "Intervalo de porta",
 "label.portforwarding": "Encaminhamento de porta",
@@ -1232,20 +1743,30 @@
 "label.powerflex.storage.pool": "Pool de armazenamento",
 "label.powerstate": "Estado de energia",
 "label.preferred": "Preferido",
+"label.prefix": "Prefixo",
+"label.prefix.type": "Tipo de Prefixo",
+"label.prepare.for.shutdown": "Preparar para Desligamento",
+"label.prepareformaintenance": "Preparar para Manuten\u00e7\u00e3o",
 "label.presetup": "PreSetup",
 "label.prev": "Anterior",
 "label.previous": "Anterior",
+"label.primera.url.tooltip": "URL designando o endpoint do array de armazenamento Primera, formatado como: http[s]://HOSTNAME:PORT?cpg=NAME&hostset=NAME[&skipTlsValidation=true][&snapCPG=NAME][&taskWaitTimeoutMs=#][&keyttl=#][&connectTimeoutMs=#] onde valores em [] s\u00e3o opcionais.",
+"label.primera.username.tooltip": "O nome de usu\u00e1rio com privil\u00e9gios de edi\u00e7\u00e3o",
+"label.flashArray.username.tooltip": "O nome de us\u00e1rio com privil\u00e9gios de edi\u00e7\u00e3o",
+"label.flashArray.url.tooltip": "URL designando o endpoint Flash Array, formatado como: http[s]://HOSTNAME:PORT?pod=NAME&hostgroup=NAME[&skipTlsValidation=true][&postCopyWaitMs=#][&keyttl=#][&connectTimeoutMs=#][&apiLoginVersion=#][&apiVersion=#] onde valores em [] s\u00e3o opcionais.",
 "label.primary": "Prim\u00e1rio",
 "label.primary.storage": "Armazenamento prim\u00e1rio",
 "label.primary.storage.allocated": "Armazenamento prim\u00e1rio alocado",
 "label.primary.storage.used": "Uso do armazenamento prim\u00e1rio",
 "label.primarystoragelimit": "Limites do armazenamento prim\u00e1rio (GiB)",
+"label.primarystoragetotal": "Armazenamento prim\u00e1rio",
 "label.private.gateway": "Gateway privado",
 "label.private.interface": "Interface privada",
 "label.private.registry": "Registro privado",
 "label.privateinterface": "Interface privada",
 "label.privateip": "Endere\u00e7o IP privado",
 "label.privatekey": "Chave privada PKCS#8",
+"label.privatemtu": "MTU da Interface Privada",
 "label.privatenetwork": "Rede privada",
 "label.privateport": "Porta privada",
 "label.profilename": "Perfil",
@@ -1280,15 +1801,22 @@
 "label.public.ips": "IPs P\u00fablicos",
 "label.public.lb": "LB p\u00fablico",
 "label.public.traffic": "Tr\u00e1fego p\u00fablico",
+"label.public.traffic.nsx": "Tr\u00e1fego P\u00fablico NSX",
+"label.publicipid": "ID do endere\u00e7o IP",
+"label.publicmtu": "MTU da Interface P\u00fablica",
 "label.publicinterface": "Interface p\u00fablica",
 "label.publicip": "Endere\u00e7o IP",
 "label.publickey": "Chave p\u00fablica",
 "label.publicnetwork": "Rede p\u00fablica",
 "label.publicport": "Porta p\u00fablica",
+"label.purge.usage.records.error": "Falha ao eliminar registros de uso",
+"label.purge.usage.records.success": "Registros de uso eliminados com sucesso",
+"label.purgeresources": "Limpar Recursos",
 "label.purpose": "Prop\u00f3sito",
 "label.qostype": "Tipo de QoS",
 "label.quickview": "Visualiza\u00e7\u00e3o r\u00e1pida",
 "label.quiescevm": "Quiesce VM",
+"label.quiettime": "Tempo em espera (em seg)",
 "label.quota": "Cota",
 "label.quota.add.credits": "Adicionar cr\u00e9ditos",
 "label.quota.configuration": "Configura\u00e7\u00e3o da cota",
@@ -1301,6 +1829,7 @@
 "label.quota.statement.tariff": "Tarifa",
 "label.quota.summary": "Relat\u00f3rios",
 "label.quotastate": "Estado da cota",
+"label.quota_enforce": "Impor Cota",
 "label.summary": "Sum\u00e1rio",
 "label.quota.tariff": "Tarifa",
 "label.quota.tariff.activationrule": "Regra de ativa\u00e7\u00e3o",
@@ -1310,15 +1839,24 @@
 "label.quota.total": "Total",
 "label.quota.type.name": "Tipo de uso",
 "label.quota.type.unit": "Unidade do uso",
+"label.action.update.object.storage" : "Atualizar Object Storage",
 "label.quota.usage": "Consumo da cota",
 "label.quota.validate.activation.rule": "Validar regra de ativa\u00e7\u00e3o",
 "label.quota.value": "Valor",
 "label.rados.monitor": "Monitor RADOS",
+"label.rados.monitor.description": "O(s) monitor(es) RADOS. Se houver v\u00e1rios monitores, eles s\u00e3o separados por v\u00edrgula. Por exemplo, \"192.168.0.1,192.168.0.2,192.168.0.3\", \"mon1, mon2, mon3\". Endere\u00e7os IPv6 devem incluir colchetes, por exemplo, \"[fc00:1234::1],[fc00:1234::2],[fc00:1234::3]\".",
 "label.rados.pool": "Pool do RADOS",
 "label.rados.secret": "Segredo RADOS",
 "label.rados.user": "Usu\u00e1rio RADOS",
 "label.ram": "RAM",
+"label.range.last.1month": "\u00daltimo 1 m\u00eas",
+"label.range.last.1week": "\u00daltima 1 semana",
+"label.range.last.2week": "\u00daltimas 2 semanas",
+"label.range.last.3month": "\u00daltimos 3 meses",
+"label.range.today": "Hoje",
+"label.range.yesterday": "Ontem",
 "label.raw.data": "Dados Brutos",
+"label.rawusage": "Uso bruto (em horas)",
 "label.rbd": "RDB",
 "label.rbdid": "Usu\u00e1rio Ceph",
 "label.rbdmonitor": "Monitor Ceph",
@@ -1330,8 +1868,14 @@
 "label.readonly": "Apenas leitura",
 "label.reason": "Motivo",
 "label.reboot": "Reiniciar",
+"label.recent.deliveries": "Entregas recentes",
+"label.recover.sharedfs": "Recuperar Sistema de Arquivos Compartilhado",
+"label.recovering": "Recuperando",
 "label.receivedbytes": "Bytes recebidos",
 "label.recover.vm": "Recuperar VM",
+"label.recursivedomains": "Dom\u00ednios recursivos",
+"label.redeliver": "Reentregar",
+"label.redirecturi": "URI de Redirecionamento",
 "label.redirect": "Clique para acessar:",
 "label.redundantrouter": "Roteador Redundante",
 "label.redundantrouterstate": "Estado redundante",
@@ -1339,40 +1883,61 @@
 "label.redundantvpcrouter": "VPC redundante",
 "label.refresh": "Atualizar",
 "label.region": "Regi\u00e3o",
+"label.register.api.key": "Registrar chave de API",
+"label.register.oauth": "Registrar OAuth",
+"label.register.user.data": "Registrar dados de usu\u00e1rio",
 "label.register.template": "Registrar template",
 "label.reinstall.vm": "Reinstalar VM",
 "label.reject": "Rejeitar",
 "label.related": "Relacionado",
+"label.relationaloperator": "Operador",
 "label.release": "Liberar",
 "label.release.account": "Liberar conta",
+"label.release.dedicated.bgp.peer": "Liberar par BGP dedicado",
 "label.release.dedicated.cluster": "Liberar cluster dedicado",
 "label.release.dedicated.host": "Liberar host dedicado",
+"label.release.dedicated.ipv4.subnet": "Liberar sub-rede IPv4 dedicada",
 "label.release.dedicated.pod": "LIberar pod dedicado",
 "label.release.dedicated.zone": "Liberar zona dedicada",
 "label.releasing.ip": "Liberando IP",
+"label.remote.instances": "Inst\u00e2ncias Remotas",
 "label.remove": "Remover",
 "label.remove.annotation": "Remover coment\u00e1rio",
+"label.remove.bgp.peer": "Remover par BGP",
 "label.remove.egress.rule": "Remover regra de sa\u00edda",
+"label.remove.gui.theme": "Remover tema da GUI",
+"label.remove.interface.route.table": "Remover tabela de rotas de interface Tungsten",
 "label.remove.ip.range": "Remover intervalo de IPs",
+"label.remove.ipv4.subnet": "Remover sub-rede IPv4",
 "label.remove.ldap": "Remover LDAP",
+"label.remove.logical.network": "Remover Rede do roteador l\u00f3gico",
+"label.remove.logical.router": "Remover roteador l\u00f3gico",
 "label.remove.network.offering": "Remover oferta de rede",
+"label.remove.network.route.table": "Remover tabela de roteamento de Rede Tungsten Fabric",
 "label.remove.pf": "Remover regra de redirecionamento de porta",
+"label.remove.policy": "Remover pol\u00edtica",
 "label.remove.project.account": "Remover conta de projeto",
 "label.remove.project.role": "Remover fun\u00e7\u00e3o do projeo",
 "label.remove.project.user": "Remover usu\u00e1rio do projeto",
+"label.remove.routing.policy": "Remover pol\u00edtica de roteamento Tungsten-Fabric",
+"label.remove.tungsten.tag": "Remover Tag",
+"label.remove.user.data": "Remover Userdata",
+"label.removed": "Removido",
+"label.removedaccounts": "Contas removidas",
 "label.remove.rule": "Remover regra",
 "label.remove.ssh.key.pair": "Remover par de chaves SSH",
 "label.remove.vm.from.lb": "Remover VM da regra de balanceamento de carga",
 "label.remove.vmware.datacenter": "Remover datacenter VMware",
 "label.remove.vpc": "Remover VPC",
 "label.remove.vpc.offering": "Remover oferta VPC",
-"label.removed": "Removido",
 "label.removing": "Removendo",
 "label.replace.acl": "Substituir ACL",
 "label.report.bug": "Reportar um problema",
+"label.request": "Solicita\u00e7\u00e3o",
 "label.required": "Obrigat\u00f3rio",
 "label.requireshvm": "HVM",
 "label.requiresupgrade": "Requer atualiza\u00e7\u00e3o",
+"label.reserved": "Reservado",
 "label.reserved.system.gateway": "Gateway de sistema reservado",
 "label.reserved.system.ip": "IP de sistema reservado",
 "label.reserved.system.netmask": "M\u00e1scara de rede reservada do sistema",
@@ -1382,8 +1947,11 @@
 "label.reservedsystemnetmask": "M\u00e1scara de rede reservada do sistema",
 "label.reservedsystemstartip": "In\u00edcio dos IPs reservados para o sistema",
 "label.reset": "Reiniciar",
+"label.reset.config.value": "Redefinir para valor padr\u00e3o",
 "label.reset.ssh.key.pair": "Recriar par de chaves SSH",
 "label.reset.to.default": "Reinicializar para o padr\u00e3o",
+"label.reset.userdata.on.autoscale.vm.group": "Redefinir Userdata no Grupo de VMs de AutoScale",
+"label.reset.userdata.on.vm": "Redefinir Userdata na Inst\u00e2ncia",
 "label.reset.vpn.connection": "Reiniciar a conex\u00e3o VPN",
 "label.resource": "Recurso",
 "label.resource.limit.exceeded": "Limite de recurso excedido",
@@ -1392,6 +1960,8 @@
 "label.resourcename": "Nome do recurso",
 "label.resources": "Recursos",
 "label.resourcestate": "Estado do recurso",
+"label.resourcetype": "Tipo de recurso",
+"label.response": "Resposta",
 "label.restart.network": "Reiniciar rede",
 "label.restart.vpc": "Reiniciar a VPC",
 "label.restartrequired": "Reiniciar obrigat\u00f3rio",
@@ -1399,12 +1969,18 @@
 "label.restore.volume.attach": "Restaurar volume e anex\u00e1-lo",
 "label.review": "Revisar",
 "label.role": "Fun\u00e7\u00e3o",
+"label.roleid": "Fun\u00e7\u00e3o",
 "label.rolename": "Fun\u00e7\u00e3o",
 "label.roles": "Fun\u00e7\u00f5es",
 "label.roletype": "Tipo de fun\u00e7\u00e3o",
 "label.rolepermissiontab.searchbar": "Pesquisa de regras",
 "label.root.certificate": "Certificado ra\u00edz",
 "label.root.disk.size": "Tamanho do disco ra\u00edz (GB)",
+"label.rootdiskcontrollertypekvm": "Controladora do disco ROOT",
+"label.rootdisksize": "Tamanho do disco ROOT (GB)",
+"label.routenexthop": "Pr\u00f3ximo salto da rota",
+"label.routenexthoptype": "Tipo do pr\u00f3ximo salto da rota",
+"label.routeprefix": "Prefixo da rota",
 "label.rootdisk": "Disco ra\u00edz",
 "label.rootdiskcontrollertype": "Controlador do disco ra\u00edz",
 "label.router.health.check.last.updated": "\u00daltima atualiza\u00e7\u00e3o",
@@ -1414,6 +1990,12 @@
 "label.routercount": "Total de roteadores virtuais",
 "label.routerip": "Endere\u00e7os IPv4 para o roteador dentro da rede compartilhada",
 "label.routeripv6": "Endere\u00e7os IPv6 para o roteador dentro da rede compartilhada",
+"label.router.source.nat.ip": "IP source NAT do roteador",
+"label.routing.firewall": "Firewall de Roteamento IPv4",
+"label.routing.policy": "Pol\u00edtica de roteamento",
+"label.routing.policy.terms": "Termos da pol\u00edtica de roteamento",
+"label.routing.policy.terms.then": "Termos da pol\u00edtica de roteamento ent\u00e3o",
+"label.routingmode": "Modo de roteamento",
 "label.resourcegroup": "Grupo de recurso",
 "label.rule": "Regra",
 "label.rule.number": "Regra n\u00famero",
@@ -1423,6 +2005,7 @@
 "label.rules.file.to.import": "Arquivo CSV com as defini\u00e7\u00f5es de regras para importar",
 "label.run.proxy.locally": "Rodar o proxy localmente",
 "label.running": "VMs rodando",
+"label.running.vms": "Inst\u00e2ncias em Execu\u00e7\u00e3o",
 "label.s2scustomergatewayid": "ID do gateway do cliente site a site",
 "label.s2svpngatewayid": "ID do gateway da VPN site a site",
 "label.s3.access.key": "Chave de acesso",
@@ -1443,9 +2026,17 @@
 "label.save": "Salvar",
 "label.save.new.rule": "Salvar nova regra",
 "label.scale.vm": "Escalar VM",
+"label.scaledown.policies": "Pol\u00edticas de ScaleDown",
+"label.scaledown.policy": "Pol\u00edtica de ScaleDown",
+"label.scaleup.policies": "Pol\u00edticas de ScaleUp",
+"label.scaleup.policy": "Pol\u00edtica de ScaleUp",
+"label.scaling": "Escalonamento",
+"label.schedule.add": "Adicionar agendamento",
+"label.schedules": "Agendamentos",
 "label.schedule": "Programar",
 "label.scheduled.backups": "Backups programados",
 "label.scope": "Escopo",
+"label.scope.tooltip": "Escopo do Pool de Armazenamento Prim\u00e1rio",
 "label.search": "Pesquisar",
 "label.secondary.isolated.vlan.type.isolated": "Isolada",
 "label.secondary.isolated.vlan.type.promiscuous": "Prom\u00edscuos",
@@ -1454,11 +2045,13 @@
 "label.secondaryips": "IPs secund\u00e1rios",
 "label.secondarystoragelimit": "Limites do armazenamento secund\u00e1rio (GiB)",
 "label.secretkey": "Chave secreta",
+"label.secret.key": "Chave secreta",
 "label.secured": "Protegido",
 "label.security.groups": "Grupos de seguran\u00e7a",
 "label.securitygroup": "Grupo de seguran\u00e7a",
 "label.securitygroupenabled": "Grupo de seguran\u00e7a ativado",
 "label.securitygroups": "Grupos de seguran\u00e7a",
+"label.securitygroupsenabled": "Grupos de seguran\u00e7a ativados",
 "label.see.more.info.cpu.usage": "Ver mais informa\u00e7\u00f5es sobre o uso de CPU",
 "label.see.more.info.memory.usage": "Ver mais informa\u00e7\u00f5es sobre o uso de mem\u00f3ria",
 "label.see.more.info.network.usage": "Ver mais informa\u00e7\u00f5es sobre o uso de rede",
@@ -1466,11 +2059,17 @@
 "label.see.more.info.shown.charts": "Ver mais informa\u00E7\u00F5es sobre os gr\u00E1ficos mostrados",
 "label.select": "Selecionar",
 "label.select-view": "Selecionar visualiza\u00e7\u00e3o",
+"label.select.2fa.provider": "Selecione o provedor",
 "label.select.a.zone": "Selecione uma zona",
 "label.select.deployment.infrastructure": "Selecione uma infraestrutura de implanta\u00e7\u00e3o",
+"label.select.guest.os.type": "Por favor, selecione o tipo de SO convidado",
+"label.select.network": "Selecionar Rede",
 "label.select.period": "Selecionar per\u00edodo",
 "label.select.project": "Selecionar projeto",
 "label.select.projects": "Selecionar projetos",
+"label.select.ps": "Selecionar armazenamento prim\u00e1rio",
+"label.select.root.disk": "Selecione o disco ROOT",
+"label.select.source.vcenter.datacenter": "Selecione o Datacenter VMware vCenter de origem",
 "label.select.tier": "Selecionar camada",
 "label.select.zones": "Selecionar zonas",
 "label.selected.storage": "Armazenamento selecionado",
@@ -1479,10 +2078,12 @@
 "label.semanticversion": "Vers\u00e3o sem\u00e2ntica",
 "label.sent": "Enviado",
 "label.sentbytes": "Bytes enviados",
+"label.sequence": "Sequ\u00eancia",
 "label.server": "Servidor",
 "label.server.certificate": "Certificados do servidor",
 "label.service.connectivity.distributedroutercapabilitycheckbox": "Roteador distribu\u00eddo",
 "label.service.connectivity.regionlevelvpccapabilitycheckbox": "VPC a n\u00edvel de regi\u00e3o",
+"label.service.group": "Grupo de servi\u00e7os",
 "label.service.lb.elasticlbcheckbox": "LB el\u00e1stico",
 "label.service.lb.inlinemodedropdown": "Modo",
 "label.service.lb.lbisolationdropdown": "Isolamento de LB",
@@ -1491,23 +2092,31 @@
 "label.service.offering": "Plano",
 "label.service.staticnat.associatepublicip": "Associa IP p\u00fablico",
 "label.service.staticnat.elasticipcheckbox": "IP el\u00e1stico",
+"label.servicegroupuuid": "Grupo de Servi\u00e7os",
+"label.serviceip": "IP de Servi\u00e7o",
 "label.servicelist": "Servi\u00e7os",
 "label.serviceofferingid": "Oferta de computa\u00e7\u00e3o",
 "label.serviceofferingname": "Oferta de computa\u00e7\u00e3o",
+"label.sessions": "Sess\u00f5es de cliente ativas",
 "label.set.default.nic": "Configurar para NIC padr\u00e3o",
 "label.set.reservation": "Fazer reserva",
+"label.set.reservation.account.desc": "Por favor, especifique uma Conta para ser associada a este intervalo de IP",
 "label.set.reservation.desc": "(opcional) especificar uma conta a ser associada a esta faixa de IP.<br/><br/>VMs de sistema: habilitar a dedica\u00e7\u00e3o da faixa IP p\u00fablica para SSVM e CPVM, campo de conta desativado. Rigor das reservas definido em 'system.vm.public.ip.reservation.mode.strictness'",
+"label.set.reservation.systemvm.desc": "Ativar dedica\u00e7\u00e3o de intervalo de IP p\u00fablico para SSVM e CPVM. Rigor da reserva definido em 'system.vm.public.ip.reservation.mode.strictness'.",
 "label.setting": "Configura\u00e7\u00e3o",
 "label.settings": "Configura\u00e7\u00f5es",
 "label.setup": "Configura\u00e7\u00e3o",
-"label.shared": "Compartilhado",
-"label.sharedexecutable": "Compartilhado",
+"label.shared": "Compartilhado(a)",
+"label.shared.filesystems": "Sistemas de Arquivos Compartilhados",
+"label.sharedexecutable": "Execut\u00e1veis compartilhados ",
 "label.sharedmountpoint": "SharedMountPoint",
 "label.sharedrouterip": "Endere\u00e7os IPv4 para o roteador dentro da rede compartilhada",
 "label.sharedrouteripv6": "Endere\u00e7os IPv6 para o roteador dentro da rede compartilhada",
 "label.sharewith": "Compartilhar com",
+"label.show.usage.records": "Mostrar registros de uso",
 "label.showing": "Exibindo",
 "label.shrinkok": "Encolhimento OK",
+"label.shutdown": "Desligar",
 "label.shutdown.provider": "Desabilitar provider",
 "label.simplified.chinese.keyboard": "Teclado chin\u00eas simplificado",
 "label.site.to.site.vpn": "VPN site a site",
@@ -1525,19 +2134,35 @@
 "label.snapshotlimit": "Limite de snapshots",
 "label.snapshotmemory": "Snapshot da mem\u00f3ria",
 "label.snapshots": "Snapshots",
+"label.snapshottype": "Tipo de Snapshot",
+"label.softwareversion": "Vers\u00e3o do software",
 "label.sockettimeout": "Tempo limite no socket",
+"label.source": "Selecionar Hypervisor de Origem de Importa\u00e7\u00e3o-Exporta\u00e7\u00e3o",
 "label.source.based": "SourceBased",
 "label.sourcecidr": "CIDR de origem",
 "label.sourcecidrlist": "Lista de CIDRs de origem",
+"label.sourcehost": "Host de origem",
 "label.sourceipaddress": "Endere\u00e7o IP de origem",
+"label.sourceipaddressnetworkid": "ID da Rede do endere\u00e7o IP de origem",
 "label.sourcenat": "Source NAT",
+"label.sourcenatipaddress": "Endere\u00e7o IP de NAT de origem",
 "label.sourcenatsupported": "Suporte \u00e0 source NAT",
 "label.sourcenattype": "Tipo de source NAT suportado",
 "label.sourceport": "Porta de origem",
+"label.sourcetype": "Tipo de origem",
+"label.specifyasnumber": "Especificar N\u00famero AS",
 "label.specifyipranges": "Especifique range de IP",
 "label.specifyvlan": "Especificar VLAN",
 "label.splitconnections": "Separar conex\u00f5es",
 "label.sr.name": "Nome da etiqueta SR",
+"label.srcaddressgroupuuid": "Grupo de Endere\u00e7os de Origem",
+"label.srcendport": "Porta Final de Origem",
+"label.srcipprefix": "Endere\u00e7o de Rede de Origem",
+"label.srcipprefixlen": "Comprimento do Prefixo de Origem",
+"label.srcnetwork": "Rede de Origem",
+"label.srcnetworkuuid": "Rede",
+"label.srcstartport": "Porta Inicial de Origem",
+"label.srctaguuid": "Tag de Origem",
 "label.srx": "SRX",
 "label.srx.firewall": "Juniper SRX firewall",
 "label.ssh.key.pairs": "Par de chaves SSH",
@@ -1546,6 +2171,7 @@
 "label.sshkeypairs": "Par de chaves SSH",
 "label.standard.us.keyboard": "Teclado padr\u00e3o (EUA)",
 "label.sslcertificates": "Certificados SSL",
+"label.sslverification": "Verifica\u00e7\u00e3o SSL",
 "label.start": "Iniciar",
 "label.start.date": "Data de in\u00edcio",
 "label.start.date.and.time": "Data e hor\u00e1rio inicial",
@@ -1554,14 +2180,18 @@
 "label.start.reserved.system.ip": "In\u00edcio dos IPs reservados para o sistema",
 "label.start.rolling.maintenance": "Iniciar a manunten\u00e7\u00e3o",
 "label.start.vm": "Iniciar VM",
+"label.startasn": "Iniciar N\u00famero AS",
 "label.startdate": "Por data (in\u00edcio)",
+"label.starting": "Iniciando",
 "label.startip": "IP do in\u00edcio",
 "label.startipv4": "IP inicial IPv4",
 "label.startipv6": "IP inicial IPv6",
 "label.startport": "Porta de in\u00edcio",
 "label.startquota": "Valor",
 "label.state": "Estado",
+"label.static": "Est\u00e1tico",
 "label.static.routes": "Rotas est\u00e1ticas",
+"label.staticnat": "NAT Est\u00e1tico",
 "label.statistics": "Estat\u00edsticas",
 "label.status": "Estado",
 "label.step.1": "Passo 1",
@@ -1584,6 +2214,8 @@
 "label.sticky.tablesize": "Tamanho da tabela",
 "label.stop": "Parar",
 "label.stopped": "VMs paradas",
+"label.stopped.vms": "Inst\u00e2ncias Paradas",
+"label.stopping": "Parando",
 "label.storage": "Armazenamento",
 "label.storage.migration.required": "Migra\u00e7\u00e3o de armazenamento necess\u00e1ria",
 "label.storage.tags": "Tags de armazenamento",
@@ -1592,34 +2224,56 @@
 "label.storagemotionenabled": "Motion do armazenamento habilitado",
 "label.storagepolicy": "Pol\u00edtica de armazenamento",
 "label.storagepool": "Pool de armazenamento",
+"label.storagepool.tooltip": "Pool de Armazenamento de Destino. O volume deve estar localizado neste Pool de Armazenamento",
 "label.storagetags": "Tags de armazenamento",
 "label.storagetype": "Tipo de armazenamento",
 "label.storageip": "Endere\u00e7o IP na rede de armazenamento",
 "label.strict": "Rigoroso",
 "label.subdomainaccess": "acesso ao subdom\u00ednio",
 "label.submit": "Enviar",
+"label.subnet": "Sub-rede",
 "label.succeeded": "Sucedido",
 "label.success": "Sucesso",
+"label.success.migrations": "Migra\u00e7\u00f5es bem-sucedidas",
 "label.success.set": "Definido com sucesso",
 "label.success.updated": "Atualizado com sucesso",
 "label.suitability": "Adequabilidade",
 "label.suitable": "Adequado",
 "label.sunday": "Domingo",
+"label.supported": "Suportado",
 "label.supportedservices": "Servi\u00e7os suportados",
 "label.supportsautoscaling": "Suporte \u00e0 auto-escala",
 "label.supportsha": "Suporte \u00e0 HA",
 "label.supportspublicaccess": "Suporte \u00e0 acesso p\u00fablico",
 "label.supportsstrechedl2subnet": "Suporte \u00e0 Streched L2 Subnet",
+"label.supportsvmautoscaling": "Suporta escalonamento autom\u00e1tico",
 "label.suspend.project": "Suspender projeto",
 "label.switch.type": "Tipo de switch",
 "label.sync.storage": "Sincronizar pool do armazenamento",
+"label.system.ip.pool": "Pool do Sistema",
 "label.system.offering": "Ofertas de sistema",
 "label.system.offerings": "Ofertas de sistema",
 "label.system.service.offering": "Ofertas de servi\u00e7o de sistema",
 "label.system.vm": "VM de sistema",
 "label.system.vms": "VMs de sistema",
+"label.systemcycleusage": "Ciclos de usu\u00e1rio, sistema e ociosidade",
+"label.systemloadaverages": "M\u00e9dias de carga de 1, 5 e 15 minutos",
+"label.systemmemoryfree": "Mem\u00f3ria livre do sistema",
+"label.systemmemorytotal": "Mem\u00f3ria total do sistema",
+"label.systemmemoryused": "Mem\u00f3ria do sistema usada",
+"label.systemmemoryvirtualsize": "Tamanho virtual total do processo",
+"label.systemtotalcpucycles": "Capacidade total da CPU para todos os n\u00facleos em MHz",
+"label.systemvm": "VM de Sistema",
 "label.systemvmtype": "Tipo de VM de sistema",
+"label.tag": "Tag",
 "label.tag.key": "Chave",
+"label.tag.nsx": "nsx",
+"label.tag.systemvm": "systemvm",
+"label.tag.type": "Tipo de Tag",
+"label.tagged.limits": "Limites marcados",
+"label.tagtypeuuid": "Tipo de Tag",
+"label.taguuid": "Tag",
+"label.taken": "Ocupado",
 "label.tag.value": "Valor",
 "label.tagged": "Etiquetado",
 "label.tags": "Etiquetas",
@@ -1639,7 +2293,13 @@
 "label.templatename": "Template",
 "label.templates": "Templates",
 "label.templatesubject": "Assunto",
+"label.templatetag": "Tag",
 "label.templatetype": "Tipo de template",
+"label.templateremoved": "Este template foi removido",
+"label.templateversion": "Vers\u00e3o do template",
+"label.term.type": "Tipo de termo",
+"label.test": "Teste",
+"label.test.webhook.delivery": "Testar Entrega de Webhook",
 "label.tftpdir": "Diret\u00f3rio raiz do TFTP",
 "label.theme.alert": "O painel de configura\u00e7\u00e3o \u00e9 apenas vis\u00edvel no ambiente de desenvolvimento, por favor, salve as configura\u00e7\u00f5es para que as mudan\u00e7as tenham efeito.",
 "label.theme.color": "Cor do tema",
@@ -1649,12 +2309,23 @@
 "label.theme.page.style.setting": "Defini\u00e7\u00e3o do estilo da p\u00e1gina",
 "label.theme.project": "Estilo do projeto",
 "label.theme.project.navigation.setting": "Configura\u00e7\u00e3o de navega\u00e7\u00e3o do projeto",
+"label.threadsblockedcount": "Threads Bloqueadas",
+"label.threadsdeamoncount": "Threads Daemon",
+"label.threadsnewcount": "Novas Threads",
+"label.threadsrunnablecount": "Threads Execut\u00e1veis",
+"label.threadsterminatedcount": "Threads Terminadas",
+"label.threadstotalcount": "Contagem total de Threads",
+"label.threadswaitingcount": "Threads Aguardando",
+"label.threshold.description": "Valor pelo qual o Contador ser\u00e1 avaliado com o Operador selecionado",
+"label.themes": "Temas",
 "label.threshold": "Limiar",
 "label.thursday": "Quinta",
 "label.time": "Tempo",
 "label.timeout": "Timeout",
 "label.timeout.in.second ": " Timeout (segundos)",
 "label.timezone": "Fuso hor\u00e1rio",
+"label.tmppath": "Caminho Temp",
+"label.tmppath.tooltip": "Caminho tempor\u00e1rio para armazenar imagens de disco no Host Externo antes de copiar para o pool de armazenamento de destino. O padr\u00e3o \u00e9 /tmp",
 "label.to": "para",
 "label.token": "Token",
 "label.token.for.dashboard.login": "Token para o login na Dashboard pode ser obtido atrav\u00e9s do seguinte comando",
@@ -1668,34 +2339,82 @@
 "label.traffic.types": "Tipos de tr\u00e1fego",
 "label.traffictype": "Tipo de tr\u00e1fego",
 "label.transportzoneuuid": "UUID da zona de transporte",
+"label.trigger.shutdown": "Acionar Desligamento Seguro",
 "label.try.again": "Tente novamente",
 "label.tuesday": "Ter\u00e7a",
+"label.2FA": "2FA",
+"label.two.factor.authentication": "Autentica\u00e7\u00e3o de Dois Fatores",
+"label.two.factor.authentication.secret.key": "Sua chave secreta de autentica\u00e7\u00e3o de dois fatores",
+"label.two.factor.authentication.static.pin": "Seu PIN est\u00e1tico de autentica\u00e7\u00e3o de dois fatores",
+"label.tungsten.fabric": "Tungsten Fabric",
+"label.tungsten.fabric.provider": "Provedor Tungsten Fabric",
+"label.tungsten.fabric.routing": "Roteamento Tungsten Fabric",
+"label.tungsten.interface.router.table": "Tabela de rotas da interface",
+"label.tungsten.logical.router": "Roteador L\u00f3gico",
+"label.tungsten.network.router.table": "Tabela de rotas da rede",
+"label.tungsten.provider": "Provedor Tungsten",
+"label.tungsten.provider.gateway": "Gateway do provedor Tungsten",
+"label.tungsten.provider.hostname": "Hostname do provedor Tungsten",
+"label.tungsten.provider.introspectport": "Porta de introspec\u00e7\u00e3o do provedor Tungsten",
+"label.tungsten.provider.name": "Nome do provedor Tungsten",
+"label.tungsten.provider.port": "Porta do provedor Tungsten",
+"label.tungsten.provider.vrouterport": "Porta do vrouter do provedor Tungsten",
+"label.tungsten.router.table": "Tabela de Roteador",
+"label.tungsten.routing.polices": "Pol\u00edticas de roteamento",
+"label.tungsten.static.routes": "Rotas Est\u00e1ticas",
+"label.tungstengateway": "Gateway",
+"label.tungsteninterfaceroutetablename": "Nome",
+"label.tungstennetworkroutetablename": "Nome",
+"label.tungstenproviderhostname": "Hostname do provedor",
+"label.tungstenproviderintrospectport": "Porta de introspec\u00e7\u00e3o do provedor",
+"label.tungstenproviderport": "Porta do provedor",
+"label.tungstenprovideruuid": "UUID do Provedor",
+"label.tungstenprovidervrouterport": "Porta do vrouter do provedor",
+"label.tungstenroutingpolicyterm": "Rede",
+"label.tungstenvms": "Inst\u00e2ncias",
 "label.type": "Tipo",
 "label.type.id": "Tipo do ID",
 "label.ucs": "UCS",
 "label.udp": "UDP",
+"label.udp6": "UDPv6",
+"label.uefi.supported": "UEFI suportado",
 "label.uk.keyboard": "Teclado do Reino Unido",
 "label.unauthorized": "N\u00e3o autorizado",
 "label.unavailable": "Indispon\u00edvel",
+"label.undefined": "Indefinido",
 "label.unit": "Unidade",
 "label.unknown": "Desconhecido",
 "label.unlimited": "Ilimitado",
+"label.unmanaged": "N\u00e3o gerenciado",
 "label.unmanage.instance": "N\u00e3o gerenciar inst\u00e2ncia",
+"label.unmanage.volume": "Parar de gerenciar Volume",
 "label.unmanaged.instance": "Inst\u00e2ncia n\u00e3o gerenciada",
 "label.unmanaged.instances": "Inst\u00e2ncias n\u00e3o gerenciadas",
+"label.unmanaged.volumes": "Volumes n\u00e3o gerenciados",
 "label.untagged": "N\u00e3omarcado",
+"label.up": "Cima",
+"label.update.autoscale.vmgroup": "Atualizar Grupo de AutoScale",
+"label.update.bgp.peer": "Atualizar par BGP",
+"label.update.condition": "Atualizar condi\u00e7\u00e3o",
+"label.update.ipv4.subnet": "Atualizar sub-rede IPv4",
 "label.update.instance.group": "Grupo de inst\u00e2ncias de atualiza\u00e7\u00e3o",
 "label.update.ip.range": "Atualizar intervalo IP",
 "label.update.network": "Atualizar rede",
 "label.update.physical.network": "Atualizar rede f\u00edsica",
 "label.update.project.role": "Atualizar fun\u00e7\u00e3o do projeto",
+"label.update.sharedfs": "Atualizar Sistema de Arquivos Compartilhado",
 "label.update.ssl": " atualizar certificado SSL",
 "label.update.to": "atualizado para",
 "label.update.traffic.label": "Atualizar etiquetas de tr\u00e1fego",
 "label.update.vmware.datacenter": "Atualizar VMware datacenter",
+"label.update.webhook": "Atualizar Webhook",
+"label.updateinsequence": "Atualizar em sequ\u00eancia",
 "label.updating": "Atualizando",
 "label.upgrade.router.newer.template": "Atualize roteador para usar template mais novo",
+"label.upgrading": "Atualizando",
 "label.upload": "Enviar",
+"label.upload.description": "Caminho de onde objetos serão enviados",
+"label.upload.path": "Caminho de envio",
 "label.upload.icon": "Carregar \u00cdcone",
 "label.upload.iso.from.local": "Carregar ISO local",
 "label.upload.resource.icon": "Carregar \u00cdcone",
@@ -1704,11 +2423,40 @@
 "label.upload.volume.from.local": "Carregar volume local",
 "label.upload.volume.from.url": "Carregar volume por URL",
 "label.url": "URL",
+"label.usage": "Uso",
+"label.usage.explanation": "Nota: Apenas o Usage Server que possui o job de uso ativo \u00e9 mostrado aqui.",
+"label.usage.records.downloading": "Baixando registros de uso",
+"label.usage.records.fetch.child.domains": "Buscar registros de uso para dom\u00ednios filhos",
+"label.usage.records.generate": "Gerar registros de uso",
+"label.usage.records.generate.after": "Os registros de uso ser\u00e3o criados para o per\u00edodo ap\u00f3s ",
+"label.usage.records.generate.description": "Se o job de uso agendado n\u00e3o foi executado ou falhou, isso gerar\u00e1 registros (apenas se houver registros a serem gerados)",
+"label.usage.records.generated": "Um job foi criado para gerar registros de uso.",
+"label.usage.records.purge": "Expurgar registros de uso",
+"label.usage.records.purge.alert": "Expurgar registros de uso excluir\u00e1 permanentemente os registros do banco de dados. Dependendo dos dados sendo exclu\u00eddos, isso pode aumentar a carga no banco de dados e pode demorar um pouco. Tem certeza de que deseja continuar?",
+"label.usage.records.purge.days": "Expurgar registros com mais de",
+"label.usage.records.purge.days.description": "Expurgar registros com mais de o n\u00famero especificado de dias.",
+"label.usage.records.usagetype.required": "O tipo de uso \u00e9 obrigat\u00f3rio com o ID do recurso",
+"label.usageid": "ID do Recurso",
+"label.usageislocal": "Um Usage Server est\u00e1 instalado localmente",
+"label.usagename": "Tipo de uso",
+"label.usagetypedescription": "Descri\u00e7\u00e3o do uso",
 "label.usageinterface": "Interface de uso",
 "label.usagetype": "Tipo",
 "label.usageunit": "Unidade",
 "label.use.kubectl.access.cluster": "os arquivos <code><b>kubectl</b></code> e <code><b>kubeconfig</b></code> para acessar o cluster",
 "label.use.local.timezone": "Use o fuso hor\u00e1rio local",
+"label.userdata.do.append": "Anexar dados do usu\u00e1rio",
+"label.userdata.do.override": "Substituir dados do usu\u00e1rio",
+"label.userdata.registered": "Dados do usu\u00e1rio armazenados",
+"label.userdata.text": "Entrada manual de dados do usu\u00e1rio",
+"label.userdatadetails": "Detalhes dos dados do usu\u00e1rio",
+"label.userdataid": "ID dos dados do usu\u00e1rio",
+"label.userdataname": "Nome dos dados do usu\u00e1rio",
+"label.userdataparams": "Par\u00e2metros dos dados do usu\u00e1rio",
+"label.userdatapolicy": "Pol\u00edtica de link de dados do usu\u00e1rio",
+"label.userdatapolicy.tooltip": "Os dados do usu\u00e1rio vinculados ao Template podem ser substitu\u00eddos pelos dados do usu\u00e1rio fornecidos durante a implanta\u00e7\u00e3o da Inst\u00e2ncia. Selecione a pol\u00edtica de substitui\u00e7\u00e3o conforme necess\u00e1rio.",
+"label.username.tooltip": "O Nome de Usu\u00e1rio para o Host",
+"label.keep.mac.address.on.public.nic": "Utilizar o mesmo endere\u00e7o MAC para a NIC p\u00fablica dos VRs",
 "label.used": "Utilizado",
 "label.usehttps": "Utilize HTTPS",
 "label.usenewdiskoffering": "Substituir a oferta de disco?",
@@ -1733,7 +2481,9 @@
 "label.vcenterpassword": "Senha vCenter",
 "label.vcenterusername": "Usu\u00e1rio vCenter",
 "label.vcsdeviceid": "ID",
+"label.verify": "Verificar",
 "label.version": "Vers\u00e3o",
+"label.versioning": "Versionamento",
 "label.versions": "Vers\u00f5es",
 "label.vgpu": "VGPU",
 "label.vgputype": "Tipo de vGPU",
@@ -1741,11 +2491,14 @@
 "label.view.all": "Visualizar tudo",
 "label.view.console": "Visualizar console",
 "label.viewing": "Visualizar",
+"label.virtualmachine": "Inst\u00e2ncia",
+"label.virtualmachinecount": "Contagem de Inst\u00e2ncias",
 "label.virtual.machine": "M\u00e1quina virtual",
 "label.virtual.machines": "M\u00e1quinas virtuais",
 "label.virtual.network": "Rede virtual",
 "label.virtual.networking": "Rede virtual",
 "label.virtual.routers": "Roteadores virtuais",
+"label.virtual.routers.system.offering": "Oferta de sistema do roteador virtual",
 "label.virtualmachineid": "ID da VM",
 "label.virtualmachinename": "Nome da VM",
 "label.virtualsize": "Tamanho virtual",
@@ -1767,18 +2520,59 @@
 "label.vmlimit": "Limites de inst\u00e2ncias",
 "label.vmname": "Nome da VM",
 "label.vms": "VMs",
+"label.vmscheduleactions": "A\u00e7\u00f5es",
+"label.vmsnapshotlimit": "Limite de snapshots de VM",
 "label.vmstate": "Estado da VM",
 "label.vmtotal": "VMs totais",
+"label.vmware": "VMware",
 "label.vmware.storage.policy": "Pol\u00edtica de armazenamento do VMWare",
 "label.vmwaredcid": "ID do datacenter VMware",
 "label.vmwaredcname": "Nome do datacenter VMware",
 "label.vmwaredcvcenter": "Vcednter do datacenter VMware",
 "label.vmwarenetworklabel": "Etiqueta de tr\u00e1fego VMware",
-"label.vnf.appliance.add": "Adicionar VNF Appliance",
 "label.vnmc": "VNMC",
+"label.vnf.app.action.destroy": "Destruir appliance VNF",
+"label.vnf.app.action.edit": "Editar appliance VNF",
+"label.vnf.app.action.expunge": "Expurgar appliance VNF",
+"label.vnf.app.action.migrate.to.host": "Migrar appliance VNF para outro host",
+"label.vnf.app.action.migrate.to.ps": "Migrar appliance VNF para outro armazenamento prim\u00e1rio",
+"label.vnf.app.action.reboot": "Reiniciar appliance VNF",
+"label.vnf.app.action.recover": "Recuperar appliance VNF",
+"label.vnf.app.action.reinstall": "Reinstalar appliance VNF",
+"label.vnf.app.action.scale": "Escalonar appliance VNF",
+"label.vnf.app.action.start": "Iniciar appliance VNF",
+"label.vnf.app.action.stop": "Parar appliance VNF",
+"label.vnf.appliance": "Appliance VNF",
+"label.vnf.appliance.add": "Adicionar Appliance VNF",
+"label.vnf.appliance.access.methods": "Informa\u00e7\u00f5es de acesso de gerenciamento para este appliance VNF",
+"label.vnf.appliances": "Appliances VNF",
+"label.vnf.cidr.list": "CIDR a partir do qual o acesso \u00e0 interface de Gerenciamento do appliance VNF deve ser permitido",
+"label.vnf.cidr.list.tooltip": "a lista CIDR para encaminhar tr\u00e1fego para a interface de gerenciamento VNF. M\u00faltiplas entradas devem ser separadas por um \u00fanico caractere de v\u00edrgula (,). O valor padr\u00e3o \u00e9 0.0.0.0/0.",
+"label.vnf.configure.management": "Configurar regras de Firewall e Encaminhamento de Porta para as interfaces de gerenciamento da VNF",
+"label.vnf.configure.management.tooltip": "Verdadeiro por padr\u00e3o, regras de grupo de seguran\u00e7a ou de rede (source nat e regras de firewall) ser\u00e3o configuradas para interfaces de gerenciamento VNF. Falso caso contr\u00e1rio. Saiba quais regras s\u00e3o configuradas em http://docs.cloudstack.apache.org/en/latest/adminguide/networking/vnf_templates_appliances.html#deploying-vnf-appliances",
+"label.vnf.detail.add": "Adicionar detalhe VNF",
+"label.vnf.detail.remove": "Remover detalhe VNF",
+"label.vnf.details": "Detalhes VNF",
+"label.vnf.nics": "NICs VNF",
+"label.vnf.nic.add": "Adicionar NIC VNF",
+"label.vnf.nic.delete": "Excluir NIC VNF",
+"label.vnf.nic.description": "Descri\u00e7\u00e3o da NIC VNF",
+"label.vnf.nic.deviceid": "ID do Dispositivo da NIC VNF. Come\u00e7a com 0. A NIC com deviceid como 0 para o appliance VNF ser\u00e1 a NIC padr\u00e3o.",
+"label.vnf.nic.edit": "Editar NIC VNF",
+"label.vnf.nic.management": "NIC de Gerenciamento",
+"label.vnf.nic.management.description": "Verdadeiro se a NIC VNF for uma interface de gerenciamento. Falso caso contr\u00e1rio",
+"label.vnf.nic.mappings": "Mapeamentos de NIC VNF",
+"label.vnf.nic.name": "Nome da NIC VNF",
+"label.vnf.nic.remove": "Remover NIC VNF",
+"label.vnf.nic.required": "Verdadeiro se a NIC VNF for obrigat\u00f3ria. Caso contr\u00e1rio, opcional",
+"label.vnf.settings": "Configura\u00e7\u00f5es VNF",
+"label.vnf.template.register": "Registrar template VNF",
+"label.vnf.templates": "Templates VNF",
 "label.volgroup": "Grupo de volume",
 "label.volume": "Disco",
 "label.volume.empty": "Nenhum volume de dados anexado a esta VM",
+"label.volume.encryption.support": "Criptografia de Volume Suportada",
+"label.volume.metrics": "M\u00e9tricas de Volume",
 "label.volume.volumefileupload.description": "Clique ou arraste o arquivo para esta \u00e1rea para carreg\u00e1-lo",
 "label.volumechecksum": "MD5 checksum",
 "label.volumechecksum.description": "Utilize o hash que voc\u00ea criou no inicio do procedimento de carregamento de volume",
@@ -1790,15 +2584,18 @@
 "label.volumename": "Nome do disco",
 "label.volumes": "Discos",
 "label.volumetotal": "Disco",
+"label.volumetype": "Tipo de Volume",
 "label.vpc": "VPC",
 "label.vpc.id": "ID da VPC",
 "label.vpc.offerings": "Ofertas VPC",
 "label.vpc.virtual.router": "Roteador virtual VPC",
+"label.vpc.restart.required": "Reinicializa\u00e7\u00e3o de VPC necess\u00e1ria",
 "label.vpcid": "VPC",
 "label.vpclimit": "Limites VPC",
 "label.vpcname": "VPC",
 "label.vpcoffering": "Oferta VPC",
 "label.vpcofferingid": "Oferta VPC",
+"label.vpcs": "VPCs",
 "label.vpn": "VPN",
 "label.vpn.connection": "Conex\u00e3o VPN",
 "label.vpn.gateway": "Gateway de VPN",
@@ -1819,20 +2616,26 @@
 "label.warn": "Avisar",
 "label.warn.upper": "AVISO",
 "label.warning": "Aten\u00e7\u00e3o",
+"label.webhook": "Webhook",
+"label.webhook.deliveries": "Entregas de Webhook",
+"label.webhookname": "Webhook",
+"label.webhooks": "Webhooks",
 "label.wednesday": "Quarta-Feira",
 "label.weekly": "Semanal",
 "label.welcome": "Bem-Vindo",
 "label.what.is.cloudstack": "O que \u00e9 o CloudStack&#8482?",
 "label.windows": "Windows",
 "label.with.snapshotid": "com o ID da snapshot",
-"label.write": "Escreva",
+"label.write": "Escrita",
 "label.writeback": "Write-back",
 "label.writecachetype": "Tipo do cache de escrita",
 "label.writeio": "Escrita (IO)",
 "label.writethrough": "Write-through",
 "label.xennetworklabel": "Etiqueta de tr\u00e1fego XenServer",
+"label.xenserver": "XenServer",
 "label.xenservertoolsversion61plus": "Vers\u00e3o original do XS \u00e9 6.1+",
 "label.yes": "Sim",
+"label.your.autoscale.vmgroup": "Seu grupo de escalonamento autom\u00e1tico",
 "label.yourinstance": "Sua inst\u00e2ncia",
 "label.zone": "Zona",
 "label.zone.dedicated": "Zona dedicada",
@@ -1845,18 +2648,37 @@
 "label.zonenamelabel": "Nome da zona",
 "label.zones": "Zonas",
 "label.zonewizard.traffictype.storage": "Armazenamento: tr\u00e1fego entre servidores de armazenamento prim\u00e1ria e secund\u00e1ria, tais como templates de m\u00e1quinas virtuais e snapshots",
+"label.quotagb": "Cota em GB",
+"label.quotagib": "Cota em GiB",
 "message.acquire.ip.failed": "Falha ao adquirir IP",
+"message.action.about.mandate.and.disable.2FA.user.auth": "A autentica\u00e7\u00e3o de dois fatores \u00e9 obrigat\u00f3ria para o usu\u00e1rio. Se for desativada agora, o usu\u00e1rio precisar\u00e1 configurar a autentica\u00e7\u00e3o de dois fatores novamente no pr\u00f3ximo login. <br><br>Por favor, confirme que voc\u00ea deseja desativ\u00e1-la.",
 "message.action.acquire.ip": "Por favor, confirme que voc\u00ea quer adquirir um novo IP",
 "message.action.cancel.maintenance": "A manuten\u00e7\u00e3o do seu host foi cancelada com sucesso",
 "message.action.cancel.maintenance.mode": "Confirme que voc\u00ea deseja cancelar esta manuten\u00e7\u00e3o",
 "message.action.create.snapshot.from.vmsnapshot": "Por favor, confirme que voc\u00ea quer criar uma snapshot a partir de uma snapshot de VM",
+"message.action.delete.asnrange": "Por favor, confirme a faixa AS que voc\u00ea deseja excluir",
+"message.action.delete.autoscale.vmgroup": "Por favor, confirme que voc\u00ea deseja excluir este grupo de autoescalonamento.",
 "message.action.delete.backup.offering": "Por favor, confirme que voc\u00ea quer remover esta oferta de backup",
+"message.action.delete.backup.repository": "Por favor, confirme que voc\u00ea deseja excluir este reposit\u00f3rio de backup?",
+"message.action.delete.backup.schedule": "Confirme que voc\u00ea deseja remover esse agendamento de backup.",
 "message.action.delete.cluster": "Confirme que voc\u00ea deseja excluir este host",
+"message.action.delete.domain": "Por favor, confirme que voc\u00ea deseja excluir este dom\u00ednio.",
 "message.action.delete.disk.offering": "Confirme que voc\u00ea deseja excluir esta oferta de disco",
+"message.action.delete.external.firewall": "Por favor, confirme que voc\u00ea gostaria de remover este firewall externo. Aviso: Se voc\u00ea planeja adicionar de volta o mesmo firewall externo, deve redefinir os dados de uso no dispositivo.",
+"message.action.delete.external.load.balancer": "Por favor, confirme que voc\u00ea gostaria de remover este balanceador de carga externo. Aviso: Se voc\u00ea planeja adicionar de volta o mesmo balanceador de carga externo, deve redefinir os dados de uso no dispositivo.",
+"message.action.delete.gui.theme": "Por favor, confirme que voc\u00ea deseja excluir este tema da GUI",
+"message.action.delete.guest.os": "Por favor, confirme que voc\u00ea deseja excluir este SO convidado. Entradas definidas pelo sistema n\u00e3o podem ser exclu\u00eddas.",
+"message.action.delete.guest.os.hypervisor.mapping": "Por favor, confirme que voc\u00ea deseja excluir este mapeamento de hypervisor do SO convidado. Entradas definidas pelo sistema n\u00e3o podem ser exclu\u00eddas.",
+"message.action.delete.ingress.rule": "Por favor, confirme que voc\u00ea deseja excluir esta regra de ingresso.",
 "message.action.delete.instance.group": "Por favor, confirme que voc\u00ea quer remover o grupo de inst\u00e2ncia",
+"message.action.delete.interface.static.route": "Por favor, confirme que voc\u00ea deseja remover esta Rota Est\u00e1tica de interface?",
 "message.action.delete.iso": "Confirme que voc\u00ea deseja excluir esta ISO",
+"message.action.delete.ipv4.subnet": "Por favor, confirme que voc\u00ea deseja excluir esta sub-rede IPv4.",
+"message.action.delete.network.static.route": "Por favor, confirme que voc\u00ea deseja remover esta Rota Est\u00e1tica de Rede",
 "message.action.delete.network": "Confirme que voc\u00ea deseja remover esta rede.",
+"message.action.delete.nexusvswitch": "Por favor, confirme que voc\u00ea deseja excluir este nexus 1000v",
 "message.action.delete.node": "Por favor, confirme que voc\u00ea quer remover este nodo.",
+"message.action.delete.oauth.provider": "Por favor, confirme que voc\u00ea deseja excluir o provedor OAuth.",
 "message.action.delete.physical.network": "Por favor confirme que voc\u00ea deseja deletar esta rede f\u00edsica",
 "message.action.delete.pod": "Confirme que voc\u00ea deseja remover este pod.",
 "message.action.delete.secondary.storage": "Confirme que voc\u00ea deseja remover este armazenamento secund\u00e1rio.",
@@ -1865,30 +2687,46 @@
 "message.action.delete.snapshot": "Confirme que voc\u00ea deseja remover esta snapshot.",
 "message.action.delete.system.service.offering": "Por favor confirme que voc\u00ea deseja deletar esta oferta de servi\u00e7o de sistema.",
 "message.action.delete.template": "Confirme que voc\u00ea deseja remover este template.",
+"message.action.delete.theme": "Por favor, confirme que voc\u00ea deseja excluir este tema.",
+"message.action.delete.tungsten.router.table": "Por favor, confirme que voc\u00ea deseja remover a Tabela de Rotas desta Rede?",
 "message.action.delete.volume": "Confirme que voc\u00ea deseja remover este disco.",
 "message.action.delete.vpn.user": "Por favor, confirme que voc\u00ea quer remover o usu\u00e1rio da VPN.",
 "message.action.delete.zone": "Confirme que voc\u00ea deseja remover esta zona.",
 "message.action.destroy.instance": "Por favor, confirme que voc\u00ea deseja excluir esta inst\u00e2ncia.",
 "message.action.destroy.instance.with.backups": "Por favor, confirme que voc\u00ea quer destruir a inst\u00e2ncia. \u00c9 poss\u00edvel que haja backups associados a inst\u00e2ncia no qual n\u00e3o ser\u00e3o removidos.",
+"message.action.destroy.sharedfs": "Por favor, confirme que voc\u00ea deseja destruir este Sistema de Arquivos Compartilhado.<br><b>Cuidado: Isso excluir\u00e1 todos os dados do Sistema de Arquivos Compartilhado tamb\u00e9m.</b>",
 "message.action.destroy.systemvm": "Confirme que voc\u00ea deseja excluir esta VM de sistema.",
 "message.action.destroy.volume": "Por favor, confirme que voc\u00ea quer destruir este volume.",
+"message.action.disable.2FA.user.auth": "Por favor, confirme que voc\u00ea deseja desativar a autentica\u00e7\u00e3o de dois fatores do usu\u00e1rio.",
 "message.action.disable.cluster": "Confirma a desativa\u00e7\u00e3o do cluster.",
+"message.action.disable.disk.offering": "Por favor, confirme que voc\u00ea deseja desativar esta oferta de disco.",
 "message.action.disable.physical.network": "Por favor confirme que voc\u00ea deseja desabilitar esta rede f\u00edsica.",
 "message.action.disable.pod": "Confirma a desativa\u00e7\u00e3o do pod.",
 "message.action.disable.static.nat": "Confirme que voc\u00ea deseja desativar o NAT est\u00e1tico.",
+"message.action.disable.service.offering": "Por favor, confirme que voc\u00ea deseja desativar esta oferta de servi\u00e7o.",
+"message.action.disable.system.service.offering": "Por favor, confirme que voc\u00ea deseja desativar esta oferta de servi\u00e7o do sistema.",
 "message.action.disable.zone": "Confirma a desativa\u00e7\u00e3o da zona.",
 "message.action.download.iso": "Por favor confirme que voc\u00ea deseja baixar esta ISO.",
 "message.action.download.snapshot": "Por favor confirme que voc\u00ea deseja baixar esta snapshot.",
 "message.action.download.template": "Por favor confirme que voc\u00ea deseja baixar este template.",
+"message.action.edit.nfs.mount.options": "Altera\u00e7\u00f5es nas op\u00e7\u00f5es de montagem NFS s\u00f3 ter\u00e3o efeito ao cancelar o modo de manuten\u00e7\u00e3o, o que far\u00e1 com que o pool de armazenamento seja remontado em todos os hosts KVM com as novas op\u00e7\u00f5es de montagem.",
 "message.action.enable.cluster": "Confirma a ativa\u00e7\u00e3o do cluster.",
+"message.action.enable.disk.offering": "Por favor, confirme que voc\u00ea deseja ativar esta oferta de disco.",
+"message.action.enable.service.offering": "Por favor, confirme que voc\u00ea deseja ativar esta oferta de servi\u00e7o.",
+"message.action.enable.system.service.offering": "Por favor, confirme que voc\u00ea deseja ativar esta oferta de servi\u00e7o do sistema.",
 "message.action.enable.physical.network": "Por favor confirme que voc\u00ea deseja habilitar esta rede f\u00edsica.",
 "message.action.enable.pod": "Confirma a ativa\u00e7\u00e3o do pod.",
 "message.action.enable.zone": "Confirma a ativa\u00e7\u00e3o da zona.",
 "message.action.expunge.instance": "Por favor, confirme que voc\u00ea deseja eliminar esta inst\u00e2ncia.",
 "message.action.expunge.instance.with.backups": "Por favor, confirme que voc\u00ea quer eliminar esta inst\u00e2ncia. \u00c9 poss\u00edvel que haja backups associados a inst\u00e2ncia no qual n\u00e3o ser\u00e3o removidos.",
+"message.action.expunge.sharedfs": "Por favor, confirme que voc\u00ea deseja expurgar este Sistema de Arquivos Compartilhado.",
 "message.action.host.enable.maintenance.mode": "Ativar o modo de manuten\u00e7\u00e3o ir\u00e1 causar o live migration de todas as inst\u00e2ncias hospedadas neste host para o pr\u00f3ximo dispon\u00edvel.",
 "message.action.instance.reset.password": "Por favor confirme que voc\u00ea deseja alterar a senha de root para est\u00e1 m\u00e1quina virtual.",
 "message.action.manage.cluster": "Confirma a vincula\u00e7\u00e3o do cluster.",
+"message.action.patch.router": "Por favor, confirme que voc\u00ea deseja aplicar um patch ao vivo no roteador. <br> Esta opera\u00e7\u00e3o \u00e9 equivalente a atualizar os pacotes do roteador e reiniciar a Rede sem limpeza.",
+"message.action.patch.systemvm": "Por favor, confirme que voc\u00ea deseja aplicar um patch na VM de Sistema.",
+"message.action.primary.storage.scope.cluster": "Por favor, confirme que voc\u00ea deseja alterar o escopo de zona para o cluster especificado.<br>Esta opera\u00e7\u00e3o atualizar\u00e1 o banco de dados e desconectar\u00e1 o pool de armazenamento de todos os hosts que estavam conectados anteriormente ao armazenamento prim\u00e1rio e n\u00e3o fazem parte do cluster especificado.",
+"message.action.primary.storage.scope.zone": "Por favor, confirme que voc\u00ea deseja alterar o escopo de cluster para zona.<br>Esta opera\u00e7\u00e3o atualizar\u00e1 o banco de dados e conectar\u00e1 o pool de armazenamento a todos os hosts da zona executando o mesmo hypervisor definido no pool de armazenamento.",
 "message.action.primarystorage.enable.maintenance.mode": "Aviso: colocar o armazenamento prim\u00e1rio em modo de manuten\u00e7\u00e3o ir\u00e1 causar a parada de todas as VMs hospedadas nesta unidade. Deseja continuar?",
 "message.action.quota.tariff.create.error.namerequired": "Por favor, informe o nome da tarifa.",
 "message.action.quota.tariff.create.error.usagetyperequired": "Por favor, selecione o tipo da tarifa.",
@@ -1897,8 +2735,16 @@
 "message.action.reboot.instance": "Por favor, confirme que voc\u00ea deseja reiniciar esta inst\u00e2ncia.",
 "message.action.reboot.router": "Confirme que voc\ufffd deseja reiniciar este roteador.",
 "message.action.reboot.systemvm": "Confirme que voc\u00ea deseja reiniciar esta VM de sistema.",
+"message.action.recover.sharedfs": "Por favor, confirme que voc\u00ea gostaria de recuperar este Sistema de Arquivos Compartilhado.",
 "message.action.recover.volume": "Por favor, confirme que voc\u00ea quer recuperar este volume.",
+"message.action.release.asnumber": "Por favor, confirme que voc\u00ea deseja liberar este N\u00famero AS.",
 "message.action.release.ip": "Confirme que voc\u00ea deseja liberar este IP.",
+"message.action.release.reserved.ip": "Por favor, confirme que voc\u00ea deseja liberar este IP reservado.",
+"message.action.remove.host": "Por favor, confirme que voc\u00ea deseja remover este host.",
+"message.action.remove.logical.router": "Por favor, confirme que voc\u00ea deseja remover o Roteador L\u00f3gico?",
+"message.action.remove.routing.policy": "Por favor, confirme que voc\u00ea deseja remover a Pol\u00edtica de Roteamento desta Rede",
+"message.action.reserve.ip": "Por favor, confirme que voc\u00ea deseja reservar este IP.",
+"message.action.restart.sharedfs": "Por favor, confirme que voc\u00ea deseja reiniciar este Sistema de Arquivos Compartilhado. Isso causar\u00e1 um tempo de inatividade para o usu\u00e1rio.<br>Reiniciar com limpeza reinicializar\u00e1 a Inst\u00e2ncia do Sistema de Arquivos Compartilhado sem afetar o sistema de arquivos instalado.",
 "message.action.revert.snapshot": "Por favor, confirme que voc\u00ea deseja reverter o seu volume desta snapshot.",
 "message.action.router.health.checks": "Resultados das checagens de sa\u00fade ser\u00e3o obtidos do roteador.",
 "message.action.router.health.checks.disabled.warning": "Por favor, habilite as checagens de sa\u00fade do roteador.",
@@ -1909,15 +2755,20 @@
 "message.action.settings.warning.vm.running": "Por favor, pare a VM para acessar as configura\u00e7\u00f5es",
 "message.action.start.instance": "Por favor, confirme que voc\u00ea deseja iniciar esta inst\u00e2ncia.",
 "message.action.start.router": "Confirme que voc\u00ea deseja inciar este roteador.",
+"message.action.start.sharedfs": "Por favor, confirme que voc\u00ea deseja iniciar este Sistema de Arquivos Compartilhado.",
 "message.action.start.systemvm": "Confirme que voc\u00ea deseja iniciar esta VM de sistema.",
 "message.action.stop.instance": "Por favor, confirme que voc\u00ea deseja parar esta inst\u00e2ncia.",
 "message.action.stop.router": "Confirme que voc\ufffd deseja parar este roteador.",
+"message.action.stop.sharedfs": "Por favor, confirme que voc\u00ea deseja parar este Sistema de Arquivos Compartilhado.",
 "message.action.stop.systemvm": "Confirme que voc\u00ea deseja parar esta VM de sistema.",
 "message.action.unmanage.cluster": "Confirma a desvincula\u00e7\u00e3o do cluster.",
 "message.action.unmanage.instance": "Por favor, confirme que voc\u00ea deseja parar de gerenciar a inst\u00e2ncia.",
 "message.action.unmanage.instances": "Por favor, confirme que voc\u00ea deseja parar de gerenciar as inst\u00e2ncias.",
 "message.action.unmanage.virtualmachine": "Por favor, confirme que voc\u00ea deseja parar de gerenciar a VM.",
 "message.action.vmsnapshot.delete": "Por favor, confirme que voc\u00ea deseja excluir esta snapshot de VM.",
+"message.action.unmanage.volume": "Por favor, confirme que voc\u00ea deseja parar de gerenciar o Volume.",
+"message.action.unmanage.volumes": "Por favor, confirme que voc\u00ea deseja parar de gerenciar os Volumes.",
+"message.action.vmsnapshot.disk-only.delete": "Por favor, confirme que voc\u00ea deseja excluir esta snapshot de VM.",
 "message.activate.project": "Voc\u00ea tem certeza que deseja ativar este projeto?",
 "message.add.egress.rule.failed": "Falha ao adicionar uma nova regra de sa\u00edda",
 "message.add.egress.rule.processing": "Adicionando uma nova regra de sa\u00edda...",
@@ -1925,14 +2776,29 @@
 "message.add.firewall": "Adicionar firewall \u00e0\u00a0 zona.",
 "message.add.firewall.rule.failed": "Falha ao adicionar uma nova regra de firewall",
 "message.add.firewall.rule.processing": "Adicionando uma nova regra de firewall...",
+"message.add.firewallrule.failed": "Falha ao adicionar Regra de Firewall",
 "message.add.host": "Especifique os seguintes par\u00e2metros para adicionar um novo host.",
+"message.add.host.sshkey": "AVISO: Para adicionar um host com chave SSH, voc\u00ea deve garantir que o host do seu hypervisor foi configurado corretamente.",
 "message.add.iprange.processing": "Adicionando intervalo IP...",
+"message.add.ipv4.subnet.for.guest.network.failed": "Falha ao adicionar sub-rede IPv4 para rede guest",
+"message.add.ipv4.subnet.for.guest.network.processing": "Adicionando sub-rede IPv4 para rede guest...",
+"message.add.ip.v6.prefix.processing": "Adicionando Prefixo IPv6...",
+"message.add.ip.v6.firewall.rule.failed": "Falha ao adicionar regra de firewall IPv6",
+"message.add.ip.v6.firewall.rule.processing": "Adicionando regra de firewall IPv6...",
+"message.add.ip.v6.firewall.rule.success": "Regra de firewall IPv6 adicionada",
+"message.redeliver.webhook.delivery": "Reentregar esta entrega de Webhook",
+"message.remove.ip.v6.firewall.rule.failed": "Falha ao remover regra de firewall IPv6",
+"message.remove.ip.v6.firewall.rule.processing": "Removendo regra de firewall IPv6...",
+"message.remove.ip.v6.firewall.rule.success": "Regra de firewall IPv6 removida",
+"message.add.nsx.controller": "Adicionar Provedor NSX",
 "message.add.network": "Adicionar uma nova rede para a zona: <b><span id=\"zone_name\"></span></b>",
 "message.add.network.acl.failed": "Falha ao adicionar lista de rede ACL",
 "message.add.network.acl.processing": "Adicionando lista de rede ACL...",
 "message.add.network.failed": "Falha ao adicionar rede",
 "message.add.network.processing": "Adicionando rede...",
 "message.add.new.gateway.to.vpc": "Favor especificar a informa\u00e7\u00e3o para adicionar um novo gateway a esta VPC.",
+"message.add.physical.network.failed": "Falha ao adicionar rede f\u00edsica",
+"message.add.physical.network.processing": "Adicionando uma nova rede f\u00edsica...",
 "message.add.pod": "Adicionar um novo pod para a zona <b><span id=\"add_pod_zone_name\"></span></b>",
 "message.add.pod.during.zone.creation": "Cada zona deve conter um ou mais pods e iremos adicionar o primeiro pod agora. Um pod cont\u00e9m hosts e servidores de armazenamento prim\u00e1rio que ser\u00e3o adicionados em uma etapa posterior. Inicialmente, configure um intervalo de endere\u00e7os IP reservados para o tr\u00e1fego de gerenciamento interno do CloudStack. A faixa de IP reservados devem ser \u00fanicos para cada zona na nuvem.",
 "message.add.port.forward.failed": "Falha ao adicionar nova regra de encaminhamento de porta",
@@ -1941,6 +2807,9 @@
 "message.add.private.gateway.processing": "Adicionando gateway privado...",
 "message.add.resource.description": "Adicionar recursos de infraestrutura",
 "message.add.resource.hint": "Adicionar recursos de infraestrutura - pods, clusters, armazenamentos prim\u00e1rios/secund\u00e1rios.",
+"message.add.routing.firewall.rule.failed": "Falha ao adicionar regra de firewall de Roteamento IPv4",
+"message.add.routing.firewall.rule.processing": "Adicionando regra de firewall de Roteamento IPv4...",
+"message.add.routing.firewall.rule.success": "Regra de firewall de Roteamento IPv4 adicionada",
 "message.add.rule.failed": "Falha ao adicionar nova regra",
 "message.add.rule.processing": "Adicionando nova regra do security-group...",
 "message.add.secondary.ipaddress.processing": "Adicionando endere\u00e7o IP secund\u00e1rio...",
@@ -1949,7 +2818,10 @@
 "message.add.tag.failed": "Falha ao adicionar nova etiqueta",
 "message.add.tag.for.networkacl": "Adicionar etiqueta para rede ACL",
 "message.add.tag.processing": "Adicionando nova etiqueta...",
+"message.add.template": "Por favor, insira os seguintes dados para criar o seu novo Template",
+"message.add.tungsten.routing.policy.available": "A pol\u00edtica de roteamento Tungsten-Fabric est\u00e1 pronta para iniciar. Por favor, prossiga para a pr\u00f3xima etapa.",
 "message.add.user.to.project": "Este formul\u00e1rio permitir\u00e1 adicionar usu\u00e1rios espec\u00edficos de uma conta a um projeto.<br>Al\u00e9m disso, uma fun\u00e7\u00e3o de projeto pode ser adicionada ao usu\u00e1rio/conta para permitir/n\u00e3o permitir o acesso API em n\u00edvel de projeto.<br> Tamb\u00e9m podemos especificar a fun\u00e7\u00e3o com a qual o usu\u00e1rio deve ser adicionado a um projeto - admin/Regular; se n\u00e3o for especificado, o padr\u00e3o \u00e9 'Regular'.",
+"message.add.volume": "Por favor, preencha os seguintes dados para adicionar um novo volume.",
 "message.add.vpn.connection.failed": "Falha ao adicionar conex\u00e3o VPN",
 "message.add.vpn.connection.processing": "Adicionando conex\u00e3o VPN...",
 "message.add.vpn.customer.gateway": "Adicionando o gateway da VPN do cliente",
@@ -1957,11 +2829,14 @@
 "message.add.vpn.gateway": "Favor confirmar que voc\u00ea deseja adicionar um gateway de VPN",
 "message.add.vpn.gateway.failed": "Falha ao adicionar gateway da VPN",
 "message.add.vpn.gateway.processing": "Adicionando gateway da VPN...",
+"message.added.vpc.offering": "Oferta de VPC adicionada",
+"message.adding.firewall.policy": "Adicionando Pol\u00edtica de Firewall",
 "message.adding.host": "Adicionando host",
 "message.adding.netscaler.device": "Adicionando dispositivo Nescaler",
 "message.adding.netscaler.provider": "Adicionando Netscaler provider",
 "message.advanced.security.group": "Escolha esta op\u00e7\u00e3o se desejar utilizar grupos de seguran\u00e7a para isolamento das VMs guest.",
 "message.alert.show.all.stats.data": "Isso pode retornar muitos dados dependendo das configura\u00e7\u00f5es de coleta e reten\u00e7\u00e3o de estat\u00edsticas.",
+"message.allowed": "Permitido",
 "message.apply.success": "Aplicado com sucesso",
 "message.assign.instance.another": "Favor especificar o tipo de conta, dom\u00ednio, nome da conta e rede (opcional) da nova conta. <br> Se o NIC padr\u00e3o da VM estiver em uma rede compartilhada, o CloudStack verificar\u00e1 se a rede pode ser usada pela nova conta se voc\u00ea n\u00e3o especificar uma rede. <br> Se o NIC padr\u00e3o da VM estiver em uma rede isolada, e a nova conta tiver mais uma rede isolada, voc\u00ea deve especificar uma.",
 "message.assign.vm.failed": "Falha na designa\u00e7\u00e3o de VM",
@@ -1969,26 +2844,52 @@
 "message.attach.volume": "Preencha os seguintes dados para conectar o novo disco. Se voc\u00ea est\u00e1 conectando um disco a uma m\u00e1quina virtual Windows, ser\u00e1 necess\u00e1rio reiniciar a inst\u00e2ncia para visualizar o novo disco.",
 "message.attach.volume.failed": "Falha ao anexar volume",
 "message.attach.volume.progress": "Anexando volume",
+"message.attach.volume.success": "Volume anexado com sucesso \u00e0 inst\u00e2ncia",
 "message.authorization.failed": "Sess\u00e3o expirada, a verifica\u00e7\u00e3o de autoriza\u00e7\u00e3o falhou",
+"message.autoscale.loadbalancer.update": "A regra do balanceador de carga s\u00f3 pode ser atualizada quando o grupo de autoescalonamento estiver DESATIVADO.",
+"message.autoscale.policies.update": "As pol\u00edticas de aumento/diminui\u00e7\u00e3o s\u00f3 podem ser atualizadas quando o grupo de autoescalonamento estiver DESATIVADO.",
+"message.autoscale.vm.networks": "Por favor, escolha pelo menos uma Rede para as Inst\u00e2ncias no grupo de autoescalonamento. A Rede padr\u00e3o deve ser uma Rede Isolada ou Camada de Rede VPC que suporte AutoScale de Inst\u00e2ncia e tenha regras de balanceamento de carga.",
+"message.autoscale.vmprofile.update": "O perfil de Inst\u00e2ncia de AutoScale s\u00f3 pode ser atualizado quando o grupo de autoescalonamento estiver DESATIVADO.",
 "message.backup.attach.restore": "Favor confirmar que voc\u00ea deseja restaurar e anexar o volume do backup?",
 "message.backup.create": "Voc\u00ea tem certeza de que quer criar um backup da VM?",
 "message.backup.offering.remove": "Voc\u00ea tem certeza que quer remover a VM da oferta de backup e excluir a cadeia de backup?",
 "message.backup.restore": "Por favor, confirme que voc\u00ea deseja restaurar o backup da VM?",
+"message.bgp.peers.null": "Por favor note, se nenhum par BGP for selecionado, o VR conectar\u00e1 a <br> (1) pares BGP dedicados que o propriet\u00e1rio pode acessar, se o propriet\u00e1rio tiver pares BGP dedicados e a configura\u00e7\u00e3o da conta use.system.bgp.peers estiver definida como false; <br> (2) todos os pares BGP que o propriet\u00e1rio pode acessar, caso contr\u00e1rio.<br>",
+"message.bucket.delete": "Por favor, confirme que voc\u00ea deseja excluir este Bucket",
+"message.cancel.shutdown": "Por favor, confirme que voc\u00ea gostaria de cancelar o desligamento neste Management Server. Ele voltar\u00e1 a aceitar quaisquer novos job Ass\u00edncronos.",
 "message.certificate.upload.processing": "Carregamento de certificados em andamento",
+"message.change.disk.offering.sharedfs.failed": "Falha ao alterar oferta de disco para o Sistema de Arquivos Compartilhado.",
+"message.change.disk.offering.sharedfs.processing": "Alterando oferta de disco para o Sistema de Arquivos Compartilhado.",
 "message.change.offering.confirm": "Por favor, confirme que voc\u00ea deseja mudar a oferta de servi\u00e7o desta inst\u00e2ncia virtual.",
+"message.change.offering.for.volume": "Por favor, confirme que voc\u00ea deseja alterar a oferta de disco para o volume",
+"message.change.offering.for.volume.failed": "Falha ao alterar oferta para o volume",
+"message.change.offering.processing": "Alterando oferta para o volume...",
 "message.change.password": "Por favor, troque sua senha.",
+"message.change.scope.failed": "Falha na altera\u00e7\u00e3o de escopo",
+"message.change.scope.processing": "Altera\u00e7\u00e3o de escopo em andamento",
+"message.change.service.offering.sharedfs.failed": "Falha ao alterar oferta de servi\u00e7o para o Sistema de Arquivos Compartilhado.",
+"message.change.service.offering.sharedfs.processing": "Alterando oferta de servi\u00e7o para o Sistema de Arquivos Compartilhado.",
 "message.cluster.dedicated": "Cluster dedicado",
 "message.cluster.dedication.released": "Cluster dedicado liberado",
+"message.config.health.monitor.failed": "Configura\u00e7\u00e3o do Monitor de Sa\u00fade falhou",
 "message.config.sticky.policy.failed": "Falha na configura\u00e7\u00e3o da pol\u00edtica sticky",
 "message.config.sticky.policy.processing": "Atualizando pol\u00edtica sticky...",
+"message.configure.network.ip.and.mac": "Por favor, configure o endere\u00e7o IP e o endere\u00e7o mac das redes, se necess\u00e1rio.",
+"message.configure.network.select.default.network": "Por favor, configure o endere\u00e7o IP e o endere\u00e7o mac das redes, se necess\u00e1rio. Por favor, selecione uma rede como a rede padr\u00e3o.",
 "message.configuring.guest.traffic": "Configurando tr\u00e1fego do guest",
+"message.configuring.nsx.public.traffic": "Configurando tr\u00e1fego p\u00fablico NSX",
 "message.configuring.physical.networks": "Configurando redes f\u00edsicas",
 "message.configuring.public.traffic": "Configurando tr\u00e1fego p\u00fablico",
 "message.configuring.storage.traffic": "Configurando tr\u00e1fego de storage",
 "message.confirm.action.force.reconnect": "Por favor confirme que voc\u00ea deseja for\u00e7ar a reconex\u00e3o com este host.",
+"message.confirm.add.router.table.to.instance": "Por favor, confirme que voc\u00ea deseja adicionar a Tabela de Rotas a esta NIC",
+"message.confirm.add.routing.policy": "Por favor, confirme que voc\u00ea deseja adicionar a Pol\u00edtica de Roteamento a esta Rede",
 "message.confirm.archive.selected.alerts": "Por favor confirme que voc\u00ea deseja arquivar os alertas selecionados",
 "message.confirm.archive.selected.events": "Por favor confirme que voc\u00ea deseja arquivar os eventos selecionados",
 "message.confirm.attach.disk": "Voc\u00ea tem certeza que deseja conectar este disco?",
+"message.confirm.change.disk.offering.for.sharedfs": "Por favor, confirme que voc\u00ea deseja alterar a oferta de disco para o Sistema de Arquivos Compartilhado. Isso pode migrar o volume subjacente para um pool de armazenamento diferente, se necess\u00e1rio.",
+"message.confirm.change.offering.for.volume": "Por favor, confirme que voc\u00ea deseja alterar a oferta de disco para o volume",
+"message.confirm.change.service.offering.for.sharedfs": "Por favor, confirme que voc\u00ea deseja alterar a oferta de servi\u00e7o para o Sistema de Arquivos Compartilhado.",
 "message.confirm.configure.ovs": "Voc\u00ea tem certeza de que quer configurar os Ovs?",
 "message.confirm.delete.acl": "Voc\u00ea tem certeza que deseja apagar esta lista ACL?",
 "message.confirm.delete.bigswitchbcf": "Por favor, confirme que voc\u00ea deseja deletar este controlador BigSwitch BCF",
@@ -2001,42 +2902,66 @@
 "message.confirm.delete.niciranvp": "Por favor, confirme que voc\u00ea deseja excluir o controlador Nicira Nvp",
 "message.confirm.delete.pa": "Por favor, confirme que voc\u00ea deseja remover Palo Alto",
 "message.confirm.delete.provider": "Por favor, confirme que voc\u00ea deseja excluir este provedor?",
+"message.confirm.delete.traffic.type": "Por favor, confirme que voc\u00ea gostaria de excluir o tipo de tr\u00e1fego.",
 "message.confirm.delete.srx": "Por favor confirme que voc\u00ea deseja remover o SRX",
 "message.confirm.destroy.router": "Por favor confirme que voc\u00ea gostaria de destruir este roteador",
+"message.confirm.disable.autoscale.vmgroup": "Por favor, confirme que voc\u00ea deseja desativar este grupo de autoescalonamento.",
 "message.confirm.disable.host": "Favor confirmar que voc\u00ea deseja desabilitar este host.",
 "message.confirm.disable.network.offering": "Voc\u00ea tem certeza que deseja deshabilitar esta oferta de rede?",
 "message.confirm.disable.provider": "Por favor confirme que voc\u00ea gostaria de desabilitar este provider",
 "message.confirm.disable.storage": "Por favor, confirme que voc\u00ea deseja desabilitar o pool de armazenamento",
 "message.confirm.disable.vpc.offering": "Voc\u00ea tem certeza que deseja desabilitar esta oferta de VPC?",
+"message.confirm.disable.webhook": "Por favor, confirme que voc\u00ea deseja desativar este webhook.",
+"message.confirm.enable.autoscale.vmgroup": "Por favor, confirme que voc\u00ea deseja ativar este grupo de autoescalonamento.",
 "message.confirm.enable.host": "Por favor confirme que voc\u00ea deseja habilitar este host.",
 "message.confirm.enable.network.offering": "Voc\u00ea tem certeza que deseja habilitar esta oferta de rede?",
 "message.confirm.enable.provider": "Por favor confirme que voc\u00ea gostaria de habilitar este provider",
 "message.confirm.enable.storage": "Por favor, confirme que voc\u00ea deseja hablitar o pool de armazenamento",
 "message.confirm.enable.vpc.offering": "Voc\u00ea tem certeza que deseja habilitar esta oferta de VPC?",
+"message.confirm.enable.webhook": "Por favor, confirme que voc\u00ea deseja ativar este webhook.",
+"message.confirm.remove.firewall.rule": "Por favor, confirme que voc\u00ea deseja excluir esta Regra de Firewall?",
 "message.confirm.remove.ip.range": "Por favor confirme que voc\u00ea deseja remover este range de IP.",
 "message.confirm.remove.network.offering": "Voc\u00ea tem certeza que deseja remover esta oferta de rede?",
+"message.confirm.remove.network.policy": "Por favor, confirme que voc\u00ea deseja remover esta Pol\u00edtica de Rede?",
+"message.confirm.remove.routing.policy": "Por favor, confirme que voc\u00ea deseja excluir esta Pol\u00edtica de Roteamento?",
 "message.confirm.remove.selected.alerts": "Por favor confirme que voc\u00ea deseja remover os alertas selecionados",
 "message.confirm.remove.selected.events": "Por favor confirme que voc\u00ea deseja remover os eventos selecionados",
 "message.confirm.remove.vmware.datacenter": "Por favor, confirme que voc\u00ea quer remover este VMware datacenter",
 "message.confirm.remove.vpc.offering": "Voc\u00ea tem certeza que deseja remover esta oferta de VPC?",
 "message.confirm.replace.acl.new.one": "Voc\u00ea deseja substituir a ACL com uma nova?",
+"message.confirm.reset.network.permissions": "Tem certeza de que deseja redefinir as permiss\u00f5es desta Rede?",
 "message.confirm.scale.up.router.vm": "Voc\u00ea realmente quer escalonar a VM do roteador?",
 "message.confirm.scale.up.system.vm": "Voc\u00ea realmente quer escalonar a VM do sistema?",
 "message.confirm.start.lb.vm": "Confirme que voc\u00ea deseja iniciar esta LB VM",
 "message.confirm.sync.storage": "Por favor, confirme que voc\u00ea gostaria de sincronizar o pool de armazenamento",
+"message.confirm.type": "Para confirmar, digite",
 "message.confirm.upgrade.router.newer.template": "Por favor confirme que voc\u00ea deseja atualizar o roteador para usar o template mais recente.",
 "message.cpu.usage.info": "A porcentagem de uso da CPU pode exceder 100% se a VM tiver mais de 1 vCPU ou quando o CPU Cap n\u00E3o estiver habilitado. Este comportamento acontece de acordo com o hypervisor que est\u00E1 sendo utilizado (ex: no KVM), devido \u00E0 forma como contabilizam as estat\u00EDsticas",
+"message.create.backup.failed": "Falha ao criar backup.",
+"message.create.bucket.failed": "Falha ao criar bucket.",
+"message.create.bucket.processing": "Cria\u00e7\u00e3o de bucket em andamento",
 "message.create.compute.offering": "Oferta de computa\u00e7\u00e3o criada",
 "message.create.internallb": "Criando LB interno",
 "message.create.internallb.failed": "Falha ao criar LB interno",
 "message.create.internallb.processing": "Cria\u00e7\u00e3o do LB interno em progresso",
 "message.create.service.offering": "Oferta de servi\u00e7o criada",
+"message.create.sharedfs.failed": "Falha ao criar Sistema de Arquivos Compartilhado.",
+"message.create.sharedfs.processing": "Cria\u00e7\u00e3o de Sistema de Arquivos Compartilhado em andamento.",
 "message.create.snapshot.from.vmsnapshot.failed": "Falha ao criar snapshot a partir de uma snapshot de VM",
 "message.create.snapshot.from.vmsnapshot.progress": "Cria\u00e7\u00e3o de snapshot em progresso",
+"message.create.template.failed": "Falha ao criar template.",
+"message.create.template.processing": "Cria\u00e7\u00e3o de template em andamento",
+"message.create.tungsten.public.network": "Criar Rede p\u00fablica Tungsten-Fabric",
 "message.create.volume.failed": "Falha ao criar volume",
 "message.create.volume.processing": "Cria\u00e7\u00e3o de volume em progresso",
 "message.create.vpc.offering": "Oferta VPC criada",
 "message.create.vpn.customer.gateway.failed": "A cria\u00e7\u00e3o do gateway da VPN do cliente falhou",
+"message.creating.autoscale.scaledown.conditions": "Criando condi\u00e7\u00f5es de ScaleDown",
+"message.creating.autoscale.scaledown.policy": "Criando pol\u00edtica de ScaleDown",
+"message.creating.autoscale.scaleup.conditions": "Criando condi\u00e7\u00f5es de ScaleUp",
+"message.creating.autoscale.scaleup.policy": "Criando pol\u00edtica de ScaleUp",
+"message.creating.autoscale.vmgroup": "Criando Grupo de AutoScale",
+"message.creating.autoscale.vmprofile": "Criando perfil de Inst\u00e2ncia de AutoScale",
 "message.creating.cluster": "Criando cluster",
 "message.creating.guest.network": "Criando rede guest",
 "message.creating.physical.networks": "Criando redes fisicas",
@@ -2059,9 +2984,13 @@
 "message.delete.acl.rule": "Remover regra ACL",
 "message.delete.acl.rule.failed": "Falha ao remover regra ACL",
 "message.delete.affinity.group": "Por favor, confirme que voc\u00ea deseja remover este grupo de afinidade",
+"message.delete.asn.range": "ASN Range exclu\u00eddo com sucesso",
 "message.delete.backup": "Voc\u00ea tem certeza de que quer apagar o backup?",
 "message.delete.failed": "Falha ao remover",
 "message.delete.gateway": "Favor confirmar que voc\u00ea deseja deleta o gateway",
+"message.delete.ip.v6.prefix.processing": "Excluindo prefixo IPv6...",
+"message.delete.keypair": "Favor confirmar que voc\u00ea deseja deletar a chave de API.",
+"message.delete.keypair.failed": "Falha ao deletar par de chave de API",
 "message.delete.port.forward.processing": "Removendo regra de encaminhamento de porta...",
 "message.delete.project": "Voc\u00ea tem certeza que deseja remover este projeto?",
 "message.delete.rule.processing": "Removendo regra...",
@@ -2070,44 +2999,70 @@
 "message.delete.tag.failed": "Falha ao remover etiqueta",
 "message.delete.tag.for.networkacl": "Remover etiqueta para rede ACL",
 "message.delete.tag.processing": "Removendo etiqueta...",
+"message.delete.traffic.type.processing": "Excluindo tipo de tr\u00e1fego...",
+"message.delete.tungsten.policy.rule": "Por favor, confirme que voc\u00ea deseja excluir a Regra de Pol\u00edtica?",
+"message.delete.tungsten.tag": "Tem certeza de que deseja remover esta Tag desta Pol\u00edtica?",
 "message.delete.user": "Por favor confirme que voc\u00ea deseja deletar este usu\u00e1rio.",
 "message.delete.vpn.connection": "Favor confirmar que voc\u00ea deseja deletar esta conex\u00e3o VPN",
 "message.delete.vpn.customer.gateway": "Favor confirmar que voc\u00ea deseja deletar este gateway de VPN de usu\u00e1rio",
 "message.delete.vpn.gateway": "Favor confirmar que voc\u00ea deseja deletar este gateway de VPN",
+"message.delete.webhook": "Por favor, confirme que voc\u00ea deseja excluir este Webhook.",
+"message.delete.webhook.delivery": "Por favor, confirme que voc\u00ea deseja excluir esta entrega de Webhook.",
+"message.deleting.firewall.policy": "Excluindo Pol\u00edtica de Firewall",
 "message.deleting.node": "Removendo nodo",
 "message.deleting.vm": "Removendo VM",
+"message.denied": "Negado",
 "message.deployasis": "O modelo selecionado \u00e9 Deploy As-Is, ou seja, a VM \u00e9 implantada atrav\u00e9s da importa\u00e7\u00e3o de um OVA com vApps diretamente no vCenter. O redimensionamento do(s) disco(s) raiz(s) \u00e9 permitido somente em VMs paradas para tais modelos.",
 "message.desc.advanced.zone": "Para topologias de rede mais sofisticadas. este modelo fornece maior flexibilidade na defini\u00e7\u00e3o de redes de clientes e fornece ofertas de rede personalizadas, tais como firewall, VPN ou de balanceamento de carga.",
 "message.desc.basic.zone": "Fornece uma \u00fanica rede onde em cada inst\u00e2ncia de VM \u00e9 atribu\u00eddo um IP diretamente na rede. O isolamento guest podem ser fornecidos atrav\u00e9s de camada-3 da rede com grupos de seguran\u00e7a (filtragem da fonte de endere\u00e7os IP).",
+"message.desc.core.zone": "Zonas Core destinam-se a implanta\u00e7\u00f5es baseadas em Datacenter e permitem toda a gama de funcionalidades de Rede e outras no Apache CloudStack. Zonas Core t\u00eam uma s\u00e9rie de pr\u00e9-requisitos e dependem da presen\u00e7a de armazenamento compartilhado e inst\u00e2ncias auxiliares.",
 "message.desc.cluster": "Cada pod deve conter um ou mais clusters, e iremos adicionar o primeiro cluster agora. Um cluster fornece uma maneira de agrupamento de hosts. Os hosts de um cluster t\u00eam hardware id\u00eantico, executam o mesmo virtualizador, est\u00e3o na mesma sub-rede e acessam o mesmo armazenamento compartilhado. Cada cluster \u00e9 constitu\u00eddo por um ou mais hosts e um ou mais servidores de armazenamento prim\u00e1rio.",
 "message.desc.create.ssh.key.pair": "Por favor, preencha os seguintes dados para criar ou registar um par de chaves SSH.<br><br>(1) Se a chave p\u00fablica est\u00e1 definida, CloudStack ir\u00e1 registrar a chave p\u00fablica. Voc\u00ea pode us\u00e1-la atrav\u00e9s de sua chave privada.<br><br>(2) Se a chave p\u00fablica n\u00e3o est\u00e1 definida, CloudStack ir\u00e1 criar um novo par de chaves SSH. Neste caso, copie e salve a chave privada. CloudStack n\u00e3o ir\u00e1 mant\u00ea-la.<br>",
 "message.desc.created.ssh.key.pair": "Par de chaves SSH criado",
-"message.desc.host": "Cada cluster deve conter pelo menos um host (computador) para as VMs guest serem executadas e iremos adicionar o primeira host agora. Para um host funcionar no CloudStack, voc\u00ea deve instalar um virtualizador no host, atribuir um endere\u00e7o IP e garantir que o host est\u00e1 conectado ao servidor de gerenciamento do CloudStack.<br/><br/>Forne\u00e7a o hostname ou o endere\u00e7o IP do host, o nome de usu\u00e1rio (geralmente root) e a senha e qualquer label que voc\u00ea utiliza para categorizar os hosts.",
+"message.desc.edge.zone": "Zonas Edge s\u00e3o zonas leves, projetadas para implanta\u00e7\u00e3o em cen\u00e1rios de computa\u00e7\u00e3o de borda. Elas s\u00e3o limitadas em funcionalidade, mas t\u00eam muito menos pr\u00e9-requisitos do que zonas core.<br><br>Por favor, consulte a documenta\u00e7\u00e3o do Apache CloudStack para mais informa\u00e7\u00f5es sobre Tipos de Zona<br><a href='http://docs.cloudstack.apache.org/en/latest/installguide/configuration.html#adding-a-zone'>http://docs.cloudstack.apache.org/en/latest/installguide/configuration.html#adding-a-zone</a>",
+"message.desc.host": "Cada cluster deve conter pelo menos um host (computador) para as VMs guest serem executadas e iremos adicionar o primeira host agora. Para um host funcionar no CloudStack, voc\u00ea deve instalar um virtualizador no host, atribuir um endere\u00e7o IP e garantir que o host est\u00e1 conectado ao Management Server do CloudStack.<br/><br/>Forne\u00e7a o hostname ou o endere\u00e7o IP do host, o nome de usu\u00e1rio (geralmente root) e a senha e qualquer label que voc\u00ea utiliza para categorizar os hosts.",
+"message.desc.import.ext.kvm.wizard": "Importar dom\u00ednio libvirt de Host KVM Externo n\u00e3o gerenciado pelo CloudStack",
+"message.desc.import.local.kvm.wizard": "Importar imagem QCOW2 do Armazenamento Local do Host KVM selecionado",
+"message.desc.import.shared.kvm.wizard": "Importar imagem QCOW2 do Pool de Armazenamento Prim\u00e1rio selecionado",
+"message.desc.import.unmanage.volume": "Por favor, escolha um pool de armazenamento do qual voc\u00ea deseja importar ou parar de gerenciar volumes. O pool de armazenamento deve estar no status Up. <br>Este recurso suporta apenas KVM.",
 "message.desc.importexportinstancewizard": "Testa caracter\u00edstica s\u00f3 se aplica aos clusters Cloudstack VMware. Ao optar por gerenciar uma inst\u00e2ncia, o CloudStack assume a orquestra\u00e7\u00e3o dessa inst\u00e2ncia. A inst\u00e2ncia \u00e9 deixada em funcionamento e n\u00e3o movida fisicamente. Desagrupar inst\u00e2ncias, remove a capacidade do CloudStack de gerenci\u00e1-las (mas elas s\u00e3o deixadas em funcionamento e n\u00e3o s\u00e3o destru\u00eddas).",
+"message.desc.importingestinstancewizard": "Este recurso aplica-se apenas a inst\u00e2ncias KVM baseadas em libvirt. Apenas inst\u00e2ncias Paradas podem ser ingeridas",
+"message.desc.importmigratefromvmwarewizard": "Ao selecionar um Datacenter VMware existente ou externo e uma inst\u00e2ncia para importar, o CloudStack migra a inst\u00e2ncia selecionada do VMware para KVM em um host de convers\u00e3o usando virt-v2v e a importa para um cluster KVM",
 "message.desc.primary.storage": "Cada cluster deve conter um ou mais servidores de armazenamento prim\u00e1rio e iremos adicionar o primeiro agora. Um armazenamento prim\u00e1rio, cont\u00e9m os volumes de disco para todas as VMs em execu\u00e7\u00e3o nos hosts do cluster. utiliza qualquer protocolo compat\u00edvel com os padr\u00f5es que \u00e9 suportado pelo virtualizador utilizado.",
+"message.desc.register.user.data": "Por favor, preencha os seguintes dados para registrar um dado de usu\u00e1rio.",
+"message.desc.registered.user.data": "Dados do Usu\u00e1rio Registrados.",
 "message.desc.reset.ssh.key.pair": "Por favor, especifique um par de chaves SSH que voc\u00ea deseja adicionar a esta VM.",
 "message.desc.secondary.storage": "Cada zona deve ter pelo menos um NFS ou servidor de armazenamento secund\u00e1rio e iremos adicionar o primeiro agora. Um armazenamento secund\u00e1rios armazena templates de VM, imagens ISO e snapshots do volume de disco da VM. Esse servidor deve estar dispon\u00edvel para todos os hosts na zona. <br/><br/> Fornecer o endere\u00e7o IP e o caminho exportados.",
+"message.desc.zone.edge": "Uma zona \u00e9 a maior unidade organizacional no CloudStack e, normalmente, corresponde a um \u00fanico datacenter. Zonas fornecem isolamento f\u00edsico e redund\u00e2ncia. Uma zona de borda consiste em um ou mais hosts (cada um dos quais fornece armazenamento local como servidores de armazenamento prim\u00e1rio). Apenas redes compartilhadas e L2 podem ser implantadas nessas zonas e funcionalidades que requerem armazenamentos secund\u00e1rios n\u00e3o s\u00e3o suportadas.",
 "message.desc.zone": "Uma zona \u00e9 a maior unidade organizacional no CloudStack e normalmente corresponde \u00e0 um \u00fanico datacenter. As zonas disponibilizam isolamento f\u00edsico e redund\u00e2ncia. Uma zona \u00e9 composta por um ou mais pods (cada um dos quais cont\u00e9m os hosts e servidores de armazenamento prim\u00e1rio) e um servidor de armazenamento secund\u00e1rio que \u00e9 compartilhado por todos os pods na zona.",
 "message.detach.disk": "Voc\u00ea tem certeza que deseja desconectar este disco?",
 "message.detach.iso.confirm": "Confirme se voc\u00ea deseja desconectar o ISO da inst\u00e2ncia virtual.",
 "message.disable.account": "Por favor confirme que voc\u00ea deseja desabilitar esta conta. Ap\u00f3s desabilitar uma conta, todos os usu\u00e1rios desta conta n\u00e3o ir\u00e3o possuir mais acesso aos seus recursos da cloud. Todas as m\u00e1quinas virtuais ser\u00e3o automaticamente desligadas.",
+"message.disable.role": "Por favor, confirme que voc\u00ea gostaria de desativar esta Fun\u00e7\u00e3o",
 "message.disable.user": "Por favor confirme que voc\u00ea deseja desabilitar este usu\u00e1rio.",
 "message.disable.vpn": "Voc\u00ea tem certeza que deseja desabilitar a VPN?",
 "message.disable.vpn.failed": "Falha ao desabilitar VPN",
 "message.disable.vpn.processing": "Desabilitando VPN...",
+"message.disable.webhook.ssl.verification": "Desativar a verifica\u00e7\u00e3o SSL n\u00e3o \u00e9 recomendado",
 "message.discovering.feature": "Descobrindo funcionalidades, por favor aguarde...",
 "message.disk.offering.created": "Oferta de disco criada:",
 "message.disk.usage.info.data.points": "Cada ponto no gr\u00e1fico representa a diferen\u00e7a de dados lidos/escritos desde a \u00faltima coleta de estat\u00edstica realizada (o ponto anterior)",
 "message.disk.usage.info.sum.of.disks": "O uso de disco apresentado \u00e9 composto pela soma de dados lidos/escritos por todos os discos da VM",
 "message.download.volume": "Clique <a href=\"#\">00000</a> para baixar o disco",
 "message.download.volume.confirm": "Por favor confirme que voc\u00ea quer baixar este volume",
+"message.drs.plan.description": "O n\u00famero m\u00e1ximo de migra\u00e7\u00f5es ao vivo permitidas para DRS. Configure DRS na aba de configura\u00e7\u00f5es antes de gerar um plano ou para ativar o DRS autom\u00e1tico para o cluster.",
+"message.drs.plan.executed": "Plano DRS executado com sucesso.",
 "message.edit.acl.failed": "Falha ao editar regra ACL",
 "message.edit.acl.processing": "Editando regra ACL...",
 "message.edit.rule.failed": "Falha ao editar regra",
 "message.edit.rule.processing": "Atualizando regra...",
 "message.edit.traffic.type": "Favor especificar a etiqueta de tr\u00e1fego que voc\u00ea deseja associar com este tipo de tr\u00e1fego.",
+"message.egress.rules.allow": "Permitir (o tr\u00e1fego correspondente \u00e0s regras de sa\u00edda adicionadas ser\u00e1 negado)",
+"message.egress.rules.deny": "Negar (o tr\u00e1fego correspondente \u00e0s regras de sa\u00edda adicionadas ser\u00e1 permitido)",
+"message.egress.rules.info.for.network": "A pol\u00edtica de sa\u00edda padr\u00e3o desta Rede \u00e9 %x. <br> O tr\u00e1fego de sa\u00edda correspondente \u00e0s seguintes regras de sa\u00edda ser\u00e1 %y",
 "message.enable.account": "Confirme se voc\u00ea deseja ativar a conta.",
 "message.enable.netsacler.provider.failed": "Falha ao habilitar provedor Netscaler",
+"message.enable.role": "Por favor, confirme que voc\u00ea deseja ativar esta Fun\u00e7\u00e3o",
 "message.enable.securitygroup.provider.failed": "Falha ao habilitar provedor do grupo de seguran\u00e7a",
 "message.enable.user": "Por favor confirme que voc\u00ea deseja habilitar este usu\u00e1rio.",
 "message.enable.vpn": "Por favor confirme que voc\u00ea deseja acesso VPN habilitado para este endere\u00e7o IP.",
@@ -2119,23 +3074,46 @@
 "message.enter.valid.nic.ip": "Por favor insira um endere\u00e7o IP valido para o NIC",
 "message.error.access.key": "Por favor insira a chave de acesso",
 "message.error.add.guest.network": "Os campos IPv4 ou IPv6 precisam ser preenchidos ao adicionar uma rede guest",
+"message.error.delete.asnrange": "Excluindo Faixa AS",
+"message.error.add.interface.static.route": "Adicionar Rota Est\u00e1tica de interface falhou",
+"message.error.add.logical.router": "Adicionar Roteador L\u00f3gico falhou",
+"message.error.add.network.static.route": "Adicionar Rota Est\u00e1tica de Rede falhou",
+"message.error.add.policy.rule": "Adicionar regra de Pol\u00edtica falhou",
 "message.error.add.secondary.ipaddress": "Houve um erro ao adicionar o endere\u00e7o IP secund\u00e1rio",
+"message.error.add.tungsten.router.table": "Adicionar Tabela de Roteador falhou",
+"message.error.add.tungsten.routing.policy": "Adicionar Pol\u00edtica de Roteamento Tungsten-Fabric falhou",
 "message.error.agent.password": "Por favor, insira a senha do agente",
-"message.error.agent.username": "Por favor, insira o usu\u00e1rio do agent",
+"message.error.agent.username": "Por favor, insira o usu\u00e1rio do agente",
+"message.error.apply.network.policy": "Aplica\u00e7\u00e3o da Pol\u00edtica de Rede falhou",
+"message.error.apply.tungsten.tag": "Aplica\u00e7\u00e3o de Tag falhou",
+"message.error.authentication.code": "Por favor, insira o c\u00f3digo de autentica\u00e7\u00e3o.",
 "message.error.binaries.iso.url": "Por favor, digite a URL ISO dos bin\u00e1rios",
 "message.error.bucket": "Por favor, insira o bucket",
+"message.error.cidr": "CIDR \u00e9 obrigat\u00f3rio",
+"message.error.cidr.or.cidrsize": "CIDR ou tamanho do cidr \u00e9 obrigat\u00f3rio",
 "message.error.cloudian.console": "Single-Sign-On falhou para o Cloudian management console. Solicite a seu administrador que conserte problemas de integra\u00e7\u00e3o.",
 "message.error.cluster.description": "Por favor, digite a descri\u00e7\u00e3o do Kubernetes cluster",
 "message.error.cluster.name": "Por favor, insira o nome do cluster",
 "message.error.confirm.password": "Por favor, confirme a nova senha",
+"message.error.confirm.text": "Por favor, insira o texto de confirma\u00e7\u00e3o",
+"message.error.create.webhook.local.account": "Conta deve ser fornecida para criar um Webhook com escopo Local.",
+"message.error.create.webhook.name": "Nome deve ser fornecido para criar um Webhook.",
+"message.error.create.webhook.payloadurl": "URL de Payload deve ser fornecida para criar um Webhook.",
 "message.error.current.password": "Por favor, insira a senha atual",
 "message.error.custom.disk.size": "Por favor, insira o tamanho do disco personalizado",
 "message.error.date": "Por favor, insira uma data",
+"message.error.delete.interface.static.route": "Remo\u00e7\u00e3o de Rota Est\u00e1tica de interface falhou",
+"message.error.delete.network.static.route": "Remo\u00e7\u00e3o de Rota Est\u00e1tica de Rede falhou",
+"message.error.delete.tungsten.policy.rule": "Exclus\u00e3o da regra de Pol\u00edtica falhou",
+"message.error.delete.tungsten.router.table": "Remo\u00e7\u00e3o da Tabela de Roteador falhou",
+"message.error.delete.tungsten.tag": "Remo\u00e7\u00e3o da Tag falhou",
 "message.error.description": "Por favor, insira uma descri\u00e7\u00e3o",
 "message.error.discovering.feature": "Exce\u00e7\u00e3o lan\u00e7ada durante a descoberta de funcionalidades",
 "message.error.display.text": "Por favor, insira o texto de exibi\u00e7\u00e3o",
+"message.error.duration.less.than.interval": "A dura\u00e7\u00e3o na pol\u00edtica de AutoScale n\u00e3o pode ser menor que o intervalo",
 "message.error.enable.saml": "Incapaz de encontrar IDs de usu\u00e1rios para ativar o SAML Single Sign On, por favor, ative-o manualmente.",
 "message.error.end.date.and.time": "Por favor, selecione a data e hor\u00e1rio final.",
+"message.error.endasn": "Por favor, insira a Faixa AS final",
 "message.error.endip": "Por favor, insira o IP final",
 "message.error.gateway": "Por favor, insira o gateway",
 "message.error.host.name": "Por favor, insira o nome do host",
@@ -2148,9 +3126,11 @@
 "message.error.internallb.instance.port": "Por favor, especifique a porta da inst\u00e2ncia",
 "message.error.internallb.name": "Por favor, especifique um nome para o LB interno",
 "message.error.internallb.source.port": "Por favor, insira uma porta de origem",
+"message.error.invalid.autoscale.vmgroup.name": "Nome do Grupo de AutoScale inv\u00e1lido. Ele pode conter as letras ASCII 'a' a 'z', 'A' a 'Z', os d\u00edgitos '0' a '9' e o h\u00edfen ('-'), deve ter entre 1 e 255 caracteres.",
 "message.error.ip.range": "Por favor, insira um intervalo v\u00e1lido",
 "message.error.ipv4.address": "Por favor, insira um endere\u00e7o IPv4 v\u00e1lido",
 "message.error.ipv4.dns1": "Por favor, insira o DNS 1 IPv4",
+"message.error.ipv4.dns2": "Por favor, insira o DNS 2 IPv4",
 "message.error.ipv6.address": "Por favor, insira um endere\u00e7o IPv6 v\u00e1lido.",
 "message.error.ipv6.gateway": "Por favor, insira o gateway IpV6",
 "message.error.ipv6.gateway.format": "Por favor, insira um gateway IpV6 v\u00e1lido.",
@@ -2160,6 +3140,10 @@
 "message.error.loading.setting": "Houve um erro ao carregar estas configura\u00e7\u00f5es.",
 "message.error.lun": "Por favor, insira o # LUN",
 "message.error.macaddress": "Por favor, digite um endere\u00e7o MAC v\u00e1lido.",
+"message.error.max.members.less.than.min.members": "O valor de M\u00e1x membros deve ser maior que o valor de M\u00edn membros",
+"message.error.mtu.below.min": "MTU est\u00e1 abaixo do valor m\u00ednimo suportado de %x",
+"message.error.mtu.private.max.exceed": "O valor inserido excede o MTU privado m\u00e1ximo permitido para esta Zona, seu valor ser\u00e1 automaticamente reduzido para corresponder a ele.",
+"message.error.mtu.public.max.exceed": "O valor inserido excede o MTU p\u00fablico m\u00e1ximo permitido para esta Zona, seu valor ser\u00e1 automaticamente reduzido para corresponder a ele.",
 "message.error.name": "Por favor, insira um nome",
 "message.error.netmask": "Por favor, insira am\u00e1scara de rede",
 "message.error.network.offering": "Por favor, selecione a oferta de rede",
@@ -2168,6 +3152,7 @@
 "message.error.nexus1000v.password": "Por favor, insira a senha do Nexus 1000v",
 "message.error.nexus1000v.username": "Por favor, insira o usu\u00e1rio do Nexus 1000v",
 "message.error.number": "Por favor, insira um n\u00famero v\u00e1lido",
+"message.error.parent.subnet": "Por favor, escolha uma sub-rede pai",
 "message.error.password": "Insira a sua senha",
 "message.error.path": "Por favor, insira o path",
 "message.error.provide.setting": "Deve fornecer uma chave v\u00e1lida e um valor para a configura\u00e7\u00e3o",
@@ -2175,10 +3160,16 @@
 "message.error.rados.pool": "Por favor, digite o RADOS pool",
 "message.error.rados.secret": "Por favor, digite o RADOS secret",
 "message.error.rados.user": "Por favor, digite o usu\u00e1rio RADOS",
+"message.error.remove.logical.router": "Remo\u00e7\u00e3o do Roteador L\u00f3gico falhou",
+"message.error.remove.network.policy": "Remo\u00e7\u00e3o da Pol\u00edtica de Rede falhou",
 "message.error.remove.nic": "Houve um erro",
 "message.error.remove.secondary.ipaddress": "Houve um erro ao remover o endere\u00e7o IP secund\u00e1rio",
+"message.error.remove.tungsten.routing.policy": "Remo\u00e7\u00e3o da Pol\u00edtica de Roteamento Tungsten-Fabric da Rede falhou",
+"message.error.remove.vm.schedule": "Remo\u00e7\u00e3o do Agendamento de Inst\u00e2ncia falhou",
 "message.error.required.input": "Por favor, digite os dados",
+"message.error.reset.config": "Incapaz de redefinir configura\u00e7\u00e3o para o valor padr\u00e3o",
 "message.error.retrieve.kubeconfig": "N\u00e3o foi poss\u00edvel recuperar a configura\u00e7\u00e3o do cluster Kubernetes",
+"message.error.routing.policy.term": "Comunidade precisa ter o seguinte formato n\u00famero:n\u00famero",
 "message.error.s3nfs.path": "Por favor, insira o S3 NFS path",
 "message.error.s3nfs.server": "Por favor, insira o servidor S3 NFS",
 "message.error.save.setting": "Houve um erro ao salvar esta configura\u00e7\u00e3o.",
@@ -2188,18 +3179,28 @@
 "message.error.secret.key": "Por favor, insira a chave secreta",
 "message.error.select": "Por favor, escolha uma op\u00e7\u00e3o",
 "message.error.select.domain.to.dedicate": "Por favor, escolha o dom\u00ednio a ser dedicado",
+"message.error.select.load.balancer": "Por favor, selecione um balanceador de carga",
+"message.error.select.network": "Por favor, selecione uma Rede",
+"message.error.select.network.supports.vm.autoscaling": "A Rede padr\u00e3o que voc\u00ea selecionou n\u00e3o suporta AutoScale de Inst\u00e2ncia, por favor selecione uma Rede padr\u00e3o que suporte AutoScale de Inst\u00e2ncia.",
+"message.error.select.user": "Por favor, selecione um Usu\u00e1rio",
 "message.error.select.zone.type": "Por favor, escolha o tipo de zona abaixo.",
 "message.error.server": "Por favor, insira o servidor",
 "message.error.serviceoffering.for.cluster": "Por favor, escolha a oferta de servi\u00e7o para o cluster Kubernetes",
+"message.error.setup.2fa": "Falha na configura\u00e7\u00e3o 2FA ao verificar o c\u00f3digo, por favor tente novamente.",
 "message.error.size": "Por favor, insira o tamanho em GB",
 "message.error.size.for.cluster": "Por favor, insira o tamanho do cluster Kubernetes",
 "message.error.smb.password": "Por favor, insira a senha do SMB ",
 "message.error.smb.username": "Por favor, insira o usu\u00e1rio do SMB",
+"message.error.specify.stickiness.method": "Por favor, especifique um m\u00e9todo de stickiness",
 "message.error.specify.sticky.name": "Por favor, especifique o nome sticky",
 "message.error.sr.namelabel": "Por favor, insira o nome-R\u00f3tulo SR",
 "message.error.start.date.and.time": "Por favor, selecione a data e hor\u00e1rio inicial.",
+"message.error.startasn": "Por favor, insira a Faixa AS inicial",
 "message.error.startip": "Por favor, insira o IP de \u00cdnicio",
 "message.error.storage.tags": "Por favor, insira as tags de armazenamento",
+"message.error.swift.account": "Por favor, insira a Conta",
+"message.error.swift.key": "Por favor, insira a chave",
+"message.error.swift.username": "Por favor, insira o nome de usu\u00e1rio",
 "message.error.target.iqn": "Por favor, insira o Target IQN",
 "message.error.time": "Por favor, selecione a hora",
 "message.error.traffic.label": "Por favor, insira o r\u00f3tulo de tr\u00e1fego",
@@ -2208,6 +3209,7 @@
 "message.error.upload.template": "Falha no carregamento de template",
 "message.error.upload.template.description": "Apenas um template pode ser carregado de cada vez",
 "message.error.url": "Por favor, insira a URL",
+"message.error.userdata": "Por favor, insira o Userdata",
 "message.error.username": "Insira o seu usu\u00e1rio",
 "message.error.valid.iops.range": "Por favor, insira uma faixa IOPS v\u00e1lida",
 "message.error.vcenter.datacenter": "Por favor, insira o vCenter datacenter",
@@ -2215,6 +3217,7 @@
 "message.error.vcenter.host": "Por favor, insira o vCenter host",
 "message.error.vcenter.password": "Por favor, insira a senha vCenter",
 "message.error.vcenter.username": "Por favor, insira o usu\u00e1rio vCenter",
+"message.error.verifying.2fa": "Incapaz de verificar 2FA, por favor tente novamente.",
 "message.error.version.for.cluster": "Por favor, selecionar a vers\u00e3o Kubernetes para o cluster Kubernetes",
 "message.error.vlan.range": "Por favor, insira um intervalo VLAN/VNI v\u00e1lido",
 "message.error.volume.name": "Por favor, insira o nome do volume",
@@ -2231,14 +3234,41 @@
 "message.failed.to.add": "Falha ao adicionar",
 "message.failed.to.assign.vms": "Falha ao atribuir VMs",
 "message.failed.to.remove": "Falha ao remover",
+"message.forgot.password.success": "Um e-mail foi enviado para o seu endere\u00e7o de e-mail com instru\u00e7\u00f5es sobre como redefinir sua senha.",
 "message.generate.keys": "Por favor confirme que voc\u00ea deseja gerar novas chaves para este usu\u00e1rio.",
 "message.chart.statistic.info": "Os gr\u00E1ficos mostrados s\u00E3o autoajust\u00E1veis, ou seja, se o valor se aproximar ou passar do limite, ele crescer\u00E1 para ajustar o valor mostrado",
+"message.chart.statistic.info.hypervisor.additionals": "Os dados de m\u00e9tricas dependem do plugin de hypervisor usado para cada hypervisor. O comportamento pode variar entre diferentes hypervisors. Por exemplo, com KVM, as m\u00e9tricas s\u00e3o estat\u00edsticas em tempo real fornecidas pelo libvirt. Em contraste, com VMware, as m\u00e9tricas s\u00e3o dados m\u00e9dios para um determinado intervalo de tempo controlado pela configura\u00e7\u00e3o.",
 "message.guest.traffic.in.advanced.zone": "O tr\u00e1fego de rede guest \u00e9 para comunica\u00e7\u00e3o entre m\u00e1quinas virtuais do usu\u00e1rio final. Especifique um intervalo de IDs de VLAN para transportar o tr\u00e1fego do guest para cada rede f\u00edsica.",
 "message.guest.traffic.in.basic.zone": "O tr\u00e1fego de rede guest \u00e9 para comunica\u00e7\u00e3o entre m\u00e1quinas virtuais do usu\u00e1rio final. Especifique um intervalo de endere\u00e7os IP para que CloudStack possa atribuir \u00e0s VMs. Certifique-se que este intervalo n\u00e3o se sobreponha o range de IPs reservados do sistema.",
+"message.host.controlstate": "O Status do Recurso de Computa\u00e7\u00e3o para esta Inst\u00e2ncia \u00e9 ",
+"message.host.controlstate.retry": "Algumas a\u00e7\u00f5es nesta Inst\u00e2ncia falhar\u00e3o, se for o caso, por favor aguarde um pouco e tente novamente.",
 "message.host.dedicated": "Host dedicado",
 "message.host.dedication.released": "Host dedicado liberado",
 "message.info.cloudian.console": "O Cloudian management console deve abrir em outra janela",
-"message.installwizard.copy.whatiscloudstack": "O CloudStack&#8482 \u00e9 uma plataforma de software que agrega recursos computacionais para construir uma Cloud de infraestrutura como servi\u00e7o (IaaS) p\u00fablica, privada ou h\u00edbrida. O CloudStack&#8482 ger\u00eancia a rede, o armazenamento e os recursos computacionais que comp\u00f5em a infraestrutura de cloud. utilize o CloudStack&#8482 para instalar, gerenciar e configurar os ambientes de cloud computing.<br/><br/>Indo al\u00e9m de imagens de m\u00e1quinas virtuais individuais rodando em hardware commodity, CloudStack&#8482 prov\u00ea uma solu\u00e7\u00e3o completa de software de infraestrutura de cloud para entregar datacenters virtuais como um servi\u00e7o - possuindo todos os componentes essenciais para contruir, instalar e gerenciar aplica\u00e7\u00f5es na cloud multi-camadas e multi-tenant.",
+"message.infra.setup.nsx.description": "Esta zona deve conter um provedor NSX porque o m\u00e9todo de isolamento \u00e9 NSX",
+"message.infra.setup.tungsten.description": "Esta zona deve conter um provedor Tungsten-Fabric porque o m\u00e9todo de isolamento \u00e9 TF",
+"message.import.running.instance.warning": "A VM selecionada est\u00e1 ligada no Datacenter VMware. O estado recomendado para converter uma VM VMware em KVM \u00e9 desligada ap\u00f3s um desligamento gracioso do SO convidado.",
+"message.import.volume": "Por favor, especifique o dom\u00ednio, conta ou nome do projeto. <br>Se n\u00e3o definido, o volume ser\u00e1 importado para o solicitante.",
+"message.installwizard.cloudstack.helptext.document": " * Documenta\u00e7\u00e3o:\t ",
+"message.installwizard.cloudstack.helptext.header": "\nVoc\u00ea pode encontrar mais informa\u00e7\u00f5es sobre o Apache CloudStack™ nas p\u00e1ginas listadas abaixo.\n",
+"message.installwizard.cloudstack.helptext.issues": " * Relatar problemas:\t ",
+"message.installwizard.cloudstack.helptext.mailinglists": " * Juntar-se a listas de discuss\u00e3o:\t ",
+"message.installwizard.cloudstack.helptext.releasenotes": " * Notas de lan\u00e7amento:\t ",
+"message.installwizard.cloudstack.helptext.survey": " * Participe da pesquisa:\t ",
+"message.installwizard.cloudstack.helptext.website": " * Site do projeto:\t ",
+"message.installwizard.tooltip.nsx.provider.edgecluster": "Informa\u00e7\u00f5es do cluster de borda do Provedor NSX n\u00e3o fornecidas",
+"message.installwizard.tooltip.nsx.provider.hostname": "Hostname / endere\u00e7o IP do Provedor NSX n\u00e3o fornecido",
+"message.installwizard.tooltip.nsx.provider.password": "Senha do Provedor NSX n\u00e3o fornecida",
+"message.installwizard.tooltip.nsx.provider.tier0gateway": "Informa\u00e7\u00f5es do gateway tier-0 do Provedor NSX n\u00e3o fornecidas",
+"message.installwizard.tooltip.nsx.provider.transportZone": "Informa\u00e7\u00f5es da zona de transporte do Provedor NSX n\u00e3o fornecidas",
+"message.installwizard.tooltip.nsx.provider.username": "Nome de usu\u00e1rio do Provedor NSX n\u00e3o fornecido",
+"message.installwizard.tooltip.tungsten.provider.gateway": "Gateway do provedor Tungsten \u00e9 obrigat\u00f3rio",
+"message.installwizard.tooltip.tungsten.provider.hostname": "Hostname do provedor Tungsten \u00e9 obrigat\u00f3rio",
+"message.installwizard.tooltip.tungsten.provider.introspectport": "Porta de introspec\u00e7\u00e3o do provedor Tungsten \u00e9 obrigat\u00f3ria",
+"message.installwizard.tooltip.tungsten.provider.name": "Nome do provedor Tungsten \u00e9 obrigat\u00f3rio",
+"message.installwizard.tooltip.tungsten.provider.port": "Porta do provedor Tungsten \u00e9 obrigat\u00f3ria",
+"message.installwizard.tooltip.tungsten.provider.vrouterport": "Porta do vrouter do provedor Tungsten \u00e9 obrigat\u00f3ria",
+"message.installwizard.copy.whatiscloudstack": "O CloudStack&#8482 \u00e9 uma plataforma de software que agrega recursos computacionais para construir uma Cloud de infraestrutura como servi\u00e7o (IaaS) p\u00fablica, privada ou h\u00edbrida. O CloudStack&#8482 ger\u00eancia a rede, o armazenamento e os recursos computacionais que comp\u00f5em a infraestrutura de cloud. utilize o CloudStack&#8482 para instalar, gerenciar e configurar os ambientes de cloud computing.<br/><br/>Indo al\u00e9m de imagens de m\u00e1quinas virtuais individuais rodando em hardware commodity, CloudStack&#8482 prov\u00ea uma solu\u00e7\u00e3o completa de software de infraestrutura de cloud para entregar datacenters virtuais como um servi\u00e7o - possuindo todos os componentes essenciais para contruir, instalar e gerenciar aplica\u00e7\u00f5es na cloud multi-camadas e multi-tenant. Ambas as vers\u00f5es open-source e premium est\u00e3o dispon\u00edveis, com a vers\u00e3o opensource oferecendo praticamente os mesmos recursos.",
 "message.installwizard.tooltip.addpod.name": "O nome para o pod",
 "message.installwizard.tooltip.addpod.reservedsystemendip": "Este \u00e9 o range de IP na rede privada que o CloudStack utiliza para gerenciar o armazenamento secund\u00e1rio das VMs e proxy console das VMs. estes endere\u00e7os IP s\u00e3o obtidos da mesma subrede dos servidores hosts.",
 "message.installwizard.tooltip.addpod.reservedsystemgateway": "O gateway para os hosts neste pod.",
@@ -2249,8 +3279,12 @@
 "message.installwizard.tooltip.configureguesttraffic.gueststartip": "O range de endere\u00e7os IP que estar\u00e1 dispon\u00edvel para aloca\u00e7\u00e3o para os guests nesta zona. Caso uma interface de rede seja utilizada, estes IPs devem estar no mesmo CIDR que o CIDR do pod.",
 "message.instances.managed": "Inst\u00e2ncias ou VMs controladas pelo CloudStack",
 "message.instances.unmanaged": "Inst\u00e2ncias ou VMs que n\u00e3o s\u00e3o controladas pelo CloudStack",
+"message.instances.migrate.vmware": "Inst\u00e2ncias que podem ser migradas do VMware.",
 "message.interloadbalance.not.return.elementid": "erro: A API listInternalLoadBalancerElements API n\u00e3o retorna o ID interno do elemento LB",
+"message.ip.address": "Endere\u00e7o IP : ",
 "message.ip.address.changes.effect.after.vm.restart": "As mudan\u00e7as de endere\u00e7o IP entram em vigor somente ap\u00f3s o rein\u00edcio da VM.",
+"message.ip.v6.prefix.delete": "Prefixo IPv6 exclu\u00eddo",
+"message.iso.arch": "Por favor, selecione uma arquitetura ISO",
 "message.iso.desc": "Imagem de disco contendo dados ou m\u00eddia de sistema operacional boot\u00e1vel",
 "message.kubeconfig.cluster.not.available": "kubeconfig do cluster Kubernetes n\u00e3o est\u00e1 dispon\u00edvel no momento",
 "message.kubernetes.cluster.delete": "Por favor, confirme que voc\u00ea quer destruir o cluster",
@@ -2259,25 +3293,43 @@
 "message.kubernetes.cluster.stop": "Por favor, confirme que voc\u00ea deseja parar o cluster",
 "message.kubernetes.cluster.upgrade": "Por favor, selecione a nova vers\u00e3o do Kubernetes",
 "message.kubernetes.version.delete": "Por favor, confirme que voc\u00ea deseja excluir esta vers\u00e3o do Kubernetes",
+"message.l2.network.unsupported.for.nsx": "Redes L2 n\u00e3o s\u00e3o suportadas para zonas habilitadas para NSX",
 "message.launch.zone": "A zona est\u00e1 pronta para ser executada; por favor, v\u00e1 para o pr\u00f3ximo passo.",
 "message.launch.zone.description": "A zona est\u00e1 pronta para iniciar; por favor, prossiga para o pr\u00f3ximo passo.",
 "message.launch.zone.hint": "Configurar componentes e tr\u00e1fego de rede, incluindo endere\u00e7os IP.",
 "message.license.agreements.not.accepted": "Contratos de licen\u00e7a n\u00e3o foram aceitos",
 "message.listnsp.not.return.providerid": "erro: A API listNetworkServiceProviders n\u00e3o retorna o ID do provedor virtualRouter",
 "message.load.host.failed": "Falha ao carregar os hosts",
+"message.loadbalancer.stickypolicy.configuration": "Personalize a pol\u00edtica de stickiness do balanceador de carga:",
+"message.loading.add.interface.static.route": "Adicionando Rota Est\u00e1tica de interface...",
+"message.loading.add.network.static.route": "Adicionando Rota Est\u00e1tica de Rede...",
+"message.loading.add.policy.rule": "Adicionando regra de Pol\u00edtica...",
+"message.loading.add.tungsten.router.table": "Adicionando Tabela de Roteador...",
+"message.loading.apply.tungsten.tag": "Aplicando Tag...",
+"message.loading.delete.interface.static.route": "Removendo Rota Est\u00e1tica de interface...",
+"message.loading.delete.network.static.route": "Removendo Rota Est\u00e1tica de Rede...",
+"message.loading.delete.tungsten.policy.rule": "Excluindo regra de Pol\u00edtica...",
+"message.loading.delete.tungsten.router.table": "Removendo Tabela de Roteador...",
+"message.loading.delete.tungsten.tag": "Removendo Tag...",
 "message.lock.account": "Confirme se voc\u00ea deseja bloquear esta conta. Bloqueando a conta, todos os usu\u00e1rios desta conta n\u00e3o estar\u00e3o mais habilitados a gerenciar os recursos na nuvem. Os recursos existentes (cloud server) ainda poder\u00e3o ser acessados.",
 "message.lock.user": "Confirme se voc\u00ea deseja bloquear o usu\u00e1rio \"{user}\". Bloqueando este usu\u00e1rio, o mesmo n\u00e3o estar\u00e1 mais habilitado a gerenciar os recursos na nuvem. Os recursos existentes (cloud server) ainda poder\u00e3o ser acessados.",
 "message.lock.user.success": "Usu\u00e1rio \"{user}\" bloqueado com sucesso",
 "message.login.failed": "Falha no login",
+"message.list.zone.vmware.datacenter.empty": "Nenhum Datacenter VMware existe na Zona selecionada",
 "message.memory.usage.info.hypervisor.additionals": "Os dados apresentados podem n\u00e3o refletir o real uso de mem\u00f3ria se a VM n\u00e3o possuir as ferramentas adicionais do virtualizador instaladas",
 "message.memory.usage.info.negative.value": "Se n\u00e3o for poss\u00edvel obter do hypervisor o uso de mem\u00f3ria da VM, ser\u00e3o desabilitadas as linhas de mem\u00f3ria livre do gr\u00e1fico de dados brutos e de uso de mem\u00f3ria no gr\u00e1fico de percentual",
+"message.migrate.instance.host.auto.assign": "O Host para a Inst\u00e2ncia ser\u00e1 escolhido automaticamente com base na adequa\u00e7\u00e3o dentro do mesmo cluster",
 "message.migrate.instance.to.host": "Por favor confirme que voc\u00ea deseja migrar a inst\u00e2ncia para outro host.",
 "message.migrate.instance.to.ps": "Por favor confirme que voc\u00ea deseja migrar a inst\u00e2ncia para outro armazenamento prim\u00e1rio.",
+"message.migrate.resource.to.ss": "Por favor, confirme que voc\u00ea deseja migrar este recurso para outro armazenamento secund\u00e1rio.",
 "message.migrate.router.confirm": "Por favor confirme o host que voc\u00ea deseja migrar o roteador para:",
 "message.migrate.systemvm.confirm": "Por favor confirme o host para o qual voc\u00ea deseja migrar a VM de sistema:",
 "message.migrate.volume": "Por favor confirme que voc\u00ea deseja migrar o volume \"{volume}\" do armazenamento prim\u00e1rio \"{storage}\" para outro.",
 "message.migrate.volume.failed": "Falha ao migrar volume",
+"message.migrate.volume.pool.auto.assign": "O armazenamento prim\u00e1rio para o volume ser\u00e1 escolhido automaticamente com base na adequa\u00e7\u00e3o e no destino da Inst\u00e2ncia",
 "message.migrate.volume.processing": "Migrando volume...",
+"message.migrate.volume.tooltip": "O volume pode ser migrado para qualquer pool de armazenamento adequado. O administrador deve escolher a oferta de disco apropriada para substituir, que suporte o novo pool de armazenamento",
+"message.migrate.with.storage": "Especifique o pool de armazenamento para volumes da Inst\u00e2ncia.",
 "message.migrating.failed": "Falha na migra\u00e7\u00e3o",
 "message.migrating.processing": "Migra\u00e7\u00e3o em andamento para",
 "message.migrating.vm.to.storage.failed": "Falha na migra\u00e7\u00e3o da VM para o armazenamento",
@@ -2289,7 +3341,7 @@
 "message.network.addvm.desc": "Por favor especifique a rede onde voc\u00ea gostaria de adicionar esta VM. Uma nova NIC ser\u00e1 adicionada a esta rede.",
 "message.network.description": "Configura\u00e7\u00e3o da rede e do tr\u00e1fego",
 "message.network.error": "Erro de rede",
-"message.network.error.description": "N\u00e3o \u00e9 poss\u00edvel acessar o servidor de gerenciamento ou uma extens\u00e3o do navegador pode estar bloqueando a solicita\u00e7\u00e3o de rede.",
+"message.network.error.description": "N\u00e3o \u00e9 poss\u00edvel acessar o Management Server ou uma extens\u00e3o do navegador pode estar bloqueando a solicita\u00e7\u00e3o de rede.",
 "message.network.hint": "Configure componentes de rede e tr\u00e1fego p\u00fablico/guest/gerenciamento, incluindo endere\u00e7os IP.",
 "message.network.offering.change.warning": "AVISO: Alterar a oferta causar\u00e1 tempo de inatividade de conectividade para as VMs com NICs na rede.",
 "message.network.offering.forged.transmits": "O switch deixa qualquer frame de sa\u00edda de um adaptador de m\u00e1quina virtual com um endere\u00e7o MAC de origem diferente daquele do arquivo de configura\u00e7\u00e3o .vmx.\nRejeitar - O switch deixa qualquer frame de sa\u00edda de um adaptador de m\u00e1quina virtual com um endere\u00e7o MAC de origem diferente daquele do arquivo de configura\u00e7\u00e3o .vmx.\nAceitar - O switch n\u00e3o realiza filtragem e permite todos os frames de sa\u00edda.\nNenhum - padr\u00e3o de valor a partir da configura\u00e7\u00e3o global.",
@@ -2298,21 +3350,35 @@
 "message.network.offering.mac.learning.warning": "AVISO: para usar o MAC Learning voc\u00ea deve assegurar-se de que os virtualizadores dos hosts est\u00e3o rodando ESXi 6.7+ e a rede usa o vSwitch 6.6.0+ distribu\u00eddo.",
 "message.network.offering.promiscuous.mode": "Se aplica apenas para redes guest no virtualizador VMware.\nRejeitar - O switch deixa qualquer frame de sa\u00edda de um adaptador de m\u00e1quina virtual com um endere\u00e7o MAC de origem diferente daquele do arquivo de configura\u00e7\u00e3o .vmx.\nAceitar - O switch n\u00e3o realiza filtragem e permite todos os frames de sa\u00edda.\nNenhum - padr\u00e3o de valor a partir da configura\u00e7\u00e3o global.",
 "message.network.removenic": "Por favor, confirme que deseja remover esta interface de rede, esta a\u00e7\u00e3o tamb\u00e9m ir\u00e1 remover a rede associada \u00e0 VM.",
+"message.network.restart.required": "Reinicializa\u00e7\u00e3o \u00e9 necess\u00e1ria para rede(s). Clique aqui para ver rede(s) que requerem reinicializa\u00e7\u00e3o.",
+"message.network.selection": "Escolha uma ou mais Redes para anexar a Inst\u00e2ncia.",
+"message.network.selection.new.network": "Uma nova Rede tamb\u00e9m pode ser criada aqui.",
 "message.network.secondaryip": "Por favor, confirme que voc\u00ea gostaria de adquirir um novo IP secund\u00e1rio para este NIC. \n NOTA: Voc\u00ea precisa configurar manualmente o IP secund\u00e1rio rec\u00e9m-adquirido dentro da m\u00e1quina virtual.",
 "message.network.updateip": "Por favor, confirme que voc\u00ea gostaria de mudar o endere\u00e7o IP da NIC em VM.",
 "message.network.update.nic": "Por favor, confirme que voc\u00ea gostaria de atualizar esta NIC.",
 "message.network.usage.info.data.points": "Cada ponto no gr\u00e1fico representa a diferen\u00e7a de dados trafegados desde a \u00faltima coleta de estat\u00edstica realizada (o ponto anterior)",
 "message.network.usage.info.sum.of.vnics": "O uso de rede apresentado \u00e9 composto pela soma de dados trafegados por todas as vNICs da VM",
+"message.new.version.available": "Uma nova vers\u00e3o do CloudStack est\u00e1 dispon\u00edvel. Clique aqui para verificar os detalhes",
+"message.nfs.mount.options.description": "Lista separada por v\u00edrgulas de op\u00e7\u00f5es de montagem NFS para hosts KVM. Op\u00e7\u00f5es suportadas : vers=[3,4.0,4.1,4.2], nconnect=[1...16]",
 "message.no.data.to.show.for.period": "Nenhum dado para mostrar no per\u00edodo selecionado.",
 "message.no.description": "Nenhuma descri\u00e7\u00e3o inserida.",
+"message.offering.internet.protocol.warning": "AVISO: Redes suportadas por IPv6 usam roteamento est\u00e1tico e exigir\u00e3o que rotas upstream sejam configuradas manualmente.",
+"message.offering.ipv6.warning": "Por favor, consulte a documenta\u00e7\u00e3o para criar oferta de Rede/VPC habilitada para IPv6 <a href='http://docs.cloudstack.apache.org/en/latest/plugins/ipv6.html#isolated-network-and-vpc-tier'>Suporte IPv6 no CloudStack - Redes Isoladas e Camadas de VPC</a>",
 "message.ovf.configurations": "H\u00e1 propriedades OVF dispon\u00edveis para a personaliza\u00e7\u00e3o do aparelho selecionado. Por favor, edite os valores de forma apropriada.As ofertas incompat\u00edveis de computa\u00e7\u00e3o ser\u00e3o desativadas.",
+"message.password.reset.failed": "Falha ao redefinir senha.",
+"message.password.reset.success": "A senha foi redefinida com sucesso. Por favor, fa\u00e7a login usando suas novas credenciais.",
+"message.path": "Caminho : ",
 "message.path.description": "NFS: caminho exportado do servidor. VMFS: /datacenter name/datastore name. SharedMountPoint: caminho onde o armazenamento prim\u00e1rio \u00e9 montado, tal como /mnt/primary",
 "message.please.confirm.remove.ssh.key.pair": "Por favor, confirme que voc\u00ea deseja remover este par de chaves SSH",
+"message.please.confirm.remove.user.data": "Por favor, confirme que voc\u00ea deseja remover este Userdata",
 "message.please.enter.valid.value": "Por favor, insira um valor v\u00e1lido",
 "message.please.enter.value": "Por favor, insira valores",
+"message.please.wait.while.autoscale.vmgroup.is.being.created": "Por favor, aguarde enquanto seu Grupo de AutoScale est\u00e1 sendo criado; isso pode levar um tempo...",
 "message.please.wait.while.zone.is.being.created": "Por favor, espere enquanto sua zona est\u00e1 sendo criada; isto pode demorar um pouco...",
 "message.pod.dedicated": "Pod dedicado",
 "message.pod.dedication.released": "Pod dedicado liberado",
+"message.prepare.for.shutdown": "Por favor, confirme que voc\u00ea gostaria de preparar este Management Server para desligamento. Ele n\u00e3o aceitar\u00e1 nenhum novo job Ass\u00edncrono, mas N\u00c3O terminar\u00e1 ap\u00f3s n\u00e3o haver jobs pendentes.",
+"message.primary.storage.invalid.state": "Armazenamento prim\u00e1rio n\u00e3o est\u00e1 no estado Up",
 "message.processing.complete": "Processamento conclu\u00eddo!",
 "message.protocol.description": "Para XenServer, escolha NFS, iSCSI, ou PreSetup. para KVM, escolha NFS, SharedMountPoint, RDB, CLVM ou Gluster. para vSphere, escolha NFS, PreSetup (VMFS, iSCSI, fiberChannel, vSAN ou vVols) ou datastoreCluster. para Hyper-V, escolha SMB/CIFS. para LXC, escolha NFS ou SharedMountPoint. para OVM, escolha NFS ou ocfs2.",
 "message.public.traffic.in.advanced.zone": "O tr\u00e1fego p\u00fablico \u00e9 gerado quando as VMs na nuvem acessam a internet. Os IPs acess\u00edveis ao p\u00fablico devem ser alocados para essa finalidade. Os usu\u00e1rios finais podem usar a interface do usu\u00e1rio CloudStack para adquirir esses IPs afim de implementar NAT entre a sua rede de guests e sua rede p\u00fablica. <br/><br/> Forne\u00e7a pelo menos um intervalo de endere\u00e7os IP para o tr\u00e1fego de internet.",
@@ -2340,6 +3406,11 @@
 "message.remove.ldap": "Voc\u00ea tem certeza que deseja deletar a configura\u00e7\u00e3o LDAP?",
 "message.remove.nic.processing": "Removendo NIC...",
 "message.remove.port.forward.failed": "Falha ao remover regra de encaminhamento de porta",
+"message.remove.router.table.from.interface": "Por favor, confirme que voc\u00ea deseja remover a Tabela de Roteamento desta NIC",
+"message.remove.router.table.from.interface.failed": "Remo\u00e7\u00e3o da Tabela de Roteamento da interface falhou",
+"message.remove.routing.firewall.rule.failed": "Falha ao remover regra de firewall de Roteamento IPv4",
+"message.remove.routing.firewall.rule.processing": "Removendo regra de firewall de Roteamento IPv4...",
+"message.remove.routing.firewall.rule.success": "Regra de firewall de Roteamento IPv4 removida",
 "message.remove.rule.failed": "Falha ao remover regra",
 "message.remove.secondary.ipaddress.processing": "Removendo endere\u00e7o IP secund\u00e1rio...",
 "message.remove.securitygroup.rule.processing": "Removendo regra do grupo de seguran\u00e7a...",
@@ -2348,10 +3419,12 @@
 "message.remove.vpc": "Favor confirmar que voc\u00ea deseja remover a VPC",
 "message.request.failed": "Falha na solicita\u00e7\u00e3o",
 "message.required.add.least.ip": "Por favor, adicionar pelo menos UM intervalo IP",
+"message.required.tagged.physical.network": "S\u00f3 pode haver uma rede f\u00edsica n\u00e3o marcada com tipo de tr\u00e1fego convidado.",
 "message.required.traffic.type": "Erro na configura\u00e7\u00e3o! Todos os tipos de tr\u00e1fego necess\u00e1rios devem ser adicionados e com m\u00faltiplas redes f\u00edsicas cada rede deve ter uma etiqueta.",
 "message.reset.vpn.connection": "Favor confirmar que voc\u00ea deseja reinicializar a conex\u00e3o VPN",
 "message.linstor.resourcegroup.description": "Grupo de recursos Linstor a ser usado para armazenamento prim\u00e1rio",
 "message.resize.volume.failed": "Falha ao redimensionar volume",
+"message.resize.volume.processing": "Redimensionamento de volume est\u00e1 em andamento",
 "message.resource.not.found": "Recurso n\u00e3o encontrado",
 "message.restart.mgmt.server": "Reinicie o(s) servidor(es) de gerenciamento para que a nova configura\u00c3\u00a7\u00c3\u00a3o tenha efeito.",
 "message.restart.network": "Por favor confirme que voc\ufffd deseja reiniciar a rede",
@@ -2359,24 +3432,47 @@
 "message.restart.vpc": "Favor confirmar que voc\u00ea deseja reiniciar a VPC",
 "message.restart.vpc.remark": "Por favor, confirme a reinicializa\u00e7\u00e3o do VPC <p><small><i>Observa\u00e7\u00e3o: fazendo um VPC redundante n\u00e3o redundante ir\u00e1 for\u00e7ar uma limpeza. As redes n\u00e3o estar\u00e3o dispon\u00edveis por alguns minutos</i>.</small></p>",
 "message.scale.processing": "Escalonamento em progresso",
+"message.scaledown.policies": "Por favor, adicione pelo menos uma pol\u00edtica de ScaleDown. O Grupo de AutoScale ser\u00e1 reduzido quando todas as condi\u00e7\u00f5es em uma pol\u00edtica de ScaleDown forem atendidas. As pol\u00edticas de ScaleDown ser\u00e3o verificadas ap\u00f3s as pol\u00edticas de ScaleUp.",
+"message.scaledown.policy.continue": "Por favor, adicione pelo menos uma condi\u00e7\u00e3o \u00e0 pol\u00edtica de ScaleDown para continuar",
+"message.scaledown.policy.duration.continue": "Por favor, insira uma dura\u00e7\u00e3o v\u00e1lida para a pol\u00edtica de ScaleDown para continuar",
+"message.scaledown.policy.name.continue": "Por favor, insira um nome para a pol\u00edtica de ScaleDown para continuar",
+"message.scaleup.policies": "Por favor, adicione pelo menos uma pol\u00edtica de ScaleUp. O Grupo de AutoScale ser\u00e1 aumentado quando todas as condi\u00e7\u00f5es em uma pol\u00edtica de ScaleUp forem atendidas. As pol\u00edticas de ScaleUp ser\u00e3o verificadas antes das pol\u00edticas de ScaleDown.",
+"message.scaleup.policy.continue": "Por favor, adicione pelo menos uma condi\u00e7\u00e3o \u00e0 pol\u00edtica de ScaleUp para continuar",
+"message.scaleup.policy.duration.continue": "Por favor, insira uma dura\u00e7\u00e3o v\u00e1lida para a pol\u00edtica de ScaleUp para continuar",
+"message.scaleup.policy.name.continue": "Por favor, insira um nome para a pol\u00edtica de ScaleUp para continuar",
 "message.select.a.zone": "A zona tipicamente corresponde a um \u00fanico datacenter. M\u00faltiplas zonas auxiliam a nuvem a ser mais confi\u00e1vel provendo isolamento f\u00edsico e redund\u00e2ncia.",
 "message.select.affinity.groups": "Por favor, selecione quaisquer grupos de afinidade que voc\u00ea deseja que esta VM perten\u00e7a:",
+"message.select.bgp.peers": "Por favor, selecione / desmarque os pares BGP associados \u00e0 rede ou VPC:",
 "message.select.deselect.desired.options": "Por favor, selecione / desselecione as op\u00e7\u00f5es desejadas",
+"message.select.deselect.to.sort": "Por favor, selecione / desmarque para ordenar os valores",
 "message.select.destination.image.stores": "Por favor, selecione o(s) armazenamento(s) de imagem(ns) para os quais os dados devem ser migrados",
 "message.select.disk.offering": "Por favor, selecione uma oferta de disco para o disco",
 "message.select.end.date.and.time": "Selecione uma data e hor\u00e1rio final.",
+"message.select.kvm.host.instance.conversion": "(Opcional) Selecione um host KVM no cluster para realizar a convers\u00e3o da inst\u00e2ncia atrav\u00e9s do virt-v2v",
+"message.select.load.balancer.rule": "Por favor, selecione uma regra de balanceamento de carga para o seu Grupo de escalonamento automatico.",
 "message.select.migration.policy": "Por favor, selecione uma pol\u00edtica de migra\u00e7\u00e3o",
 "message.select.nic.network": "Por favor, selecione uma rede para o NIC",
 "message.select.security.groups": "Por favor selecione o(s) grupo(s) de seguran\u00e7a para sua nova VM",
 "message.select.start.date.and.time": "Selecione uma data e hor\u00e1rio inicial.",
+"message.select.temporary.storage.instance.conversion": "(Opcional) Selecione um destino tempor\u00e1rio de Armazenamento para os discos convertidos atrav\u00e9s do virt-v2v",
+"message.select.volume.to.continue": "Por favor, selecione um volume para continuar.",
 "message.select.zone.description": "Selecione o tipo de zona b\u00e1sica/avan\u00e7ada",
 "message.select.zone.hint": "Este \u00e9 o tipo de implanta\u00e7\u00e3o de zona que voc\u00ea deseja utilizar. Zona b\u00e1sica: fornece uma \u00fanica rede na qual para cada inst\u00e2ncia de VM \u00e9 atribu\u00eddo um IP diretamente da rede. O isolamento do guest pode ser fornecido atrav\u00e9s de meios da camada 3, tais como grupos de seguran\u00e7a (filtragem de source IP). Zona avan\u00e7ada: para topologias de rede mais sofisticadas. este modelo de rede oferece  maior flexibilidade na defini\u00e7\u00e3o de redes guest e oferece ofertas de rede personalizadas, como firewall, VPN, ou suporte de balanceamento de carga.",
+"message.select.vm.to.continue": "Por favor, selecione uma inst\u00e2ncia para continuar",
+"message.server": "Servidor : ",
 "message.server.description": "NFS, iSCSI, ou PreSetup: endere\u00e7o IP ou nome DNS do dispositivo de armazenamento. VMWare PreSetup: endere\u00e7o IP ou nome DNS do servidor vCenter. Linstor: URL HTTP(S) do linstor-controller.",
 "message.set.default.nic": "Por favor confirme que voc\u00ea quer tornar este NIC o padr\u00e3o para esta VM,",
 "message.set.default.nic.manual": "Por favor atualize manualmente o NIC padr\u00e3o desta VM agora.",
 "message.setting.updated": "Configura\u00e7\u00e3o atualizada:",
+"message.setting.update.delay": "O novo valor entrar\u00e1 em vigor em 30 segundos.",
 "message.setup.physical.network.during.zone.creation": "Ao adicionar uma zona avan\u00e7ada, \u00e9 preciso configurar uma ou mais redes f\u00edsicas. Cada rede corresponde \u00e0 uma interface de rede no virtualizador. Cada rede f\u00edsica pode ser utilizada para transportar um ou mais tipos de tr\u00e1fego, com certas restri\u00e7\u00f5es sobre como eles podem ser combinados. <br/> <strong> Arraste e solte um ou mais tipos de tr\u00e1fego </ strong> em cada rede f\u00edsica.",
 "message.setup.physical.network.during.zone.creation.basic": "Ao adicionar uma zona b\u00e1sica, \u00e9 poss\u00edvel configurar uma rede f\u00edsica, que corresponde a uma interface de rede no virtualizador. A rede carrega diversos tipos de tr\u00e1fego.<br/><br/>\u00c9 poss\u00edvel <strong>adicionar e remover</strong> outros tipos de tr\u00e1fego na mesma interface de rede f\u00edsica.",
+"message.shared.network.offering.warning": "Administradores de dom\u00ednio e usu\u00e1rios regulares s\u00f3 podem criar Redes compartilhadas a partir de ofertas de Rede com a configura\u00e7\u00e3o specifyvlan=false. Por favor, contate um administrador para criar uma oferta de Rede se esta lista estiver vazia.",
+"message.shared.network.unsupported.for.nsx": "Redes compartilhadas n\u00e3o s\u00e3o suportadas para zonas habilitadas para NSX",
+"message.shutdown.triggered": "Um desligamento foi acionado. CloudStack n\u00e3o aceitar\u00e1 novos jobs",
+"message.snapshot.additional.zones": "Snapshots sempre ser\u00e3o criados em sua zona nativa - %x, aqui voc\u00ea pode selecionar zona(s) adicional(is) para onde ela ser\u00e1 copiada no momento da cria\u00e7\u00e3o",
+"message.sourcenatip.change.inhibited": "Alterar o sourcenat para este IP da Rede para este endere\u00e7o est\u00e1 inibido, pois regras de firewall est\u00e3o definidas para ele. Isso pode incluir regras de encaminhamento de porta ou balanceamento de carga.\n - Se esta for uma Rede Isolada, por favor use updateNetwork/clique no bot\u00e3o editar.\n - Se esta for uma VPC, primeiro limpe todas as outras regras para este endere\u00e7o.",
+"message.sourcenatip.change.warning": "AVISO: Alterar o endere\u00e7o IP sourcenat da rede causar\u00e1 tempo de inatividade de conectividade para as Inst\u00e2ncias com NICs na Rede.",
 "message.specify.tag.key": "Por favor, especifique uma chave de etiqueta",
 "message.specify.tag.value": "Por favor, especifique um valor para a etiqueta",
 "message.step.2.continue": "Selecione o plano",
@@ -2384,55 +3480,101 @@
 "message.step.4.continue": "Selecione pelo menos uma rede para continuar",
 "message.step.license.agreements.continue": "Por favor, aceite todos os termos de licen\u00e7a para continuar",
 "message.success.acquire.ip": "IP adquirido com sucesso",
+"message.success.add.bgp.peer": "Novo par BGP adicionado com sucesso",
 "message.success.add.egress.rule": "Nova regra de sa\u00edda adicionada com sucesso",
 "message.success.add.firewall.rule": "Nova regra do firewall adicionada com sucesso",
 "message.success.add.guest.network": "Rede guest criada com sucesso",
+"message.success.add.interface.static.route": "Rota Est\u00e1tica de interface adicionada com sucesso",
+"message.success.add.ip.v6.prefix": "Prefixo IPv6 adicionado com sucesso",
 "message.success.add.iprange": "Intervalo IP adicionado com sucesso",
+"message.success.add.ipv4.subnet": "Sub-rede IPv4 adicionada com sucesso",
+"message.success.add.ipv4.subnet.for.guest.network": "Sub-rede IPv4 para rede guest adicionada com sucesso",
 "message.success.add.kuberversion": "Vers\u00e3o do Kubernetes adicionado com sucesso",
+"message.success.add.logical.router": "Roteador L\u00f3gico adicionado com sucesso",
 "message.success.add.network": "Rede adicionada com sucesso",
 "message.success.add.network.acl": "Lista ACL da rede adicionada com sucesso",
+"message.success.add.network.permissions": "Permiss\u00f5es de Rede adicionadas com sucesso",
+"message.success.add.network.static.route": "Rota Est\u00e1tica de Rede adicionada com sucesso",
+"message.success.add.object.storage": "Object Storage adicionado com sucesso",
+"message.success.add.physical.network": "Rede F\u00edsica adicionada com sucesso",
+"message.success.add.policy.rule": "Regra de Pol\u00edtica adicionada com sucesso",
+"message.success.add.router.table.to.instance": "Tabela de Roteador adicionada \u00e0 Inst\u00e2ncia com sucesso",
 "message.success.add.port.forward": "Nova regra de encaminhamento de porta adicionada com sucesso",
 "message.success.add.private.gateway": "Gateway privado adicionado com sucesso",
 "message.success.add.rule": "Nova regra adicionada com sucesso",
 "message.success.add.secondary.ipaddress": "IP secund\u00e1rio adicionado com sucesso",
 "message.success.add.static.route": "Rota est\u00e1tica adicionada com sucesso",
 "message.success.add.tag": "Etiqueta adicionada com sucesso",
+"message.success.add.tungsten.router.table": "Tabela de Roteador adicionada com sucesso",
+"message.success.add.tungsten.routing.policy": "Pol\u00edtica de roteamento Tungsten-Fabric adicionada com sucesso",
+"message.success.add.vpc": "Uma Nuvem Privada Virtual adicionada com sucesso",
 "message.success.add.vpc.network": "Rede VPC adicionada com sucesso",
 "message.success.add.vpn.customer.gateway": "Gateway da VPN do cliente adicionado com sucesso",
 "message.success.add.vpn.gateway": "Gateway da VPN adicionado com sucesso",
 "message.success.assign.vm": "VM atribu\u00edda com sucesso",
+"message.success.assign.volume": "Volume atribu\u00eddo com sucesso",
+"message.success.apply.network.policy": "Pol\u00edtica de Rede aplicada com sucesso",
+"message.success.apply.tungsten.tag": "Tag aplicada com sucesso",
+"message.success.asign.vm": "Inst\u00e2ncia atribu\u00edda com sucesso",
 "message.success.assigned.vms": "VMs atribu\u00eddas com sucesso",
 "message.success.certificate.upload": "Certificado carregado com sucesso",
 "message.success.change.affinity.group": "Grupos de afinidade alterados com sucesso",
+"message.success.change.bgp.peers": "Pares BGP alterados com sucesso",
 "message.success.change.offering": "Oferta alterada com sucesso",
 "message.success.change.password": "Senha alterada com sucesso",
 "message.success.change.host.password": "Senha do host \"{name}\" foi alterada com sucesso",
+"message.success.change.scope": "Escopo alterado com sucesso para o pool de armazenamento",
+"message.success.clear.webhook.deliveries": "Entregas de webhook limpas com sucesso",
+"message.success.config.health.monitor": "Monitor de Sa\u00fade Configurado com Sucesso",
+"message.success.config.vm.schedule": "Agendamento de Inst\u00e2ncia configurado com sucesso",
 "message.success.config.backup.schedule": "Agendamento de backup de VM configurado com sucesso",
 "message.success.config.sticky.policy": "Sticky policy configurada com sucesso",
 "message.success.copy.clipboard": "Copiado com sucesso para a \u00e1rea de transfer\u00eancia",
 "message.success.create.account": "Conta criada com sucesso",
+"message.success.create.asnrange": "Faixa AS criada com sucesso",
+"message.success.create.bucket": "Bucket criado com sucesso",
+"message.success.create.gui.theme": "Tema da GUI \"{guiTheme}\" criado com sucesso",
 "message.success.create.internallb": "LB interno criado com sucesso",
 "message.success.create.isolated.network": "Rede isolada criada com sucesso",
 "message.success.create.keypair": "Par de chaves SSH criado com sucesso",
 "message.success.create.kubernetes.cluster": "Cluster Kubernetes criado com sucesso",
 "message.success.create.l2.network": "Rede L2 criada com sucesso",
+"message.success.create.password": "Par de chave de acesso \u00e0 API criada com sucesso",
+"message.success.create.sharedfs": "Sistema de Arquivos Compartilhado criado com sucesso",
 "message.success.create.snapshot.from.vmsnapshot": "Snapshot de volume a partir da snapshot de VM criada com sucesso",
+"message.success.create.template": "Template criado com sucesso",
 "message.success.create.user": "Usu\u00e1rio criado com sucesso",
 "message.success.create.volume": "Volume criado com sucesso",
+"message.success.create.webhook": "Webhook criado com sucesso",
+"message.success.dedicate.bgp.peer": "Par BGP dedicado com sucesso",
+"message.success.dedicate.ipv4.subnet": "Sub-rede IPv4 dedicada com sucesso",
 "message.success.delete": "Exclu\u00eddo com sucesso",
 "message.success.delete.acl.rule": "Regra ACL removida com sucesso",
+"message.success.delete.asnrange": "Faixa AS exclu\u00edda com sucesso",
+"message.success.delete.backup.schedule": "Agendamento de Backup de Inst\u00e2ncia exclu\u00eddo com sucesso",
+"message.success.delete.bgp.peer": "Par BGP exclu\u00eddo com sucesso",
 "message.success.delete.icon": "\u00cdcone deletado com sucesso",
+"message.success.delete.interface.static.route": "Rota Est\u00e1tica de interface removida com sucesso",
+"message.success.delete.ipv4.subnet": "Sub-rede IPv4 removida com sucesso",
+"message.success.delete.keypair": "Par de chave de API deletada com sucesso",
+"message.success.delete.network.static.route": "Rota Est\u00e1tica de Rede removida com sucesso",
 "message.success.delete.node": "Nodo exclu\u00eddo com sucesso",
 "message.success.delete.snapshot.policy": "Pol\u00edtica de snapshot exclu\u00edda com sucesso",
 "message.success.delete.static.route": "Rota est\u00e1tica exclu\u00edda com sucesso",
 "message.success.delete.tag": "Tag exclu\u00edda com sucesso",
+"message.success.delete.tungsten.policy.rule": "Regra de Pol\u00edtica exclu\u00edda com sucesso",
+"message.success.delete.tungsten.router.table": "Tabela de Roteador removida com sucesso",
+"message.success.delete.tungsten.tag": "Tag removida com sucesso",
 "message.success.delete.vm": "VM remov\u00edda com sucesso",
 "message.success.disable.saml.auth": "Autoriza\u00e7\u00e3o SAML desativada com sucesso",
 "message.success.disable.vpn": "VPN desativada com sucesso",
 "message.success.edit.acl": "Regra ACL editada com sucesso",
+"message.success.edit.primary.storage": "Armazenamento Prim\u00e1rio editado com sucesso",
 "message.success.edit.rule": "Regra editada com sucesso",
 "message.success.enable.saml.auth": "Autoriza\u00e7\u00e3o SAML ativada com sucesso",
 "message.success.import.instance": "Inst\u00e2ncia importada com sucesso",
+"message.success.import.volume": "Volume importado com sucesso",
+"message.success.migration": "Migra\u00e7\u00e3o conclu\u00edda com sucesso",
 "message.success.migrate.volume": "Volume migrado com sucesso",
 "message.success.migrating": "Migra\u00e7\u00e3o conclu\u00edda com sucesso para",
 "message.success.move.acl.order": "Regra de ACL movida com sucesso",
@@ -2440,26 +3582,47 @@
 "message.success.register.iso": "ISO registrado com sucesso",
 "message.success.register.keypair": "Par de chaves SSH registrado com sucesso",
 "message.success.register.template": "Template cadastrado com sucesso",
+"message.success.register.user.data": "Userdata registrado com sucesso",
+"message.success.register.user.keypair": "Novo par de chave de API criado com sucesso",
+"message.success.release.dedicated.bgp.peer": "Par BGP dedicado liberado com sucesso",
+"message.success.release.dedicated.ipv4.subnet": "Sub-rede IPv4 dedicada liberada com sucesso",
 "message.success.release.ip": "IP liberado com sucesso",
 "message.success.remove.egress.rule": "Regra de sa\u00edda removida com sucesso",
 "message.success.remove.firewall.rule": "Regra de firewall removida com sucesso",
 "message.success.remove.instance.rule": "Inst\u00e2ncia removida da regra",
 "message.success.remove.ip": "IP removido com sucesso",
 "message.success.remove.iprange": "Intervalo de IP removido com sucesso",
+"message.success.remove.logical.router": "Roteador L\u00f3gico removido com sucesso",
+"message.success.remove.network.permissions": "Permiss\u00f5es de Rede removidas com sucesso",
+"message.success.remove.network.policy": "Pol\u00edtica de Rede removida com sucesso",
 "message.success.remove.nic": "NIC removida com sucesso",
+"message.success.remove.objectstore.directory": "Diret\u00f3rio selecionado removido com sucesso",
+"message.success.remove.objectstore.objects": "Objeto(s) selecionado(s) removido(s) com sucesso",
 "message.success.remove.port.forward": "Regra de encaminhamento de porta removida com sucesso",
+"message.success.remove.router.table.from.interface": "Tabela de Roteador removida da interface com sucesso",
 "message.success.remove.rule": "Regra exclu\u00edda com sucesso",
 "message.success.remove.secondary.ipaddress": "Endere\u00e7o de IP secund\u00e1rio removido com sucesso",
 "message.success.remove.sticky.policy": "Sticky policy removida com sucesso",
+"message.success.remove.tungsten.routing.policy": "Pol\u00edtica de Roteamento Tungsten-Fabric removida da Rede com sucesso",
+"message.success.reset.network.permissions": "Permiss\u00f5es de Rede redefinidas com sucesso",
 "message.success.resize.volume": "Volume redimensionado com sucesso",
 "message.success.scale.kubernetes": "Cluster Kubernetes escalonado com sucesso",
 "message.success.unmanage.instance": "Inst\u00e2ncia n\u00e3o gerenciada com sucesso",
+"message.success.unmanage.volume": "Volume n\u00e3o gerenciado com sucesso",
+"message.success.update.account": "Conta atualizada com sucesso",
+"message.success.update.bgp.peer": "Par BGP atualizado com sucesso",
+"message.success.update.bucket": "Bucket atualizado com sucesso",
+"message.success.update.condition": "Condi\u00e7\u00e3o atualizada com sucesso",
+"message.success.update.gui.theme": "Tema da GUI \"{guiTheme}\" atualizado com sucesso",
 "message.success.update.ipaddress": "Endere\u00e7o IP atualizado com sucesso",
 "message.success.update.iprange": "Intervalo de IP atualizado com sucesso",
+"message.success.update.ipv4.subnet": "Sub-rede IPv4 atualizada com sucesso",
 "message.success.update.kubeversion": "Vers\u00e3o compat\u00edvel com Kubernetes atualizada com sucesso",
 "message.success.update.network": "Rede atualizada com sucesso",
 "message.success.update.nic": "NIC atualizada com sucesso",
 "message.success.update.user": "Usu\u00e1rio atualizado com sucesso",
+"message.success.update.sharedfs": "Sistema de Arquivos Compartilhado atualizado com sucesso",
+"message.success.update.template": "Template atualizado com sucesso",
 "message.success.upgrade.kubernetes": "Cluster do Kubernetes atualizado com sucesso",
 "message.success.upload": "Carregado com sucesso",
 "message.success.upload.description": "Este arquivo de ISO foi carregado. Verifique seu status no menu Imagens > ISOs. Verifique seu status no menu templates",
@@ -2470,15 +3633,43 @@
 "message.suspend.project": "Voc\u00ea tem certeza que deseja suspender este projeto?",
 "message.sussess.discovering.feature": "Descoberto todos os recursos dispon\u00edveis!",
 "message.switch.to": "Transferido para",
+"message.template.arch": "Por favor, selecione uma arquitetura de Template.",
 "message.template.desc": "Imagem de SO que pode ser utilizada para bootar VMs",
 "message.template.import.vm.temporary": "Se um template tempor\u00e1rio for usado, a opera\u00e7\u00e3o de redefini\u00e7\u00e3o da VM n\u00e3o funcionar\u00e1 ap\u00f3s a importa\u00e7\u00e3o.",
 "message.template.iso": "Selecione o template ou ISO para continuar",
+"message.template.type.change.warning": "AVISO: Alterar o tipo de Template para SYSTEM desativar\u00e1 futuras altera\u00e7\u00f5es no Template.",
+"message.test.webhook.delivery": "Testar entrega para o Webhook com um payload opcional",
 "message.tooltip.reserved.system.netmask": "O prefixo de rede que define a subrede deste pod. utilize a nota\u00e7\u00e3o CIDR.",
+"message.traffic.type.deleted": "Tipo de tr\u00e1fego exclu\u00eddo com sucesso",
+"message.trigger.shutdown": "Por favor, confirme que voc\u00ea gostaria de acionar um desligamento neste Management Server. Ele n\u00e3o aceitar\u00e1 nenhum novo job Ass\u00edncrono e terminar\u00e1 ap\u00f3s n\u00e3o haver jobs pendentes.",
+"message.two.fa.auth": "Abra o aplicativo de autentica\u00e7\u00e3o de dois fatores no seu dispositivo m\u00f3vel para visualizar seu c\u00f3digo de autentica\u00e7\u00e3o.",
+"message.two.fa.auth.register.account": "Abra o aplicativo de autentica\u00e7\u00e3o de dois fatores e escaneie o c\u00f3digo QR para adicionar a Conta de Usu\u00e1rio.",
+"message.two.fa.auth.staticpin": "<br> Voc\u00ea configurou 2FA para verifica\u00e7\u00e3o de seguran\u00e7a. <br> Insira o PIN est\u00e1tico gerado durante a configura\u00e7\u00e3o do 2FA para verificar.",
+"message.two.fa.auth.totp": "<br> Voc\u00ea configurou 2FA para verifica\u00e7\u00e3o de seguran\u00e7a. <br> Abra o aplicativo autenticador TOTP no seu dispositivo e insira o c\u00f3digo de autentica\u00e7\u00e3o.",
+"message.two.fa.login.page": "A autentica\u00e7\u00e3o de dois fatores (2FA) est\u00e1 ativada na sua Conta, voc\u00ea precisa selecionar um provedor 2FA e configurar. 2FA \u00e9 uma camada extra de seguran\u00e7a para sua conta. Uma vez que a configura\u00e7\u00e3o seja feita, em cada login voc\u00ea ser\u00e1 solicitado a inserir o c\u00f3digo 2FA.<br>",
+"message.two.fa.register.account": "1. Abra o aplicativo autenticador TOTP no seu dispositivo. <br>2. Escaneie o c\u00f3digo QR abaixo para adicionar o Usu\u00e1rio. <br>3. Se voc\u00ea n\u00e3o conseguir escanear o c\u00f3digo QR, insira a chave de configura\u00e7\u00e3o manualmente. <br>4. A verifica\u00e7\u00e3o do c\u00f3digo 2FA \u00e9 obrigat\u00f3ria para completar a configura\u00e7\u00e3o 2FA.",
+"message.two.fa.register.account.login.page": "1. Abra o aplicativo autenticador TOTP no seu dispositivo. <br>2. Escaneie o c\u00f3digo QR abaixo para adicionar o Usu\u00e1rio. <br>3. Se voc\u00ea n\u00e3o conseguir escanear o c\u00f3digo QR, insira a chave de configura\u00e7\u00e3o manualmente. <br>4. Verifique o c\u00f3digo 2FA para continuar para o login.",
+"message.two.fa.setup.page": "A autentica\u00e7\u00e3o de dois fatores (2FA) \u00e9 uma camada extra de seguran\u00e7a para sua conta.<br> Uma vez que a configura\u00e7\u00e3o seja feita, em cada login voc\u00ea ser\u00e1 solicitado a inserir o c\u00f3digo 2FA.<br>",
+"message.two.fa.static.pin.part1": "Se voc\u00ea n\u00e3o conseguir escanear o c\u00f3digo QR, ",
+"message.two.fa.static.pin.part2": "Clique aqui para visualizar o c\u00f3digo secreto",
+"message.two.fa.staticpin": "1. Use o PIN est\u00e1tico gerado como c\u00f3digo 2FA para autentica\u00e7\u00e3o de dois fatores.<br>2. Salve este PIN est\u00e1tico / c\u00f3digo 2FA e n\u00e3o o compartilhe. Este c\u00f3digo ser\u00e1 usado para logins subsequentes.<br>3. A verifica\u00e7\u00e3o do c\u00f3digo 2FA \u00e9 obrigat\u00f3ria para completar a configura\u00e7\u00e3o 2FA.",
+"message.two.fa.staticpin.login.page": "1. Use o PIN est\u00e1tico gerado como c\u00f3digo 2FA para autentica\u00e7\u00e3o de dois fatores.<br>2. Salve este PIN est\u00e1tico / c\u00f3digo 2FA e n\u00e3o o compartilhe. Este c\u00f3digo ser\u00e1 usado para logins subsequentes.<br>3. Verifique o c\u00f3digo 2FA para continuar para o login.",
+"message.two.fa.view.setup.key": "Clique aqui para visualizar a chave de configura\u00e7\u00e3o",
+"message.two.fa.view.static.pin": "Clique aqui para visualizar o PIN est\u00e1tico",
+"message.two.factor.authorization.failed": "Incapaz de verificar 2FA com o c\u00f3digo fornecido, por favor tente novamente.",
+"message.type.values.to.add": "Por favor, adicione valores adicionais digitando-os",
 "message.traffic.type.to.basic.zone": "Tipo de tr\u00e1fego para a zona b\u00e1sica",
+"message.update.autoscale.policy.failed": "Falha ao atualizar pol\u00edtica de AutoScale",
+"message.update.autoscale.vm.profile.failed": "Falha ao atualizar perfil de Inst\u00e2ncia de AutoScale",
+"message.update.autoscale.vmgroup.failed": "Falha ao atualizar grupo de AutoScale",
+"message.update.condition.failed": "Falha ao atualizar condi\u00e7\u00e3o",
+"message.update.condition.processing": "Atualizando condi\u00e7\u00e3o...",
+"message.update.failed": "Atualiza\u00e7\u00e3o falhou",
 "message.update.nic.processing": "Atualizando NIC...",
 "message.update.ipaddress.processing": "Atualizando endere\u00e7o IP...",
 "message.update.resource.count": "Por favor confirme que voc\u00ea quer atualizar a contagem de recursos para esta conta.",
 "message.update.resource.count.domain": "Por favor, confirme que voc\u00ea deseja atualizar as contagens de recursos para este dom\u00ednio.",
+"message.update.resource.limit.max.untagged.error": "Limite n\u00e3o marcado %x \u00e9 %y. Por favor, especifique limite para tag '%z' menor ou igual a esse",
 "message.update.ssl": "Envie o novo certificado SSL X.509 para ser atualizado em cada console proxy:",
 "message.upload.failed": "Falha ao fazer o carregamento",
 "message.upload.file.limit": "Apenas um arquivo pode ser carregado de cada vez",
@@ -2493,6 +3684,7 @@
 "message.validate.maxlength": "Por favor entre com mais de [0] caracteres.",
 "message.validate.minlength": "Por favor entre com pelo menos [0] caracteres.",
 "message.validate.number": "Por favor entre um n\u00famero v\u00e1lido.",
+"message.validate.positive.number": "Por favor, insira um n\u00famero positivo v\u00e1lido.",
 "message.validate.range": "Por favor entre com um valor com valor entre [0] e [1].",
 "message.validate.range.length": "Por favor entre com um valor com tamanho entre [0] e [1] caracteres.",
 "message.virtual.router.not.return.elementid": "erro: A API listVirtualRouterElements n\u00e3o retorna o ID do elemento do roteador virtual",
@@ -2507,6 +3699,20 @@
 "message.vm.state.stopped": "A VM est\u00e1 parada",
 "message.vm.state.stopping": "A VM est\u00e1 sendo parada",
 "message.vm.state.unknown": "O estado da VM \u00e9 desconhecido.",
+"message.vnf.appliance.networks": "Por favor, selecione as redes para o novo appliance VNF.",
+"message.vnf.credentials.change": "Por favor, altere a(s) senha(s) do appliance VNF imediatamente.",
+"message.vnf.credentials.default": "A(s) credencial(is) padr\u00e3o do appliance VNF",
+"message.vnf.credentials.in.template.vnf.details": "Por favor, encontre as credenciais padr\u00e3o para este VNF nos detalhes do template VNF.",
+"message.vnf.error.deviceid.should.be.consecutive": "O deviceid das NICs VNF selecionadas deve ser consecutivo.",
+"message.vnf.error.network.is.already.used": "A Rede foi usada por v\u00e1rias NICs do novo appliance VNF.",
+"message.vnf.error.network.should.be.used": "Todas as redes selecionadas devem ser usadas como Nics VNF",
+"message.vnf.error.no.networks": "Por favor, selecione as redes para o novo appliance VNF.",
+"message.vnf.error.no.network.for.required.deviceid": "Por favor, selecione uma Rede para a NIC obrigat\u00f3ria do novo appliance VNF.",
+"message.vnf.nic.move.down.fail": "Falha ao mover esta NIC para baixo",
+"message.vnf.nic.move.up.fail": "Falha ao mover esta NIC para cima",
+"message.vnf.no.credentials": "Nenhuma credencial encontrada para o appliance VNF.",
+"message.vnf.select.networks": "Por favor, selecione a rede relevante para cada NIC VNF.",
+"message.volume.state.primary.storage.suitability": "A adequa\u00e7\u00e3o de um armazenamento prim\u00e1rio para um volume depende da oferta de disco do volume e da aloca\u00e7\u00e3o da m\u00e1quina virtual (se o volume estiver anexado a uma m\u00e1quina virtual).",
 "message.volume.state.allocated": "O volume foi alocado, mas ainda n\u00e3o foi criado",
 "message.volume.state.attaching": "O volume est\u00e1 anexado a um volume do estado pronto.",
 "message.volume.state.copying": "O volume est\u00e1 sendo copiado do armazenamento de imagens para o armazenamento prim\u00e1rio, no caso de ser um volume carregado",
@@ -2526,12 +3732,20 @@
 "message.volume.state.uploaderror": "O carregamento do volume encontrou um erro",
 "message.volume.state.uploadinprogress": "Carregamento do volume em progresso",
 "message.volume.state.uploadop": "A opera\u00e7\u00e3o de carregamento de volume est\u00e1 em andamento",
+"message.volumes.managed": "Volumes controlados pelo CloudStack.",
+"message.volumes.unmanaged": "Volumes n\u00e3o controlados pelo CloudStack.",
+"message.vpc.restart.required": "Reinicializa\u00e7\u00e3o \u00e9 necess\u00e1ria para VPC(s). Clique aqui para ver VPC(s) que requerem reinicializa\u00e7\u00e3o.",
 "message.vr.alert.upon.network.offering.creation.others": "Como nenhum dos servi\u00e7os obrigat\u00f3rios para cria\u00e7\u00e3o do VR (VPN, DHCP, DNS, Firewall, LB, UserData, SourceNat, StaticNat, PortForwarding) foram habilitados, o VR n\u00e3o ser\u00e1 criado e a oferta de computa\u00e7\u00e3o n\u00e3o ser\u00e1 usada.",
+"message.warn.change.primary.storage.scope": "Este recurso \u00e9 testado e suportado para as seguintes configura\u00e7\u00f5es:<br>KVM - NFS/Ceph - DefaultPrimary<br>VMware - NFS - DefaultPrimary<br>*Pode haver etapas extras envolvidas para faz\u00ea-lo funcionar para outras configura\u00e7\u00f5es.",
 "message.warn.filetype": "jpg, jpeg, png, bmp e svg s\u00e3o os \u00fanicos formatos de imagem suportados",
 "message.warn.importing.instance.without.nic": "AVISO: essa inst\u00e2ncia est\u00e1 sendo importada sem NICs e muitos recursos de rede n\u00e3o estar\u00e3o dispon\u00edveis. Considere criar uma NIC antes de importar via VCenter ou assim que a inst\u00e2ncia for importada.",
+"message.warn.vpc.offerings": "Ofertas de VPC s\u00c3o exibidas somente caso a conta selecionada possua ao menos uma VPC.",
+"message.warn.zone.mtu.update": "Por favor, note que este limite n\u00e3o afetar\u00e1 as configura\u00e7\u00f5es de MTU da Rede pr\u00e9-existentes",
+"message.webhook.deliveries.time.filter": "A lista de entregas de webhook pode ser filtrada com base em data e hora. Selecione 'Customizado' para especificar o intervalo de data de in\u00edcio e fim.",
 "message.zone.creation.complete": "Cria\u00e7\u00e3o de zona completa",
 "message.zone.detail.description": "Preencha os detalhes da zona",
 "message.zone.detail.hint": "Uma zona \u00e9 a maior unidade organizacional no CloudStack, e normalmente corresponde a um \u00fanico datacenter. As zonas proporcionam isolamento f\u00edsico e redund\u00e2ncia. Uma zona consiste em um ou mais pods (cada um contendo hosts e servidores de armazenamento prim\u00e1rio) e um servidor de armazenamento secund\u00e1rio que \u00e9 compartilhado por todos os pods da zona.",
+"message.zone.edge.local.storage": "Armazenamento local ser\u00e1 usado por padr\u00e3o para Inst\u00e2ncias de Usu\u00e1rio e roteadores virtuais",
 "message.validate.min": "Por favor entre com um valor maior que ou igual a {0}.",
 "migrate.from": "Migrar de",
 "migrate.to": "Migrar para",

From 522283bdeca92a3c4ce75846c106b1fa80661bbd Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Tue, 19 May 2026 10:01:07 +0200
Subject: [PATCH 32/64] Refactor merge conflict checker workflow (#13183)

---
 .github/workflows/merge-conflict-checker.yml | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/merge-conflict-checker.yml b/.github/workflows/merge-conflict-checker.yml
index 748156a2d9ce..2c826a47c7ec 100644
--- a/.github/workflows/merge-conflict-checker.yml
+++ b/.github/workflows/merge-conflict-checker.yml
@@ -17,16 +17,14 @@
 
 name: "PR Merge Conflict Check"
 on:
-  push:
-  pull_request:
-    types: [opened, synchronize, reopened]
+  schedule:
+    - cron: '*/10 * * * *'
+  workflow_dispatch:
 
-permissions:  # added using https://github.com/step-security/secure-workflows
-  contents: read
+permissions: {}
 
 concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
+  group: "gh-aw-${{ github.workflow }}"
 
 jobs:
   triage:

From 3285e2fad8747d3a02cf135616ee220a34a8da4e Mon Sep 17 00:00:00 2001
From: agronaught <jason@ball.net>
Date: Tue, 19 May 2026 20:10:02 +1000
Subject: [PATCH 33/64] systemvm: accept ipv6 established/related return
 traffic (#13173)

---
 systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py
index 93d0d0388efe..63d7724dd20a 100755
--- a/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py
+++ b/systemvm/debian/opt/cloud/bin/cs/CsNetfilter.py
@@ -232,7 +232,7 @@ def add_ip6_chain(self, address_family, table, chain, hook, action):
         if hook == "input" or hook == "output":
             CsHelper.execute("nft add rule %s %s %s icmpv6 type { echo-request, echo-reply, \
                 nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept" % (address_family, table, chain))
-        elif hook == "forward":
+        if hook == "input" or hook == "forward":
             CsHelper.execute("nft add rule %s %s %s ct state established,related accept" % (address_family, table, chain))
 
     def add_ip4_chain(self, address_family, table, chain, hook, action):

From 68221cf10182765c0abce1fe2e3954307335c19f Mon Sep 17 00:00:00 2001
From: James Peru Mmbono <jmsperu@gmail.com>
Date: Tue, 19 May 2026 17:31:58 +0300
Subject: [PATCH 34/64] fix(linstor): pre-flight check destination is a LINSTOR
 satellite before live migration (#13077)

---
 .../motion/LinstorDataMotionStrategy.java     | 61 +++++++++++++++++++
 1 file changed, 61 insertions(+)

diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java
index cab2820f09ae..aa450a8290fb 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/motion/LinstorDataMotionStrategy.java
@@ -314,6 +314,58 @@ private boolean needsExactSizeProp(VolumeInfo srcVolumeInfo) {
         return true;
     }
 
+    /**
+     * Verify that the destination KVM host is a registered LINSTOR satellite on the controller
+     * backing every destination pool involved in this migration. Throws CloudRuntimeException
+     * with a clear message when it isn't, instead of letting the resource creation later fail
+     * obscurely inside auto-placement.
+     *
+     * Best-effort: a transient controller error during this check does not block the migration
+     * — we log a warning and let the downstream resource-create surface the real issue. Only a
+     * confirmed "host not in node list" outcome aborts the migration up-front.
+     */
+    private void verifyDestinationIsLinstorSatellite(Map<VolumeInfo, DataStore> volumeDataStoreMap, Host destHost) {
+        if (destHost == null || destHost.getName() == null) {
+            // Without a destination host name to match, the only sensible thing is to let the
+            // existing flow run and report whatever it would have reported.
+            return;
+        }
+        for (Map.Entry<VolumeInfo, DataStore> entry : volumeDataStoreMap.entrySet()) {
+            DataStore destDataStore = entry.getValue();
+            StoragePoolVO destStoragePool = _storagePool.findById(destDataStore.getId());
+            if (destStoragePool == null
+                    || destStoragePool.getPoolType() != Storage.StoragePoolType.Linstor) {
+                continue;
+            }
+            DevelopersApi api = LinstorUtil.getLinstorAPI(destStoragePool.getHostAddress());
+            try {
+                List<String> nodes = LinstorUtil.getLinstorNodeNames(api);
+                if (nodes == null) {
+                    logger.warn("LINSTOR controller {} returned null node list; skipping pre-flight",
+                            destStoragePool.getHostAddress());
+                    return;
+                }
+                if (!nodes.contains(destHost.getName())) {
+                    throw new CloudRuntimeException(String.format(
+                            "Cannot migrate to host '%s': it is not a registered LINSTOR satellite on " +
+                                    "controller %s (pool '%s'). Known satellites: %s. Either register the " +
+                                    "host with `linstor node create` or pick a different destination.",
+                            destHost.getName(),
+                            destStoragePool.getHostAddress(),
+                            destStoragePool.getName(),
+                            nodes));
+                }
+            } catch (ApiException apiEx) {
+                // Don't block migration on a transient controller hiccup — log and let the
+                // downstream resource creation handle the real failure.
+                logger.warn("LINSTOR pre-flight check could not contact controller {}: {}; " +
+                                "letting downstream resource creation proceed",
+                        destStoragePool.getHostAddress(), apiEx.getBestMessage());
+                return;
+            }
+        }
+    }
+
     @Override
     public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMachineTO vmTO, Host srcHost,
             Host destHost, AsyncCompletionCallback<CopyCommandResult> callback) {
@@ -323,6 +375,15 @@ public void copyAsync(Map<VolumeInfo, DataStore> volumeDataStoreMap, VirtualMach
                     String.format("Invalid hypervisor type [%s]. Only KVM supported", srcHost.getHypervisorType()));
         }
 
+        // Pre-flight: verify the destination KVM host is registered as a satellite on the
+        // LINSTOR controller backing each destination pool. Without this check, resource
+        // creation falls through to the resource-group's auto-placement filters and may
+        // either silently place the resource on the wrong node or fail with an opaque
+        // auto-place error from the LINSTOR API. Failing fast here gives operators a clear
+        // actionable message instead of having to correlate the live-migration failure with
+        // an unrelated LINSTOR controller log entry.
+        verifyDestinationIsLinstorSatellite(volumeDataStoreMap, destHost);
+
         String errMsg = null;
         VMInstanceVO vmInstance = _vmDao.findById(vmTO.getId());
         vmTO.setState(vmInstance.getState());

From c165806d3b8262c58821e04c622da176c935b46b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Erik=20B=C3=B6ck?=
 <89930804+erikbocks@users.noreply.github.com>
Date: Tue, 19 May 2026 12:42:29 -0300
Subject: [PATCH 35/64] Fix VPC network offerings listing in isolated network
 creation form (#12645)

* Fix VPC network offerings listing in isolated network creation form

* Apply suggestions from code review

Co-authored-by: GaOrtiga <49285692+GaOrtiga@users.noreply.github.com>

* Address Bernardo's review

---------

Co-authored-by: GaOrtiga <49285692+GaOrtiga@users.noreply.github.com>
---
 ui/public/locales/en.json                     |  1 +
 ui/public/locales/pt_BR.json                  |  1 +
 .../network/CreateIsolatedNetworkForm.vue     | 28 +++++++++++++------
 3 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 673f6da0ad11..3160e00ba30d 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -3731,6 +3731,7 @@
 "message.warn.filetype": "jpg, jpeg, png, bmp and svg are the only supported image formats.",
 "message.warn.importing.instance.without.nic": "WARNING: This Instance is being imported without NICs and many Network resources will not be available. Consider creating a NIC via vCenter before importing or as soon as the Instance is imported.",
 "message.warn.zone.mtu.update": "Please note that this limit won't affect pre-existing Network's MTU settings",
+"message.warn.vpc.offerings": "VPC offerings will only be shown if the selected account has at least one VPC.",
 "message.webhook.deliveries.time.filter": "Webhook deliveries list can be filtered based on date-time. Select 'Custom' for specifying start and end date range.",
 "message.zone.creation.complete": "Zone creation complete.",
 "message.zone.detail.description": "Populate Zone details.",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index 1b51bc438e58..b29afb8d408a 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -2510,6 +2510,7 @@
 "message.vr.alert.upon.network.offering.creation.others": "Como nenhum dos servi\u00e7os obrigat\u00f3rios para cria\u00e7\u00e3o do VR (VPN, DHCP, DNS, Firewall, LB, UserData, SourceNat, StaticNat, PortForwarding) foram habilitados, o VR n\u00e3o ser\u00e1 criado e a oferta de computa\u00e7\u00e3o n\u00e3o ser\u00e1 usada.",
 "message.warn.filetype": "jpg, jpeg, png, bmp e svg s\u00e3o os \u00fanicos formatos de imagem suportados",
 "message.warn.importing.instance.without.nic": "AVISO: essa inst\u00e2ncia est\u00e1 sendo importada sem NICs e muitos recursos de rede n\u00e3o estar\u00e3o dispon\u00edveis. Considere criar uma NIC antes de importar via VCenter ou assim que a inst\u00e2ncia for importada.",
+"message.warn.vpc.offerings": "Ofertas de VPC somente ser\u00c3o exibidas caso a conta selecionada possua ao menos uma VPC.",
 "message.zone.creation.complete": "Cria\u00e7\u00e3o de zona completa",
 "message.zone.detail.description": "Preencha os detalhes da zona",
 "message.zone.detail.hint": "Uma zona \u00e9 a maior unidade organizacional no CloudStack, e normalmente corresponde a um \u00fanico datacenter. As zonas proporcionam isolamento f\u00edsico e redund\u00e2ncia. Uma zona consiste em um ou mais pods (cada um contendo hosts e servidores de armazenamento prim\u00e1rio) e um servidor de armazenamento secund\u00e1rio que \u00e9 compartilhado por todos os pods da zona.",
diff --git a/ui/src/views/network/CreateIsolatedNetworkForm.vue b/ui/src/views/network/CreateIsolatedNetworkForm.vue
index 78d4ef72f04f..93fef14d601e 100644
--- a/ui/src/views/network/CreateIsolatedNetworkForm.vue
+++ b/ui/src/views/network/CreateIsolatedNetworkForm.vue
@@ -96,6 +96,11 @@
                 {{ opt.displaytext || opt.name || opt.description }}
               </a-select-option>
             </a-select>
+            <a-alert type="warning" v-if="!this.hasVPC">
+              <template #message>
+                <span v-html="$t('message.warn.vpc.offerings')"/>
+              </template>
+            </a-alert>
           </a-form-item>
           <a-form-item ref="asnumber" name="asnumber" v-if="isASNumberRequired()">
             <template #label>
@@ -369,7 +374,8 @@ export default {
       setMTU: false,
       asNumberLoading: false,
       selectedAsNumber: 0,
-      asNumbersZone: []
+      asNumbersZone: [],
+      hasVPC: true
     }
   },
   watch: {
@@ -515,13 +521,17 @@ export default {
       if (this.vpc !== null) { // from VPC section
         this.fetchNetworkOfferingData(true)
       } else { // from guest network section
-        var params = {}
+        const params = {
+          account: this.owner.account,
+          projectid: this.owner.projectid,
+          domainid: this.owner.domainid
+        }
         this.networkOfferingLoading = true
         if ('listVPCs' in this.$store.getters.apis) {
           api('listVPCs', params).then(json => {
             const listVPCs = json.listvpcsresponse.vpc
-            var vpcAvailable = this.arrayHasItems(listVPCs)
-            if (vpcAvailable === false) {
+            this.hasVPC = this.arrayHasItems(listVPCs)
+            if (!this.hasVPC) {
               this.fetchNetworkOfferingData(false)
             } else {
               this.fetchNetworkOfferingData()
@@ -534,7 +544,7 @@ export default {
     },
     fetchNetworkOfferingData (forVpc) {
       this.networkOfferingLoading = true
-      var params = {
+      const params = {
         zoneid: this.selectedZone.id,
         guestiptype: 'Isolated',
         state: 'Enabled'
@@ -577,7 +587,7 @@ export default {
     },
     fetchVpcData () {
       this.vpcLoading = true
-      var params = {
+      const params = {
         listAll: true,
         details: 'min'
       }
@@ -600,14 +610,14 @@ export default {
         const formRaw = toRaw(this.form)
         const values = this.handleRemoveFields(formRaw)
         this.actionLoading = true
-        var params = {
+        const params = {
           zoneId: this.selectedZone.id,
           name: values.name,
           displayText: values.displaytext,
           networkOfferingId: this.selectedNetworkOffering.id
         }
-        var usefulFields = ['gateway', 'netmask', 'cidrsize', 'startip', 'startipv4', 'endip', 'endipv4', 'dns1', 'dns2', 'ip6dns1', 'ip6dns2', 'sourcenatipaddress', 'externalid', 'vpcid', 'vlan', 'networkdomain']
-        for (var field of usefulFields) {
+        const usefulFields = ['gateway', 'netmask', 'cidrsize', 'startip', 'startipv4', 'endip', 'endipv4', 'dns1', 'dns2', 'ip6dns1', 'ip6dns2', 'sourcenatipaddress', 'externalid', 'vpcid', 'vlan', 'networkdomain']
+        for (const field of usefulFields) {
           if (this.isValidTextValueForKey(values, field)) {
             params[field] = values[field]
           }

From 38c001296a2cd5b20ef30be7a3d253c3aecef4ac Mon Sep 17 00:00:00 2001
From: Gabriel Pordeus Santos <gabriel.santos@scclouds.com.br>
Date: Tue, 19 May 2026 17:15:26 -0300
Subject: [PATCH 36/64] Rename gpordeus collaborator to gp-santos (#13195)

---
 .asf.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.asf.yaml b/.asf.yaml
index ef6781bf7f9e..5105ede1813f 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -51,7 +51,7 @@ github:
 
   collaborators:
     - ingox
-    - gpordeus
+    - gp-santos
     - erikbocks
     - Imvedansh
     - Damans227

From c267ad39bcdaa07e42c73cb29b1c4b51bccfe54e Mon Sep 17 00:00:00 2001
From: Eugenio Grosso <eugenio.grosso@gmail.com>
Date: Tue, 19 May 2026 21:21:26 +0100
Subject: [PATCH 37/64] Fix/flasharray delete rename destroy patch conflict
 (#13049)

Signed-off-by: Eugenio Grosso <eugenio.grosso@gmail.com>
Co-authored-by: Eugenio Grosso <egrosso@purestorage.com>
---
 .../adapter/flasharray/FlashArrayAdapter.java | 67 +++++++++++++++----
 1 file changed, 53 insertions(+), 14 deletions(-)

diff --git a/plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayAdapter.java b/plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayAdapter.java
index 715379daf86d..c02c4a8bec08 100644
--- a/plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayAdapter.java
+++ b/plugins/storage/volume/flasharray/src/main/java/org/apache/cloudstack/storage/datastore/adapter/flasharray/FlashArrayAdapter.java
@@ -23,7 +23,8 @@
 import java.security.KeyManagementException;
 import java.security.KeyStoreException;
 import java.security.NoSuchAlgorithmException;
-import java.text.SimpleDateFormat;
+import java.time.ZoneOffset;
+import java.time.format.DateTimeFormatter;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.Map;
@@ -88,6 +89,9 @@ public class FlashArrayAdapter implements ProviderAdapter {
     static final ObjectMapper mapper = new ObjectMapper();
     public String pod = null;
     public String hostgroup = null;
+    private static final DateTimeFormatter DELETION_TIMESTAMP_FORMAT =
+            DateTimeFormatter.ofPattern("yyyyMMddHHmmss").withZone(ZoneOffset.UTC);
+
     private String username;
     private String password;
     private String accessToken;
@@ -200,28 +204,63 @@ public void detach(ProviderAdapterContext context, ProviderAdapterDataObject dat
 
     @Override
     public void delete(ProviderAdapterContext context, ProviderAdapterDataObject dataObject) {
-        // first make sure we are disconnected
-        removeVlunsAll(context, pod, dataObject.getExternalName());
         String fullName = normalizeName(pod, dataObject.getExternalName());
 
-        FlashArrayVolume volume = new FlashArrayVolume();
+        // Snapshots live under /volume-snapshots and already use the array's
+        // reserved form <volume>.<suffix>, which legitimately contains ".".
+        // The stricter [A-Za-z0-9_-] naming rule applies to regular volume
+        // names and free-form rename targets, not to these reserved snapshot
+        // names. Since FlashArray snapshot names are system-defined rather
+        // than arbitrary rename targets, we skip the usual timestamped rename
+        // and only mark snapshots destroyed; the array's own ".N" suffix
+        // already disambiguates them in the recycle bin.
+        if (dataObject.getType() == ProviderAdapterDataObject.Type.SNAPSHOT) {
+            try {
+                FlashArrayVolume destroy = new FlashArrayVolume();
+                destroy.setDestroyed(true);
+                PATCH("/volume-snapshots?names=" + fullName, destroy, new TypeReference<FlashArrayList<FlashArrayVolume>>() {
+                });
+            } catch (CloudRuntimeException e) {
+                String msg = e.getMessage();
+                if (msg != null && (msg.contains("No such volume or snapshot")
+                        || msg.contains("Volume does not exist"))) {
+                    return;
+                }
+                throw e;
+            }
+            return;
+        }
 
-        // rename as we delete so it doesn't conflict if the template or volume is ever recreated
-        // pure keeps the volume(s) around in a Destroyed bucket for a period of time post delete
-        String timestamp = new SimpleDateFormat("yyyyMMddHHmmss").format(new java.util.Date());
-        volume.setExternalName(fullName + "-" + timestamp);
+        // first make sure we are disconnected
+        removeVlunsAll(context, pod, dataObject.getExternalName());
+
+        // Rename then destroy: FlashArray keeps destroyed volumes in a recycle
+        // bin (default 24h) from which they can be recovered. Renaming with a
+        // deletion timestamp gives operators a forensic trail when browsing the
+        // array - they can see when each destroyed copy was deleted on the
+        // CloudStack side. FlashArray rejects a single PATCH that combines
+        // {name, destroyed}, so the rename and the destroy must be issued as
+        // two separate requests each carrying only its own field.
+        // Use UTC so the rename suffix is stable regardless of the management
+        // server's local timezone or DST changes - operators correlating the
+        // CloudStack delete event with the array's audit log get a consistent
+        // wall-clock value.
+        String timestamp = DELETION_TIMESTAMP_FORMAT.format(java.time.Instant.now());
+        String renamedName = fullName + "-" + timestamp;
 
         try {
-            PATCH("/volumes?names=" + fullName, volume, new TypeReference<FlashArrayList<FlashArrayVolume>>() {
+            FlashArrayVolume rename = new FlashArrayVolume();
+            rename.setExternalName(renamedName);
+            PATCH("/volumes?names=" + fullName, rename, new TypeReference<FlashArrayList<FlashArrayVolume>>() {
             });
 
-            // now delete it with new name
-            volume.setDestroyed(true);
-
-            PATCH("/volumes?names=" + fullName + "-" + timestamp, volume, new TypeReference<FlashArrayList<FlashArrayVolume>>() {
+            FlashArrayVolume destroy = new FlashArrayVolume();
+            destroy.setDestroyed(true);
+            PATCH("/volumes?names=" + renamedName, destroy, new TypeReference<FlashArrayList<FlashArrayVolume>>() {
             });
         } catch (CloudRuntimeException e) {
-            if (e.toString().contains("Volume does not exist")) {
+            String msg = e.getMessage();
+            if (msg != null && msg.contains("Volume does not exist")) {
                 return;
             } else {
                 throw e;

From ca4645320e2b40ebc541b4818b2f8f9a044f3fc2 Mon Sep 17 00:00:00 2001
From: Nicolas Vazquez <nicovazquez90@gmail.com>
Date: Tue, 19 May 2026 17:23:27 -0300
Subject: [PATCH 38/64] Move checkRoleEscalation outside DB transaction in
 createAccount (#13044)

Co-authored-by: Aaron Chung <aaron_chung@apple.com>
---
 .../java/com/cloud/user/AccountManagerImpl.java | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
index e01137cffbc2..c485aae87ec9 100644
--- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
@@ -1341,20 +1341,19 @@ public UserAccount createUserAccount(final String userName, final String passwor
 
         final String accountNameFinal = accountName;
         final Long domainIdFinal = domainId;
-        final String accountUUIDFinal = accountUUID;
+        final String resolvedAccountUUID = accountUUID != null ? accountUUID : UUID.randomUUID().toString();
+
+        // Check role escalation before the transaction — this is a read-only check
+        // that iterates all API commands and doesn't need a write transaction open.
+        AccountVO requestedAccount = new AccountVO(accountNameFinal, domainIdFinal, networkDomain, accountType, roleId, resolvedAccountUUID);
+        checkRoleEscalation(getCurrentCallingAccount(), requestedAccount);
+
         Pair<Long, Account> pair = Transaction.execute(new TransactionCallback<>() {
             @Override
             public Pair<Long, Account> doInTransaction(TransactionStatus status) {
-                // create account
-                String accountUUID = accountUUIDFinal;
-                if (accountUUID == null) {
-                    accountUUID = UUID.randomUUID().toString();
-                }
-                AccountVO account = createAccount(accountNameFinal, accountType, roleId, domainIdFinal, networkDomain, details, accountUUID);
+                AccountVO account = createAccount(accountNameFinal, accountType, roleId, domainIdFinal, networkDomain, details, resolvedAccountUUID);
                 long accountId = account.getId();
 
-                checkRoleEscalation(getCurrentCallingAccount(), account);
-
                 // create the first user for the account
                 UserVO user = createUser(accountId, userName, password, firstName, lastName, email, timezone, userUUID, source);
 

From 35ac91e58b83d50dc71784cad9c41044926986e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jo=C3=A3o=20Jandre?=
 <48719461+JoaoJandre@users.noreply.github.com>
Date: Tue, 19 May 2026 17:24:32 -0300
Subject: [PATCH 39/64] Change exception treatment on incremental snapshot wait
 (#12665)

---
 .../com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java   | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
index 6e03b84d20cf..f95ebff5326f 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/storage/KVMStorageProcessor.java
@@ -2047,7 +2047,7 @@ private void waitForBackup(String vmName) throws CloudRuntimeException {
             try {
                 Thread.sleep(10000);
             } catch (InterruptedException e) {
-                throw new CloudRuntimeException(e);
+                logger.trace("Thread that was tracking the progress for backup of VM [{}] was interrupted. Ignoring.", vmName);
             }
         }
 

From 3c1f03144feee985404b0be0d65a25288d219d70 Mon Sep 17 00:00:00 2001
From: Davi Torres <90287660+daviftorres@users.noreply.github.com>
Date: Tue, 19 May 2026 16:29:50 -0400
Subject: [PATCH 40/64] Add null check for ApiKeyPair in getUserByApiKey
 (#12938)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Co-authored-by: dahn <daan.hoogland@gmail.com>
Co-authored-by: Bernardo De Marco Gonçalves <bernardomg2004@gmail.com>
---
 .../apache/cloudstack/api/command/admin/user/GetUserCmd.java | 4 ++--
 server/src/main/java/com/cloud/user/AccountManagerImpl.java  | 5 +++++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/user/GetUserCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/user/GetUserCmd.java
index 3427cef33661..a3dcf08c3a31 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/user/GetUserCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/user/GetUserCmd.java
@@ -22,7 +22,7 @@
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.response.UserResponse;
-
+import org.apache.cloudstack.api.ApiArgValidator;
 import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.user.UserAccount;
 
@@ -35,7 +35,7 @@ public class GetUserCmd extends BaseCmd {
     //////////////// API parameters /////////////////////
     /////////////////////////////////////////////////////
 
-    @Parameter(name = ApiConstants.USER_API_KEY, type = CommandType.STRING, required = true, description = "API key of the user")
+    @Parameter(name = ApiConstants.USER_API_KEY, type = CommandType.STRING, required = true, description = "API key of the user", validations = {ApiArgValidator.NotNullOrEmpty})
     private String apiKey;
 
     /////////////////////////////////////////////////////
diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
index 74bf56cb0832..d4f51301e78c 100644
--- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
@@ -3848,6 +3848,11 @@ public void buildACLViewSearchCriteria(SearchCriteria<? extends ControlledViewEn
     @Override
     public UserAccount getUserByApiKey(String apiKey) {
         ApiKeyPairVO keyPair = apiKeyPairDao.findByApiKey(apiKey);
+
+        if (keyPair == null) {
+            return null;
+        }
+
         return userAccountDao.findById(keyPair.getUserId());
     }
 

From a47091431a9c8bfe4f66bd2ab9ee544e779ed070 Mon Sep 17 00:00:00 2001
From: Daman Arora <61474540+Damans227@users.noreply.github.com>
Date: Wed, 20 May 2026 10:10:01 -0400
Subject: [PATCH 41/64] Fix select search icon orientation in dropdown menu
 (#13170)

---
 ui/src/style/ant-overwrite/ant-form.less | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/src/style/ant-overwrite/ant-form.less b/ui/src/style/ant-overwrite/ant-form.less
index 52a2086fb4ff..882724b8ecc3 100644
--- a/ui/src/style/ant-overwrite/ant-form.less
+++ b/ui/src/style/ant-overwrite/ant-form.less
@@ -23,6 +23,6 @@
   transition: transform .3s, -webkit-transform .3s;
 }
 
-.ant-select-open .ant-select-arrow .ant-select-suffix svg {
+.ant-select-open .ant-select-arrow .ant-select-suffix:not(.anticon-search) svg {
   transform: rotateZ(-180deg);
 }

From 1fe486f493b2f52abcf971b3d009044848c7885f Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Thu, 21 May 2026 13:19:13 +0530
Subject: [PATCH 42/64] Add ROOT CAs to the trust store and allow force
 provisioning of certs hosts & systemVMs via ssh (#12911)

---
 .../admin/ca/ProvisionCertificateCmd.java     |  12 +-
 .../org/apache/cloudstack/ca/CAManager.java   |  31 ++-
 .../ca/provider/RootCACustomTrustManager.java |   8 +-
 .../ca/provider/RootCAProvider.java           | 172 +++++++++++---
 .../RootCACustomTrustManagerTest.java         |  37 ++-
 .../ca/provider/RootCAProviderTest.java       | 107 ++++++++-
 .../mom/webhook/WebhookDeliveryThread.java    |   6 +-
 scripts/util/keystore-cert-import             |  20 +-
 .../discoverer/LibvirtServerDiscoverer.java   |  55 +----
 .../apache/cloudstack/ca/CAManagerImpl.java   | 223 +++++++++++++++++-
 .../cloudstack/ca/CABackgroundTaskTest.java   |  10 +-
 .../cloudstack/ca/CAManagerImplTest.java      | 223 +++++++++++++++++-
 systemvm/patch-sysvms.sh                      |  23 +-
 .../smoke/test_certauthority_root.py          | 177 +++++++++++++-
 ui/src/config/section/infra/hosts.js          |   2 +-
 .../main/java/com/cloud/utils/nio/Link.java   |   2 +-
 .../cloudstack/utils/security/CertUtils.java  |  15 +-
 .../utils/security/KeyStoreUtils.java         |   1 -
 .../utils/security/CertUtilsTest.java         |  17 +-
 19 files changed, 989 insertions(+), 152 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/ca/ProvisionCertificateCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/ca/ProvisionCertificateCmd.java
index 6deaea22ac6c..d333a74fdb3b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/ca/ProvisionCertificateCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/ca/ProvisionCertificateCmd.java
@@ -63,6 +63,12 @@ public class ProvisionCertificateCmd extends BaseAsyncCmd {
             description = "Name of the CA service provider, otherwise the default configured provider plugin will be used")
     private String provider;
 
+    @Parameter(name = ApiConstants.FORCED, type = CommandType.BOOLEAN,
+            description = "When true, uses SSH to re-provision the agent's certificate, bypassing the NIO agent connection. " +
+            "Use this when agents are disconnected due to a CA change. Supported for KVM hosts and SystemVMs. Default is false",
+            since = "4.23.0")
+    private Boolean forced;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -79,6 +85,10 @@ public String getProvider() {
         return provider;
     }
 
+    public boolean isForced() {
+        return forced != null && forced;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -90,7 +100,7 @@ public void execute() {
             throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Unable to find host by ID: " + getHostId());
         }
 
-        boolean result = caManager.provisionCertificate(host, getReconnect(), getProvider());
+        boolean result = caManager.provisionCertificate(host, getReconnect(), getProvider(), isForced());
         SuccessResponse response = new SuccessResponse(getCommandName());
         response.setSuccess(result);
         setResponseObject(response);
diff --git a/api/src/main/java/org/apache/cloudstack/ca/CAManager.java b/api/src/main/java/org/apache/cloudstack/ca/CAManager.java
index b0fb1ac73c21..d2ebdc25f1bd 100644
--- a/api/src/main/java/org/apache/cloudstack/ca/CAManager.java
+++ b/api/src/main/java/org/apache/cloudstack/ca/CAManager.java
@@ -23,6 +23,8 @@
 import java.util.List;
 import java.util.Map;
 
+import com.trilead.ssh2.Connection;
+
 import org.apache.cloudstack.framework.ca.CAProvider;
 import org.apache.cloudstack.framework.ca.CAService;
 import org.apache.cloudstack.framework.ca.Certificate;
@@ -39,7 +41,10 @@ public interface CAManager extends CAService, Configurable, PluggableService {
     ConfigKey<String> CAProviderPlugin = new ConfigKey<>("Advanced", String.class,
             "ca.framework.provider.plugin",
             "root",
-            "The CA provider plugin that is used for secure CloudStack management server-agent communication for encryption and authentication. Restart management server(s) when changed.", true);
+            "The CA provider plugin used for CloudStack internal certificate management (MS-agent encryption and authentication). " +
+            "The default 'root' provider auto-generates a CA on first startup, but also supports user-provided custom CA material " +
+            "via the ca.plugin.root.private.key, ca.plugin.root.public.key, and ca.plugin.root.ca.certificate settings. " +
+            "Restart management server(s) when changed.", false);
 
     ConfigKey<Integer> CertKeySize = new ConfigKey<>("Advanced", Integer.class,
                                     "ca.framework.cert.keysize",
@@ -85,6 +90,12 @@ public interface CAManager extends CAService, Configurable, PluggableService {
                     "The actual implementation will depend on the configured CA provider.",
             false);
 
+    ConfigKey<Boolean> CaInjectDefaultTruststore = new ConfigKey<>("Advanced", Boolean.class,
+            "ca.framework.inject.default.truststore", "true",
+            "When true, injects the CA provider's certificate into the JVM default truststore on management server startup. " +
+            "This allows outgoing HTTPS connections from the management server to trust servers with certificates signed by the configured CA. " +
+            "Restart management server(s) when changed.", false);
+
     /**
      * Returns a list of available CA provider plugins
      * @return returns list of CAProvider
@@ -130,12 +141,26 @@ public interface CAManager extends CAService, Configurable, PluggableService {
     boolean revokeCertificate(final BigInteger certSerial, final String certCn, final String provider);
 
     /**
-     * Provisions certificate for given active and connected agent host
+     * Provisions certificate for given agent host.
+     * When forced=true, uses SSH to re-provision bypassing the NIO agent connection (for disconnected agents).
      * @param host
+     * @param reconnect
      * @param provider
+     * @param forced when true, provisions via SSH instead of NIO; supports KVM hosts and SystemVMs
      * @return returns success/failure as boolean
      */
-    boolean provisionCertificate(final Host host, final Boolean reconnect, final String provider);
+    boolean provisionCertificate(final Host host, final Boolean reconnect, final String provider, final boolean forced);
+
+    /**
+     * Provisions certificate for a KVM host using an existing SSH connection.
+     * Runs keystore-setup to generate a CSR, issues a certificate, then runs keystore-cert-import.
+     * Used during host discovery and for forced re-provisioning when the NIO agent is unreachable.
+     * @param sshConnection active SSH connection to the KVM host
+     * @param agentIp IP address of the KVM host agent
+     * @param agentHostname hostname of the KVM host agent
+     * @param caProvider optional CA provider plugin name (null uses default)
+     */
+    void provisionCertificateViaSsh(Connection sshConnection, String agentIp, String agentHostname, String caProvider);
 
     /**
      * Setups up a new keystore and generates CSR for a host
diff --git a/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCACustomTrustManager.java b/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCACustomTrustManager.java
index 5ff036fef12f..d018d488c64a 100644
--- a/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCACustomTrustManager.java
+++ b/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCACustomTrustManager.java
@@ -40,17 +40,17 @@ public final class RootCACustomTrustManager implements X509TrustManager {
     private boolean authStrictness = true;
     private boolean allowExpiredCertificate = true;
     private CrlDao crlDao;
-    private X509Certificate caCertificate;
+    private List<X509Certificate> caCertificates;
     private Map<String, X509Certificate> activeCertMap;
 
-    public RootCACustomTrustManager(final String clientAddress, final boolean authStrictness, final boolean allowExpiredCertificate, final Map<String, X509Certificate> activeCertMap, final X509Certificate caCertificate, final CrlDao crlDao) {
+    public RootCACustomTrustManager(final String clientAddress, final boolean authStrictness, final boolean allowExpiredCertificate, final Map<String, X509Certificate> activeCertMap, final List<X509Certificate> caCertificates, final CrlDao crlDao) {
         if (StringUtils.isNotEmpty(clientAddress)) {
             this.clientAddress = clientAddress.replace("/", "").split(":")[0];
         }
         this.authStrictness = authStrictness;
         this.allowExpiredCertificate = allowExpiredCertificate;
         this.activeCertMap = activeCertMap;
-        this.caCertificate = caCertificate;
+        this.caCertificates = caCertificates;
         this.crlDao = crlDao;
     }
 
@@ -151,6 +151,6 @@ public void checkServerTrusted(X509Certificate[] x509Certificates, String s) thr
 
     @Override
     public X509Certificate[] getAcceptedIssuers() {
-        return new X509Certificate[]{caCertificate};
+        return caCertificates.toArray(new X509Certificate[0]);
     }
 }
diff --git a/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCAProvider.java b/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCAProvider.java
index 25c45ed2a102..afb4f561160e 100644
--- a/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCAProvider.java
+++ b/plugins/ca/root-ca/src/main/java/org/apache/cloudstack/ca/provider/RootCAProvider.java
@@ -40,7 +40,6 @@
 import java.security.spec.InvalidKeySpecException;
 import java.util.ArrayList;
 import java.util.Collection;
-import java.util.Collections;
 import java.util.Enumeration;
 import java.util.HashSet;
 import java.util.List;
@@ -60,6 +59,7 @@
 import org.apache.cloudstack.framework.ca.Certificate;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.cloudstack.framework.config.ValidatedConfigKey;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.utils.security.CertUtils;
 import org.apache.cloudstack.utils.security.KeyStoreUtils;
@@ -92,6 +92,7 @@ public final class RootCAProvider extends AdapterBase implements CAProvider, Con
 
     private static KeyPair caKeyPair = null;
     private static X509Certificate caCertificate = null;
+    private static List<X509Certificate> caCertificates = null;
     private static KeyStore managementKeyStore = null;
 
     @Inject
@@ -103,20 +104,25 @@ public final class RootCAProvider extends AdapterBase implements CAProvider, Con
     /////////////// Root CA Settings ///////////////////
     ////////////////////////////////////////////////////
 
-    private static ConfigKey<String> rootCAPrivateKey = new ConfigKey<>("Hidden", String.class,
-            "ca.plugin.root.private.key",
-            null,
-            "The ROOT CA private key.", true);
-
-    private static ConfigKey<String> rootCAPublicKey = new ConfigKey<>("Hidden", String.class,
-            "ca.plugin.root.public.key",
-            null,
-            "The ROOT CA public key.", true);
-
-    private static ConfigKey<String> rootCACertificate = new ConfigKey<>("Hidden", String.class,
-            "ca.plugin.root.ca.certificate",
-            null,
-            "The ROOT CA certificate.", true);
+    private static ConfigKey<String> rootCAPrivateKey = new ValidatedConfigKey<>("Hidden", String.class,
+            "ca.plugin.root.private.key", null,
+            "The ROOT CA private key in PEM format. " +
+            "When set along with the public key and certificate, CloudStack uses this custom CA instead of auto-generating one. " +
+            "All three ca.plugin.root.* keys must be set together. Restart management server(s) when changed.",
+            false, ConfigKey.Scope.Global, null, RootCAProvider::validatePrivateKeyPem);
+
+    private static ConfigKey<String> rootCAPublicKey = new ValidatedConfigKey<>("Hidden", String.class,
+            "ca.plugin.root.public.key", null,
+            "The ROOT CA public key in PEM format (X.509/SPKI: must start with '-----BEGIN PUBLIC KEY-----'). " +
+            "Required when providing a custom CA. Restart management server(s) when changed.",
+            false, ConfigKey.Scope.Global, null, RootCAProvider::validatePublicKeyPem);
+
+    private static ConfigKey<String> rootCACertificate = new ValidatedConfigKey<>("Hidden", String.class,
+            "ca.plugin.root.ca.certificate", null,
+            "The CA certificate(s) in PEM format (must start with '-----BEGIN CERTIFICATE-----'). " +
+            "For intermediate CAs, concatenate the signing cert first, followed by intermediate(s) and root. " +
+            "Required when providing a custom CA. Restart management server(s) when changed.",
+            false, ConfigKey.Scope.Global, null, RootCAProvider::validateCACertificatePem);
 
     private static ConfigKey<String> rootCAIssuerDN = new ConfigKey<>("Advanced", String.class,
             "ca.plugin.root.issuer.dn",
@@ -151,7 +157,7 @@ private Certificate generateCertificate(final List<String> domainNames, final Li
                 caCertificate, caKeyPair, keyPair.getPublic(),
                 subject, CAManager.CertSignatureAlgorithm.value(),
                 validityDays, domainNames, ipAddresses);
-        return new Certificate(clientCertificate, keyPair.getPrivate(), Collections.singletonList(caCertificate));
+        return new Certificate(clientCertificate, keyPair.getPrivate(), caCertificates);
     }
 
     private Certificate generateCertificateUsingCsr(final String csr, final List<String> names, final List<String> ips, final int validityDays) throws NoSuchAlgorithmException, InvalidKeyException, NoSuchProviderException, CertificateException, SignatureException, IOException, OperatorCreationException {
@@ -205,7 +211,7 @@ private Certificate generateCertificateUsingCsr(final String csr, final List<Str
                 caCertificate, caKeyPair, request.getPublicKey(),
                 subject, CAManager.CertSignatureAlgorithm.value(),
                 validityDays, dnsNames, ipAddresses);
-        return new Certificate(clientCertificate, null, Collections.singletonList(caCertificate));
+        return new Certificate(clientCertificate, null, caCertificates);
     }
 
     ////////////////////////////////////////////////////////
@@ -219,7 +225,7 @@ public boolean canProvisionCertificates() {
 
     @Override
     public List<X509Certificate> getCaCertificate() {
-        return Collections.singletonList(caCertificate);
+        return caCertificates;
     }
 
     @Override
@@ -254,8 +260,8 @@ public boolean revokeCertificate(final BigInteger certSerial, final String certC
     private KeyStore getCaKeyStore() throws CertificateException, NoSuchAlgorithmException, IOException, KeyStoreException {
         final KeyStore ks = KeyStore.getInstance("JKS");
         ks.load(null, null);
-        if (caKeyPair != null && caCertificate != null) {
-            ks.setKeyEntry(caAlias, caKeyPair.getPrivate(), getKeyStorePassphrase(), new X509Certificate[]{caCertificate});
+        if (caKeyPair != null && CollectionUtils.isNotEmpty(caCertificates)) {
+            ks.setKeyEntry(caAlias, caKeyPair.getPrivate(), getKeyStorePassphrase(), caCertificates.toArray(new X509Certificate[0]));
         } else {
             return null;
         }
@@ -274,7 +280,7 @@ public SSLEngine createSSLEngine(final SSLContext sslContext, final String remot
         final boolean authStrictness = rootCAAuthStrictness.value();
         final boolean allowExpiredCertificate = rootCAAllowExpiredCert.value();
 
-        TrustManager[] tms = new TrustManager[]{new RootCACustomTrustManager(remoteAddress, authStrictness, allowExpiredCertificate, certMap, caCertificate, crlDao)};
+        TrustManager[] tms = new TrustManager[]{new RootCACustomTrustManager(remoteAddress, authStrictness, allowExpiredCertificate, certMap, caCertificates, crlDao)};
 
         sslContext.init(kmf.getKeyManagers(), tms, new SecureRandom());
         final SSLEngine sslEngine = sslContext.createSSLEngine();
@@ -316,33 +322,39 @@ private boolean saveNewRootCAKeypair() {
             if (!configDao.update(rootCAPrivateKey.key(), rootCAPrivateKey.category(), CertUtils.privateKeyToPem(keyPair.getPrivate()))) {
                 logger.error("Failed to save RootCA private key");
             }
+            caKeyPair = keyPair;
         } catch (final NoSuchProviderException | NoSuchAlgorithmException | IOException e) {
             logger.error("Failed to generate/save RootCA private/public keys due to exception:", e);
         }
-        return loadRootCAKeyPair();
+        return caKeyPair != null && caKeyPair.getPrivate() != null && caKeyPair.getPublic() != null;
     }
 
-    private boolean saveNewRootCACertificate() {
+    boolean saveNewRootCACertificate() {
         if (caKeyPair == null) {
             throw new CloudRuntimeException("Cannot issue self-signed root CA certificate as CA keypair is not initialized");
         }
         try {
             logger.debug("Generating root CA certificate");
-            final X509Certificate rootCaCertificate = CertUtils.generateV3Certificate(
+            final X509Certificate generatedCACert = CertUtils.generateV3Certificate(
                     null, caKeyPair, caKeyPair.getPublic(),
                     rootCAIssuerDN.value(), CAManager.CertSignatureAlgorithm.value(),
                     getCaValidityDays(), null, null);
-            if (!configDao.update(rootCACertificate.key(), rootCACertificate.category(), CertUtils.x509CertificateToPem(rootCaCertificate))) {
+            if (!configDao.update(rootCACertificate.key(), rootCACertificate.category(), CertUtils.x509CertificateToPem(generatedCACert))) {
                 logger.error("Failed to update RootCA public/x509 certificate");
             }
+            caCertificates = new ArrayList<>(java.util.Collections.singletonList(generatedCACert));
+            caCertificate = generatedCACert;
         } catch (final CertificateException | NoSuchAlgorithmException | NoSuchProviderException | SignatureException | InvalidKeyException | OperatorCreationException | IOException e) {
             logger.error("Failed to generate RootCA certificate from private/public keys due to exception:", e);
             return false;
         }
-        return loadRootCACertificate();
+        return caCertificate != null;
     }
 
     private boolean loadRootCAKeyPair() {
+        if (caKeyPair != null) {
+            return true;
+        }
         if (StringUtils.isAnyEmpty(rootCAPublicKey.value(), rootCAPrivateKey.value())) {
             return false;
         }
@@ -355,14 +367,35 @@ private boolean loadRootCAKeyPair() {
         return caKeyPair.getPrivate() != null && caKeyPair.getPublic() != null;
     }
 
-    private boolean loadRootCACertificate() {
+    boolean loadRootCACertificate() {
+        if (caCertificate != null && CollectionUtils.isNotEmpty(caCertificates)) {
+            return true;
+        }
+        caCertificate = null;
+        caCertificates = null;
         if (StringUtils.isEmpty(rootCACertificate.value())) {
             return false;
         }
         try {
-            caCertificate = CertUtils.pemToX509Certificate(rootCACertificate.value());
-            caCertificate.verify(caKeyPair.getPublic());
-        } catch (final IOException | CertificateException | NoSuchAlgorithmException | InvalidKeyException | SignatureException | NoSuchProviderException e) {
+            final List<X509Certificate> loadedCerts = CertUtils.pemToX509Certificates(rootCACertificate.value());
+            if (CollectionUtils.isEmpty(loadedCerts)) {
+                logger.error("No certificates found in ca.plugin.root.ca.certificate");
+                return false;
+            }
+            final X509Certificate loadedCACert = loadedCerts.get(0);
+
+            // Verify key ownership without enforcing self-signature
+            if (!loadedCACert.getPublicKey().equals(caKeyPair.getPublic())) {
+                logger.error("The public key in the CA certificate does not match the configured CA public key");
+                return false;
+            }
+
+            if (loadedCerts.size() > 1) {
+                logger.info("Loaded CA certificate chain with {} certificate(s)", loadedCerts.size());
+            }
+            caCertificates = loadedCerts;
+            caCertificate = loadedCACert;
+        } catch (final IOException | CertificateException e) {
             logger.error("Failed to load saved RootCA certificate due to exception:", e);
             return false;
         }
@@ -389,9 +422,15 @@ private boolean loadManagementKeyStore() {
         try {
             managementKeyStore = KeyStore.getInstance("JKS");
             managementKeyStore.load(null, null);
-            managementKeyStore.setCertificateEntry(caAlias, caCertificate);
+            int caIndex = 0;
+            for (final X509Certificate cert : caCertificates) {
+                managementKeyStore.setCertificateEntry(caAlias + "-" + caIndex++, cert);
+            }
+            final List<X509Certificate> fullChain = new ArrayList<>();
+            fullChain.add(serverCertificate.getClientCertificate());
+            fullChain.addAll(caCertificates);
             managementKeyStore.setKeyEntry(managementAlias, serverCertificate.getPrivateKey(), getKeyStorePassphrase(),
-                    new X509Certificate[]{serverCertificate.getClientCertificate(), caCertificate});
+                    fullChain.toArray(new X509Certificate[0]));
         } catch (final CertificateException | NoSuchAlgorithmException | KeyStoreException | IOException  e) {
             logger.error("Failed to load root CA management-server keystore due to exception: ", e);
             return false;
@@ -421,14 +460,63 @@ protected void addConfiguredManagementIp(List<String> ipList) {
     }
 
 
+    private static void validatePrivateKeyPem(String value) {
+        if (StringUtils.isEmpty(value)) return;
+        try {
+            CertUtils.pemToPrivateKey(value);
+        } catch (InvalidKeySpecException | IOException e) {
+            throw new IllegalArgumentException(
+                    "ca.plugin.root.private.key is not a valid PEM private key: " + e.getMessage());
+        }
+    }
+
+    private static void validatePublicKeyPem(String value) {
+        if (StringUtils.isEmpty(value)) return;
+        try {
+            CertUtils.pemToPublicKey(value);
+        } catch (InvalidKeySpecException | IOException e) {
+            throw new IllegalArgumentException(
+                    "ca.plugin.root.public.key is not a valid PEM public key: " + e.getMessage());
+        }
+    }
+
+    static void validateCACertificatePem(String value) {
+        if (StringUtils.isEmpty(value)) return;
+        try {
+            final List<X509Certificate> certs = CertUtils.pemToX509Certificates(value);
+            if (CollectionUtils.isEmpty(certs)) {
+                throw new IllegalArgumentException(
+                        "ca.plugin.root.ca.certificate contains no certificates");
+            }
+        } catch (IOException | CertificateException e) {
+            throw new IllegalArgumentException(
+                    "ca.plugin.root.ca.certificate is not a valid PEM certificate: " + e.getMessage());
+        }
+    }
+
     private boolean setupCA() {
-        if (!loadRootCAKeyPair() && !saveNewRootCAKeypair()) {
-            logger.error("Failed to save and load root CA keypair");
-            return false;
+        if (!loadRootCAKeyPair()) {
+            if (hasUserProvidedCAKeys()) {
+                logger.error("Failed to load user-provided CA keys from configuration. " +
+                    "Check that ca.plugin.root.private.key, ca.plugin.root.public.key, and " +
+                    "ca.plugin.root.ca.certificate are all set and in the correct PEM format. " +
+                    "Overwriting with auto-generated keys.");
+            }
+            if (!saveNewRootCAKeypair()) {
+                logger.error("Failed to save and load root CA keypair");
+                return false;
+            }
         }
-        if (!loadRootCACertificate() && !saveNewRootCACertificate()) {
-            logger.error("Failed to save and load root CA certificate");
-            return false;
+        if (!loadRootCACertificate()) {
+            if (hasUserProvidedCAKeys()) {
+                logger.error("Failed to load user-provided CA certificate. " +
+                    "Check that ca.plugin.root.ca.certificate is set and in PEM format. " +
+                    "Overwriting with auto-generated certificate.");
+            }
+            if (!saveNewRootCACertificate()) {
+                logger.error("Failed to save and load root CA certificate");
+                return false;
+            }
         }
         if (!loadManagementKeyStore()) {
             logger.error("Failed to check and configure management server keystore");
@@ -437,10 +525,16 @@ private boolean setupCA() {
         return true;
     }
 
+    private boolean hasUserProvidedCAKeys() {
+        return StringUtils.isNotEmpty(rootCAPublicKey.value())
+            || StringUtils.isNotEmpty(rootCAPrivateKey.value())
+            || StringUtils.isNotEmpty(rootCACertificate.value());
+    }
+
     @Override
     public boolean start() {
         managementCertificateCustomSAN = CAManager.CertManagementCustomSubjectAlternativeName.value();
-        return loadRootCAKeyPair() && loadRootCAKeyPair() && loadManagementKeyStore();
+        return loadRootCAKeyPair() && loadRootCACertificate() && loadManagementKeyStore();
     }
 
     @Override
diff --git a/plugins/ca/root-ca/src/test/java/org/apache/cloudstack/ca/provider/RootCACustomTrustManagerTest.java b/plugins/ca/root-ca/src/test/java/org/apache/cloudstack/ca/provider/RootCACustomTrustManagerTest.java
index d4ded3023321..714e18c3449f 100644
--- a/plugins/ca/root-ca/src/test/java/org/apache/cloudstack/ca/provider/RootCACustomTrustManagerTest.java
+++ b/plugins/ca/root-ca/src/test/java/org/apache/cloudstack/ca/provider/RootCACustomTrustManagerTest.java
@@ -23,9 +23,11 @@
 import java.security.KeyPair;
 import java.security.cert.CertificateException;
 import java.security.cert.X509Certificate;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.List;
 
 import org.apache.cloudstack.utils.security.CertUtils;
 import org.junit.Assert;
@@ -63,14 +65,14 @@ public void setUp() throws Exception {
 
     @Test
     public void testAuthNotStrictWithInvalidCert() throws Exception {
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, true, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, true, certMap, Collections.singletonList(caCertificate), crlDao);
         trustManager.checkClientTrusted(null, null);
     }
 
     @Test
     public void testAuthNotStrictWithRevokedCert() throws Exception {
         Mockito.when(crlDao.findBySerial(Mockito.any(BigInteger.class))).thenReturn(new CrlVO());
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, true, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, true, certMap, Collections.singletonList(caCertificate), crlDao);
         trustManager.checkClientTrusted(new X509Certificate[]{caCertificate}, "RSA");
         Assert.assertTrue(certMap.containsKey(clientIp));
         Assert.assertEquals(certMap.get(clientIp), caCertificate);
@@ -79,7 +81,7 @@ public void testAuthNotStrictWithRevokedCert() throws Exception {
     @Test
     public void testAuthNotStrictWithInvalidCertOwnership() throws Exception {
         Mockito.when(crlDao.findBySerial(Mockito.any(BigInteger.class))).thenReturn(null);
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, true, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, true, certMap, Collections.singletonList(caCertificate), crlDao);
         trustManager.checkClientTrusted(new X509Certificate[]{caCertificate}, "RSA");
         Assert.assertTrue(certMap.containsKey(clientIp));
         Assert.assertEquals(certMap.get(clientIp), caCertificate);
@@ -88,14 +90,14 @@ public void testAuthNotStrictWithInvalidCertOwnership() throws Exception {
     @Test(expected = CertificateException.class)
     public void testAuthNotStrictWithDenyExpiredCertAndOwnership() throws Exception {
         Mockito.when(crlDao.findBySerial(Mockito.any(BigInteger.class))).thenReturn(null);
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, false, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, false, certMap, Collections.singletonList(caCertificate), crlDao);
         trustManager.checkClientTrusted(new X509Certificate[]{expiredClientCertificate}, "RSA");
     }
 
     @Test
     public void testAuthNotStrictWithAllowExpiredCertAndOwnership() throws Exception {
         Mockito.when(crlDao.findBySerial(Mockito.any(BigInteger.class))).thenReturn(null);
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, true, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, false, true, certMap, Collections.singletonList(caCertificate), crlDao);
         trustManager.checkClientTrusted(new X509Certificate[]{expiredClientCertificate}, "RSA");
         Assert.assertTrue(certMap.containsKey(clientIp));
         Assert.assertEquals(certMap.get(clientIp), expiredClientCertificate);
@@ -103,35 +105,50 @@ public void testAuthNotStrictWithAllowExpiredCertAndOwnership() throws Exception
 
     @Test(expected = CertificateException.class)
     public void testAuthStrictWithInvalidCert() throws Exception {
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, true, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, true, certMap, Collections.singletonList(caCertificate), crlDao);
         trustManager.checkClientTrusted(null, null);
     }
 
     @Test(expected = CertificateException.class)
     public void testAuthStrictWithRevokedCert() throws Exception {
         Mockito.when(crlDao.findBySerial(Mockito.any(BigInteger.class))).thenReturn(new CrlVO());
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, true, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, true, certMap, Collections.singletonList(caCertificate), crlDao);
         trustManager.checkClientTrusted(new X509Certificate[]{caCertificate}, "RSA");
     }
 
     @Test(expected = CertificateException.class)
     public void testAuthStrictWithInvalidCertOwnership() throws Exception {
         Mockito.when(crlDao.findBySerial(Mockito.any(BigInteger.class))).thenReturn(null);
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, true, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, true, certMap, Collections.singletonList(caCertificate), crlDao);
         trustManager.checkClientTrusted(new X509Certificate[]{caCertificate}, "RSA");
     }
 
     @Test(expected = CertificateException.class)
     public void testAuthStrictWithDenyExpiredCertAndOwnership() throws Exception {
         Mockito.when(crlDao.findBySerial(Mockito.any(BigInteger.class))).thenReturn(null);
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, false, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, false, certMap, Collections.singletonList(caCertificate), crlDao);
         trustManager.checkClientTrusted(new X509Certificate[]{expiredClientCertificate}, "RSA");
     }
 
+    @Test
+    public void testGetAcceptedIssuersWithChain() throws Exception {
+        final KeyPair rootKeyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate rootCert = CertUtils.generateV3Certificate(null, rootKeyPair, rootKeyPair.getPublic(),
+                "CN=root", "SHA256withRSA", 365, null, null);
+        final List<X509Certificate> chain = Arrays.asList(caCertificate, rootCert);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(
+                clientIp, false, true, certMap, chain, crlDao);
+
+        final X509Certificate[] issuers = trustManager.getAcceptedIssuers();
+        Assert.assertEquals(2, issuers.length);
+        Assert.assertEquals(caCertificate, issuers[0]);
+        Assert.assertEquals(rootCert, issuers[1]);
+    }
+
     @Test
     public void testAuthStrictWithAllowExpiredCertAndOwnership() throws Exception {
         Mockito.when(crlDao.findBySerial(Mockito.any(BigInteger.class))).thenReturn(null);
-        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, true, certMap, caCertificate, crlDao);
+        final RootCACustomTrustManager trustManager = new RootCACustomTrustManager(clientIp, true, true, certMap, Collections.singletonList(caCertificate), crlDao);
         Assert.assertTrue(trustManager.getAcceptedIssuers() != null);
         Assert.assertTrue(trustManager.getAcceptedIssuers().length == 1);
         Assert.assertEquals(trustManager.getAcceptedIssuers()[0], caCertificate);
diff --git a/plugins/ca/root-ca/src/test/java/org/apache/cloudstack/ca/provider/RootCAProviderTest.java b/plugins/ca/root-ca/src/test/java/org/apache/cloudstack/ca/provider/RootCAProviderTest.java
index 8311f4d45abc..21f00c66a1df 100644
--- a/plugins/ca/root-ca/src/test/java/org/apache/cloudstack/ca/provider/RootCAProviderTest.java
+++ b/plugins/ca/root-ca/src/test/java/org/apache/cloudstack/ca/provider/RootCAProviderTest.java
@@ -31,6 +31,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collection;
+import java.util.Collections;
 import java.util.List;
 import java.util.UUID;
 
@@ -38,6 +39,7 @@
 
 import org.apache.cloudstack.framework.ca.Certificate;
 import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.utils.security.CertUtils;
 import org.apache.cloudstack.utils.security.SSLUtils;
 import org.bouncycastle.asn1.x509.GeneralName;
@@ -49,7 +51,6 @@
 import org.junit.runner.RunWith;
 import org.mockito.Mockito;
 import org.mockito.junit.MockitoJUnitRunner;
-import org.springframework.test.util.ReflectionTestUtils;
 
 
 @RunWith(MockitoJUnitRunner.class)
@@ -75,7 +76,7 @@ public void setUp() throws Exception {
 
         addField(provider, "caKeyPair", caKeyPair);
         addField(provider, "caCertificate", caCertificate);
-        addField(provider, "caKeyPair", caKeyPair);
+        addField(provider, "caCertificates", Collections.singletonList(caCertificate));
     }
 
     @After
@@ -129,6 +130,46 @@ public void testIssueCertificateWithCsr() throws NoSuchProviderException, Certif
         certificate.getClientCertificate().verify(caCertificate.getPublicKey());
     }
 
+    @Test
+    public void testGetCaCertificateWithChain() throws Exception {
+        final KeyPair rootKeyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate rootCert = CertUtils.generateV3Certificate(null, rootKeyPair, rootKeyPair.getPublic(),
+                "CN=root", "SHA256withRSA", 365, null, null);
+        final KeyPair intermediateKeyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate intermediateCert = CertUtils.generateV3Certificate(rootCert, rootKeyPair,
+                intermediateKeyPair.getPublic(), "CN=intermediate", "SHA256withRSA", 365, null, null);
+
+        final List<X509Certificate> chain = Arrays.asList(intermediateCert, rootCert);
+        addField(provider, "caKeyPair", intermediateKeyPair);
+        addField(provider, "caCertificate", intermediateCert);
+        addField(provider, "caCertificates", chain);
+
+        Assert.assertEquals(2, provider.getCaCertificate().size());
+        Assert.assertEquals(intermediateCert, provider.getCaCertificate().get(0));
+        Assert.assertEquals(rootCert, provider.getCaCertificate().get(1));
+    }
+
+    @Test
+    public void testIssueCertificateWithoutCsrAndChain() throws Exception {
+        final KeyPair rootKeyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate rootCert = CertUtils.generateV3Certificate(null, rootKeyPair, rootKeyPair.getPublic(),
+                "CN=root", "SHA256withRSA", 365, null, null);
+        final KeyPair intermediateKeyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate intermediateCert = CertUtils.generateV3Certificate(rootCert, rootKeyPair,
+                intermediateKeyPair.getPublic(), "CN=intermediate", "SHA256withRSA", 365, null, null);
+
+        addField(provider, "caKeyPair", intermediateKeyPair);
+        addField(provider, "caCertificate", intermediateCert);
+        addField(provider, "caCertificates", Arrays.asList(intermediateCert, rootCert));
+
+        final Certificate certificate = provider.issueCertificate(Arrays.asList("domain1.com"), null, 1);
+        Assert.assertNotNull(certificate);
+        Assert.assertEquals(2, certificate.getCaCertificates().size());
+        Assert.assertEquals(intermediateCert, certificate.getCaCertificates().get(0));
+        Assert.assertEquals(rootCert, certificate.getCaCertificates().get(1));
+        certificate.getClientCertificate().verify(intermediateKeyPair.getPublic());
+    }
+
     @Test
     public void testRevokeCertificate() throws Exception {
         Assert.assertTrue(provider.revokeCertificate(CertUtils.generateRandomBigInt(), "anyString"));
@@ -177,8 +218,8 @@ public void testIsManagementCertificateNoAltNames() {
     }
 
     @Test
-    public void testIsManagementCertificateNoMatch() {
-        ReflectionTestUtils.setField(provider, "managementCertificateCustomSAN", "cloudstack");
+    public void testIsManagementCertificateNoMatch() throws Exception {
+        addField(provider, "managementCertificateCustomSAN", "cloudstack");
         try {
             X509Certificate certificate = Mockito.mock(X509Certificate.class);
             List<List<?>> altNames = new ArrayList<>();
@@ -193,9 +234,9 @@ public void testIsManagementCertificateNoMatch() {
     }
 
     @Test
-    public void testIsManagementCertificateMatch() {
+    public void testIsManagementCertificateMatch() throws Exception {
         String customSAN = "cloudstack";
-        ReflectionTestUtils.setField(provider, "managementCertificateCustomSAN", customSAN);
+        addField(provider, "managementCertificateCustomSAN", customSAN);
         try {
             X509Certificate certificate = Mockito.mock(X509Certificate.class);
             List<List<?>> altNames = new ArrayList<>();
@@ -208,4 +249,58 @@ public void testIsManagementCertificateMatch() {
             Assert.fail(String.format("Exception occurred: %s", e.getMessage()));
         }
     }
+
+    @Test
+    public void testLoadRootCACertificateWithMismatchedCert() throws Exception {
+        KeyPair otherKeyPair = CertUtils.generateRandomKeyPair(1024);
+        X509Certificate mismatchedCert = CertUtils.generateV3Certificate(null, otherKeyPair, otherKeyPair.getPublic(), "CN=other", "SHA256withRSA", 365, null, null);
+        String mismatchedPem = CertUtils.x509CertificateToPem(mismatchedCert);
+
+        ConfigKey<String> mockCertKey = Mockito.mock(ConfigKey.class);
+        Mockito.when(mockCertKey.value()).thenReturn(mismatchedPem);
+        addField(provider, "rootCACertificate", mockCertKey);
+
+        addField(provider, "caCertificate", null);
+        addField(provider, "caCertificates", null);
+
+        Boolean result = provider.loadRootCACertificate();
+        Assert.assertFalse(result);
+        Assert.assertNull(provider.getCaCertificate());
+    }
+
+    @Test
+    public void testSaveNewRootCACertificateWithStaleCache() throws Exception {
+        ConfigurationDao configDao = Mockito.mock(ConfigurationDao.class);
+        addField(provider, "configDao", configDao);
+
+        ConfigKey<String> mockCertKey = Mockito.mock(ConfigKey.class);
+        Mockito.when(mockCertKey.key()).thenReturn("ca.plugin.root.ca.certificate");
+        Mockito.when(mockCertKey.category()).thenReturn("Hidden");
+        addField(provider, "rootCACertificate", mockCertKey);
+
+        ConfigKey<String> mockIssuerKey = Mockito.mock(ConfigKey.class);
+        Mockito.when(mockIssuerKey.value()).thenReturn("CN=ca.cloudstack.apache.org");
+        addField(provider, "rootCAIssuerDN", mockIssuerKey);
+
+        addField(provider, "caCertificate", null);
+        addField(provider, "caCertificates", null);
+
+        Mockito.when(configDao.update(Mockito.anyString(), Mockito.anyString(), Mockito.anyString())).thenReturn(true);
+
+        Boolean result = provider.saveNewRootCACertificate();
+        Assert.assertTrue(result);
+        Assert.assertNotNull(provider.getCaCertificate());
+        Assert.assertEquals(1, provider.getCaCertificate().size());
+    }
+
+    @Test
+    public void testValidateCACertificatePem() throws Exception {
+        String truncatedPem = "-----BEGIN CERTIFICATE-----\nMIICxTCCAa0CAQAw\n";
+        try {
+            RootCAProvider.validateCACertificatePem(truncatedPem);
+            Assert.fail("Expected IllegalArgumentException");
+        } catch (IllegalArgumentException e) {
+            Assert.assertTrue(e.getMessage().contains("is not a valid PEM certificate"));
+        }
+    }
 }
diff --git a/plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/WebhookDeliveryThread.java b/plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/WebhookDeliveryThread.java
index ac840c00be32..3f2d85458d30 100644
--- a/plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/WebhookDeliveryThread.java
+++ b/plugins/event-bus/webhook/src/main/java/org/apache/cloudstack/mom/webhook/WebhookDeliveryThread.java
@@ -48,6 +48,8 @@
 import org.apache.http.client.config.RequestConfig;
 import org.apache.http.client.methods.CloseableHttpResponse;
 import org.apache.http.client.methods.HttpPost;
+import javax.net.ssl.SSLContext;
+
 import org.apache.http.conn.ssl.NoopHostnameVerifier;
 import org.apache.http.conn.ssl.TrustAllStrategy;
 import org.apache.http.entity.ContentType;
@@ -97,7 +99,9 @@ protected boolean isValidJson(String json) {
 
     protected void setHttpClient() throws NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
         if (webhook.isSslVerification()) {
-            httpClient = HttpClients.createDefault();
+            httpClient = HttpClients.custom()
+                    .setSSLContext(SSLContext.getDefault())
+                    .build();
             return;
         }
         httpClient = HttpClients
diff --git a/scripts/util/keystore-cert-import b/scripts/util/keystore-cert-import
index a9465f273a3d..cf355e098454 100755
--- a/scripts/util/keystore-cert-import
+++ b/scripts/util/keystore-cert-import
@@ -70,8 +70,8 @@ elif [ ! -f "$CACERT_FILE" ]; then
 fi
 
 # Import cacerts into the keystore
-awk '/-----BEGIN CERTIFICATE-----?/{n++}{print > "cloudca." n }' "$CACERT_FILE"
-for caChain in $(ls cloudca.*); do
+awk 'BEGIN{n=0} /-----BEGIN CERTIFICATE-----/{n++} n>0{print > "cloudca." n }' "$CACERT_FILE"
+for caChain in $(ls cloudca.* 2>/dev/null); do
     keytool -delete -noprompt -alias "$caChain" -keystore "$KS_FILE" -storepass "$KS_PASS" > /dev/null 2>&1 || true
     keytool -import -noprompt -storepass "$KS_PASS" -trustcacerts -alias "$caChain" -file "$caChain" -keystore "$KS_FILE" > /dev/null 2>&1
 done
@@ -137,6 +137,22 @@ if [ -f "$SYSTEM_FILE" ]; then
     chmod 644 /usr/local/share/ca-certificates/cloudstack/ca.crt
     update-ca-certificates > /dev/null 2>&1 || true
 
+    # Import CA cert(s) into realhostip.keystore so the SSVM JVM
+    # (which overrides the truststore via -Djavax.net.ssl.trustStore in _run.sh)
+    # can trust servers signed by the CloudStack CA
+    REALHOSTIP_KS_FILE="$(dirname "$(dirname "$PROPS_FILE")")/certs/realhostip.keystore"
+    REALHOSTIP_PASS="vmops.com"
+    if [ -f "$REALHOSTIP_KS_FILE" ]; then
+        awk 'BEGIN{n=0} /-----BEGIN CERTIFICATE-----/{n++} n>0{print > "cloudca." n }' "$CACERT_FILE"
+        for caChain in $(ls cloudca.* 2>/dev/null); do
+            keytool -delete -noprompt -alias "$caChain" -keystore "$REALHOSTIP_KS_FILE" \
+                -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1 || true
+            keytool -import -noprompt -trustcacerts -alias "$caChain" -file "$caChain" \
+                -keystore "$REALHOSTIP_KS_FILE" -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1
+        done
+        rm -f cloudca.*
+    fi
+
     # Ensure cloud service is running in systemvm
     if [ "$MODE" == "ssh" ]; then
         systemctl start cloud > /dev/null 2>&1
diff --git a/server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java b/server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
index efda72555e2c..b9fa3f0ebae7 100644
--- a/server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
+++ b/server/src/main/java/com/cloud/hypervisor/kvm/discoverer/LibvirtServerDiscoverer.java
@@ -21,7 +21,6 @@
 import java.net.InetAddress;
 import java.net.URI;
 import java.util.Arrays;
-import java.util.Collections;
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
@@ -32,11 +31,8 @@
 
 import org.apache.cloudstack.agent.lb.IndirectAgentLB;
 import org.apache.cloudstack.ca.CAManager;
-import org.apache.cloudstack.ca.SetupCertificateCommand;
 import org.apache.cloudstack.direct.download.DirectDownloadManager;
-import org.apache.cloudstack.framework.ca.Certificate;
 import org.apache.cloudstack.utils.cache.LazyCache;
-import org.apache.cloudstack.utils.security.KeyStoreUtils;
 
 import com.cloud.agent.AgentManager;
 import com.cloud.agent.Listener;
@@ -66,7 +62,6 @@
 import com.cloud.resource.ResourceStateAdapter;
 import com.cloud.resource.ServerResource;
 import com.cloud.resource.UnableDeleteHostException;
-import com.cloud.utils.PasswordGenerator;
 import com.cloud.utils.StringUtils;
 import com.cloud.utils.UuidUtils;
 import com.cloud.utils.exception.CloudRuntimeException;
@@ -174,55 +169,7 @@ private void setupAgentSecurity(final Connection sshConnection, final String age
             throw new CloudRuntimeException("Cannot secure agent communication because SSH connection is invalid for host IP=" + agentIp);
         }
 
-        Integer validityPeriod = CAManager.CertValidityPeriod.value();
-        if (validityPeriod < 1) {
-            validityPeriod = 1;
-        }
-
-        String keystorePassword = PasswordGenerator.generateRandomPassword(16);
-        final SSHCmdHelper.SSHCmdResult keystoreSetupResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
-                String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
-                                "/etc/cloudstack/agent/agent.properties " +
-                                "/etc/cloudstack/agent/%s " +
-                                "%s %d " +
-                                "/etc/cloudstack/agent/%s",
-                        KeyStoreUtils.KS_SETUP_SCRIPT,
-                        KeyStoreUtils.KS_FILENAME,
-                        keystorePassword,
-                        validityPeriod,
-                        KeyStoreUtils.CSR_FILENAME));
-
-        if (!keystoreSetupResult.isSuccess()) {
-            throw new CloudRuntimeException("Failed to setup keystore on the KVM host: " + agentIp);
-        }
-
-        final Certificate certificate = caManager.issueCertificate(keystoreSetupResult.getStdOut(), Arrays.asList(agentHostname, agentIp), Collections.singletonList(agentIp), null, null);
-        if (certificate == null || certificate.getClientCertificate() == null) {
-            throw new CloudRuntimeException("Failed to issue certificates for KVM host agent: " + agentIp);
-        }
-
-        final SetupCertificateCommand certificateCommand = new SetupCertificateCommand(certificate);
-        final SSHCmdHelper.SSHCmdResult setupCertResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
-                String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
-                                "/etc/cloudstack/agent/agent.properties %s " +
-                                "/etc/cloudstack/agent/%s %s " +
-                                "/etc/cloudstack/agent/%s \"%s\" " +
-                                "/etc/cloudstack/agent/%s \"%s\" " +
-                                "/etc/cloudstack/agent/%s \"%s\"",
-                        KeyStoreUtils.KS_IMPORT_SCRIPT,
-                        keystorePassword,
-                        KeyStoreUtils.KS_FILENAME,
-                        KeyStoreUtils.SSH_MODE,
-                        KeyStoreUtils.CERT_FILENAME,
-                        certificateCommand.getEncodedCertificate(),
-                        KeyStoreUtils.CACERT_FILENAME,
-                        certificateCommand.getEncodedCaCertificates(),
-                        KeyStoreUtils.PKEY_FILENAME,
-                        certificateCommand.getEncodedPrivateKey()));
-
-        if (setupCertResult != null && !setupCertResult.isSuccess()) {
-            throw new CloudRuntimeException("Failed to setup certificate in the KVM agent's keystore file, please see logs and configure manually!");
-        }
+        caManager.provisionCertificateViaSsh(sshConnection, agentIp, agentHostname, null);
 
         if (logger.isDebugEnabled()) {
             logger.debug("Succeeded to import certificate in the keystore for agent on the KVM host: " + agentIp + ". Agent secured and trusted.");
diff --git a/server/src/main/java/org/apache/cloudstack/ca/CAManagerImpl.java b/server/src/main/java/org/apache/cloudstack/ca/CAManagerImpl.java
index 2b4e7ddc9d41..73ff79301fb7 100644
--- a/server/src/main/java/org/apache/cloudstack/ca/CAManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/ca/CAManagerImpl.java
@@ -22,12 +22,14 @@
 import java.security.GeneralSecurityException;
 import java.security.KeyStore;
 import java.security.KeyStoreException;
+import java.security.SecureRandom;
 import java.security.cert.CertificateExpiredException;
 import java.security.cert.CertificateNotYetValidException;
 import java.security.cert.CertificateParsingException;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.Iterator;
@@ -39,6 +41,21 @@
 import javax.naming.ConfigurationException;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLEngine;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
+import javax.net.ssl.X509TrustManager;
+
+import com.trilead.ssh2.Connection;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
+import com.cloud.host.HostVO;
+import com.cloud.utils.PasswordGenerator;
+import com.cloud.utils.ssh.SSHCmdHelper;
+import com.cloud.vm.VMInstanceVO;
+import com.cloud.vm.dao.VMInstanceDao;
+import org.apache.cloudstack.utils.security.KeyStoreUtils;
+import org.apache.commons.lang3.math.NumberUtils;
 
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.ServerApiException;
@@ -60,6 +77,7 @@
 import org.joda.time.DateTimeZone;
 
 import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.routing.NetworkElementCommand;
 import com.cloud.alert.AlertManager;
 import com.cloud.certificate.CrlVO;
 import com.cloud.certificate.dao.CrlDao;
@@ -81,6 +99,12 @@ public class CAManagerImpl extends ManagerBase implements CAManager {
     @Inject
     private HostDao hostDao;
     @Inject
+    private VMInstanceDao vmInstanceDao;
+    @Inject
+    private NetworkOrchestrationService networkOrchestrationService;
+    @Inject
+    private ConfigurationDao configDao;
+    @Inject
     private AgentManager agentManager;
     @Inject
     private BackgroundPollManager backgroundPollManager;
@@ -177,12 +201,17 @@ public boolean revokeCertificate(final BigInteger certSerial, final String certC
 
     @Override
     @ActionEvent(eventType = EventTypes.EVENT_CA_CERTIFICATE_PROVISION, eventDescription = "provisioning certificate for host", async = true)
-    public boolean provisionCertificate(final Host host, final Boolean reconnect, final String caProvider) {
+    public boolean provisionCertificate(final Host host, final Boolean reconnect, final String caProvider, final boolean forced) {
         if (host == null) {
             throw new CloudRuntimeException("Unable to find valid host to renew certificate for");
         }
         CallContext.current().setEventDetails("Host ID: " + host.getUuid());
         CallContext.current().putContextParameter(Host.class, host.getUuid());
+
+        if (forced) {
+            return provisionCertificateForced(host, reconnect, caProvider);
+        }
+
         String csr = null;
 
         try {
@@ -200,6 +229,141 @@ public boolean provisionCertificate(final Host host, final Boolean reconnect, fi
         }
     }
 
+    protected boolean provisionCertificateForced(Host host, Boolean reconnect, String caProvider) {
+        if (host.getType() == Host.Type.Routing && host.getHypervisorType() == com.cloud.hypervisor.Hypervisor.HypervisorType.KVM) {
+            return provisionKvmHostViaSsh(host, caProvider);
+        } else if (host.getType() == Host.Type.ConsoleProxy || host.getType() == Host.Type.SecondaryStorageVM) {
+            return provisionSystemVmViaSsh(host, reconnect, caProvider);
+        }
+        throw new CloudRuntimeException("Forced certificate provisioning is only supported for KVM hosts and SystemVMs.");
+    }
+
+    @Override
+    public void provisionCertificateViaSsh(final Connection sshConnection, final String agentIp, final String agentHostname, final String caProvider) {
+        Integer validityPeriod = CAManager.CertValidityPeriod.value();
+        if (validityPeriod < 1) {
+            validityPeriod = 1;
+        }
+
+        String keystorePassword = PasswordGenerator.generateRandomPassword(16);
+
+        // 1. Setup Keystore and Generate CSR
+        final SSHCmdHelper.SSHCmdResult keystoreSetupResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
+                String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
+                              "/etc/cloudstack/agent/agent.properties " +
+                              "/etc/cloudstack/agent/%s " +
+                              "%s %d " +
+                              "/etc/cloudstack/agent/%s",
+                        KeyStoreUtils.KS_SETUP_SCRIPT,
+                        KeyStoreUtils.KS_FILENAME,
+                        keystorePassword,
+                        validityPeriod,
+                        KeyStoreUtils.CSR_FILENAME));
+
+        if (!keystoreSetupResult.isSuccess()) {
+            throw new CloudRuntimeException("Failed to setup keystore and generate CSR via SSH on host: " + agentIp);
+        }
+
+        // 2. Issue Certificate based on returned CSR
+        final String csr = keystoreSetupResult.getStdOut();
+        final Certificate certificate = issueCertificate(csr, Arrays.asList(agentHostname, agentIp),
+                Collections.singletonList(agentIp), null, caProvider);
+
+        if (certificate == null || certificate.getClientCertificate() == null) {
+            throw new CloudRuntimeException("Failed to issue certificates for host: " + agentIp);
+        }
+
+        // 3. Import Certificate into agent keystore
+        final SetupCertificateCommand certificateCommand = new SetupCertificateCommand(certificate);
+        final SSHCmdHelper.SSHCmdResult setupCertResult = SSHCmdHelper.sshExecuteCmdWithResult(sshConnection,
+                String.format("sudo /usr/share/cloudstack-common/scripts/util/%s " +
+                              "/etc/cloudstack/agent/agent.properties %s " +
+                              "/etc/cloudstack/agent/%s %s " +
+                              "/etc/cloudstack/agent/%s \"%s\" " +
+                              "/etc/cloudstack/agent/%s \"%s\" " +
+                              "/etc/cloudstack/agent/%s \"%s\"",
+                        KeyStoreUtils.KS_IMPORT_SCRIPT,
+                        keystorePassword,
+                        KeyStoreUtils.KS_FILENAME,
+                        KeyStoreUtils.SSH_MODE,
+                        KeyStoreUtils.CERT_FILENAME,
+                        certificateCommand.getEncodedCertificate(),
+                        KeyStoreUtils.CACERT_FILENAME,
+                        certificateCommand.getEncodedCaCertificates(),
+                        KeyStoreUtils.PKEY_FILENAME,
+                        certificateCommand.getEncodedPrivateKey()));
+
+        if (!setupCertResult.isSuccess()) {
+            throw new CloudRuntimeException("Failed to import certificates into agent keystore via SSH on host: " + agentIp);
+        }
+    }
+
+    private boolean provisionKvmHostViaSsh(Host host, String caProvider) {
+        final HostVO hostVO = (HostVO) host;
+        hostDao.loadDetails(hostVO);
+        String username = hostVO.getDetail(ApiConstants.USERNAME);
+        String password = hostVO.getDetail(ApiConstants.PASSWORD);
+        String hostIp = host.getPrivateIpAddress();
+
+        int port = AgentManager.KVMHostDiscoverySshPort.valueIn(host.getClusterId());
+        if (hostVO.getDetail(Host.HOST_SSH_PORT) != null) {
+            port = NumberUtils.toInt(hostVO.getDetail(Host.HOST_SSH_PORT), port);
+        }
+
+        Connection sshConnection = null;
+        try {
+            sshConnection = new Connection(hostIp, port);
+            sshConnection.connect(null, 60000, 60000);
+
+            String privateKey = configDao.getValue("ssh.privatekey");
+            if (!SSHCmdHelper.acquireAuthorizedConnectionWithPublicKey(sshConnection, username, privateKey)) {
+                if (StringUtils.isEmpty(password) || !sshConnection.authenticateWithPassword(username, password)) {
+                    throw new CloudRuntimeException("Failed to authenticate to host via SSH for forced provisioning: " + hostIp);
+                }
+            }
+
+            provisionCertificateViaSsh(sshConnection, hostIp, host.getName(), caProvider);
+
+            String sudoPrefix = "root".equals(username) ? "" : "sudo ";
+            SSHCmdHelper.sshExecuteCmd(sshConnection, sudoPrefix + "systemctl restart libvirtd");
+            SSHCmdHelper.sshExecuteCmd(sshConnection, sudoPrefix + "systemctl restart cloudstack-agent");
+
+            return true;
+        } catch (Exception e) {
+            logger.error("Error during forced SSH provisioning for KVM host " + host.getUuid(), e);
+            return false;
+        } finally {
+            if (sshConnection != null) {
+                sshConnection.close();
+            }
+        }
+    }
+
+    private boolean provisionSystemVmViaSsh(Host host, Boolean reconnect, String caProvider) {
+        VMInstanceVO vm = vmInstanceDao.findVMByInstanceName(host.getName());
+        if (vm == null) {
+            throw new CloudRuntimeException("Cannot find underlying VM for host: " + host.getName());
+        }
+
+        final Map<String, String> sshAccessDetails = networkOrchestrationService.getSystemVMAccessDetails(vm);
+        final Map<String, String> ipAddressDetails = new HashMap<>(sshAccessDetails);
+        ipAddressDetails.remove(NetworkElementCommand.ROUTER_NAME);
+
+        try {
+            final Host hypervisorHost = hostDao.findById(vm.getHostId());
+            if (hypervisorHost == null) {
+                throw new CloudRuntimeException("Cannot find hypervisor host for system VM: " + host.getName());
+            }
+
+            final Certificate certificate = issueCertificate(null, Arrays.asList(vm.getHostName(), vm.getInstanceName()),
+                    new ArrayList<>(ipAddressDetails.values()), CertValidityPeriod.value(), caProvider);
+            return deployCertificate(hypervisorHost, certificate, reconnect, sshAccessDetails);
+        } catch (Exception e) {
+            logger.error("Failed to provision system VM " + host.getName() + " via hypervisor SSH proxy. Ensure the hypervisor host is connected.", e);
+            return false;
+        }
+    }
+
     @Override
     public String generateKeyStoreAndCsr(final Host host, final Map<String, String> sshAccessDetails) throws AgentUnavailableException, OperationTimedoutException {
         final SetupKeyStoreCommand cmd = new SetupKeyStoreCommand(CertValidityPeriod.value());
@@ -211,11 +375,6 @@ public String generateKeyStoreAndCsr(final Host host, final Map<String, String>
         return answer.getCsr();
     }
 
-    private boolean isValidSystemVMType(Host.Type type) {
-        return Host.Type.SecondaryStorageVM.equals(type) ||
-                Host.Type.ConsoleProxy.equals(type);
-    }
-
     @Override
     public boolean deployCertificate(final Host host, final Certificate certificate, final Boolean reconnect, final Map<String, String> sshAccessDetails)
             throws AgentUnavailableException, OperationTimedoutException {
@@ -340,7 +499,7 @@ protected void runInContext() {
                         if (AutomaticCertRenewal.valueIn(host.getClusterId())) {
                             try {
                                 logger.debug("Attempting certificate auto-renewal for " + hostDescription, e);
-                                boolean result = caManager.provisionCertificate(host, false, null);
+                                boolean result = caManager.provisionCertificate(host, false, null, false);
                                 if (result) {
                                     logger.debug("Succeeded in auto-renewing certificate for " + hostDescription, e);
                                 } else {
@@ -400,9 +559,57 @@ public boolean start() {
             logger.error("Failed to find valid configured CA provider, please check!");
             return false;
         }
+        if (CaInjectDefaultTruststore.value()) {
+            injectCaCertIntoDefaultTruststore();
+        }
         return true;
     }
 
+    private void injectCaCertIntoDefaultTruststore() {
+        try {
+            final List<X509Certificate> caCerts = configuredCaProvider.getCaCertificate();
+            if (caCerts == null || caCerts.isEmpty()) {
+                logger.debug("No CA certificates found from the configured provider, skipping JVM truststore injection");
+                return;
+            }
+
+            final KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
+            trustStore.load(null, null);
+
+            // Copy existing default trusted certs
+            final TrustManagerFactory defaultTmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+            defaultTmf.init((KeyStore) null);
+            int aliasIndex = 0;
+            for (final TrustManager tm : defaultTmf.getTrustManagers()) {
+                if (tm instanceof X509TrustManager) {
+                    for (final X509Certificate cert : ((X509TrustManager) tm).getAcceptedIssuers()) {
+                        trustStore.setCertificateEntry("default-ca-" + aliasIndex++, cert);
+                    }
+                }
+            }
+
+            // Add CA provider's certificates
+            int count = 0;
+            for (final X509Certificate caCert : caCerts) {
+                final String alias = "cloudstack-ca-" + count;
+                trustStore.setCertificateEntry(alias, caCert);
+                count++;
+                logger.info("Injected CA certificate into JVM default truststore: subject={}, alias={}",
+                    caCert.getSubjectX500Principal().getName(), alias);
+            }
+
+            // Reinitialize default SSLContext with the updated truststore
+            final TrustManagerFactory updatedTmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
+            updatedTmf.init(trustStore);
+            final SSLContext sslContext = SSLContext.getInstance("TLS");
+            sslContext.init(null, updatedTmf.getTrustManagers(), new SecureRandom());
+            SSLContext.setDefault(sslContext);
+            logger.info("Successfully injected {} CA certificate(s) into JVM default truststore", count);
+        } catch (final GeneralSecurityException | IOException e) {
+            logger.error("Failed to inject CA certificate into JVM default truststore", e);
+        }
+    }
+
     @Override
     public boolean configure(final String name, final Map<String, Object> params) throws ConfigurationException {
         backgroundPollManager.submitTask(new CABackgroundTask(this, hostDao));
@@ -433,7 +640,7 @@ public String getConfigComponentName() {
     public ConfigKey<?>[] getConfigKeys() {
         return new ConfigKey<?>[] {CAProviderPlugin, CertKeySize, CertSignatureAlgorithm, CertValidityPeriod,
                 AutomaticCertRenewal, AllowHostIPInSysVMAgentCert, CABackgroundJobDelay, CertExpiryAlertPeriod,
-                CertManagementCustomSubjectAlternativeName
+                CertManagementCustomSubjectAlternativeName, CaInjectDefaultTruststore
         };
     }
 
diff --git a/server/src/test/java/org/apache/cloudstack/ca/CABackgroundTaskTest.java b/server/src/test/java/org/apache/cloudstack/ca/CABackgroundTaskTest.java
index 691bd882c078..7717e6427662 100644
--- a/server/src/test/java/org/apache/cloudstack/ca/CABackgroundTaskTest.java
+++ b/server/src/test/java/org/apache/cloudstack/ca/CABackgroundTaskTest.java
@@ -115,19 +115,19 @@ public void testAutoRenewalEnabledWithNoExceptionsOnProvisioning() throws Except
         certMap.put(hostIp, expiredCertificate);
         Assume.assumeThat(certMap.size() == 1, is(true));
         task.runInContext();
-        Mockito.verify(caManager, Mockito.times(1)).provisionCertificate(host, false, null);
+        Mockito.verify(caManager, Mockito.times(1)).provisionCertificate(host, false, null, false);
         Mockito.verify(caManager, Mockito.times(0)).sendAlert(Mockito.any(Host.class), Mockito.anyString(), Mockito.anyString());
     }
 
     @Test
     public void testAutoRenewalEnabledWithExceptionsOnProvisioning() throws Exception {
         overrideDefaultConfigValue(AutomaticCertRenewal, "_defaultValue", "true");
-        Mockito.when(caManager.provisionCertificate(any(Host.class), anyBoolean(), nullable(String.class))).thenThrow(new CloudRuntimeException("some error"));
+        Mockito.when(caManager.provisionCertificate(any(Host.class), anyBoolean(), nullable(String.class), anyBoolean())).thenThrow(new CloudRuntimeException("some error"));
         host.setManagementServerId(ManagementServerNode.getManagementServerId());
         certMap.put(hostIp, expiredCertificate);
         Assume.assumeThat(certMap.size() == 1, is(true));
         task.runInContext();
-        Mockito.verify(caManager, Mockito.times(1)).provisionCertificate(host, false, null);
+        Mockito.verify(caManager, Mockito.times(1)).provisionCertificate(host, false, null, false);
         Mockito.verify(caManager, Mockito.times(1)).sendAlert(Mockito.any(Host.class), Mockito.anyString(), Mockito.anyString());
     }
 
@@ -138,12 +138,12 @@ public void testAutoRenewalDisabled() throws Exception {
         Assume.assumeThat(certMap.size() == 1, is(true));
         // First round
         task.runInContext();
-        Mockito.verify(caManager, Mockito.times(0)).provisionCertificate(Mockito.any(Host.class), anyBoolean(), Mockito.anyString());
+        Mockito.verify(caManager, Mockito.times(0)).provisionCertificate(Mockito.any(Host.class), anyBoolean(), Mockito.anyString(), Mockito.anyBoolean());
         Mockito.verify(caManager, Mockito.times(1)).sendAlert(Mockito.any(Host.class), Mockito.anyString(), Mockito.anyString());
         Mockito.reset(caManager);
         // Second round
         task.runInContext();
-        Mockito.verify(caManager, Mockito.times(0)).provisionCertificate(Mockito.any(Host.class), anyBoolean(), Mockito.anyString());
+        Mockito.verify(caManager, Mockito.times(0)).provisionCertificate(Mockito.any(Host.class), anyBoolean(), Mockito.anyString(), Mockito.anyBoolean());
         Mockito.verify(caManager, Mockito.times(0)).sendAlert(Mockito.any(Host.class), Mockito.anyString(), Mockito.anyString());
     }
 
diff --git a/server/src/test/java/org/apache/cloudstack/ca/CAManagerImplTest.java b/server/src/test/java/org/apache/cloudstack/ca/CAManagerImplTest.java
index 08fa5529996a..2d60833d35c7 100644
--- a/server/src/test/java/org/apache/cloudstack/ca/CAManagerImplTest.java
+++ b/server/src/test/java/org/apache/cloudstack/ca/CAManagerImplTest.java
@@ -24,6 +24,7 @@
 import com.cloud.certificate.dao.CrlDao;
 import com.cloud.host.Host;
 import com.cloud.host.dao.HostDao;
+import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.framework.ca.CAProvider;
 import org.apache.cloudstack.framework.ca.Certificate;
@@ -33,16 +34,34 @@
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.Mockito;
+import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
 
 import java.lang.reflect.Field;
+import java.lang.reflect.Method;
 import java.math.BigInteger;
 import java.security.KeyPair;
 import java.security.cert.X509Certificate;
 import java.util.Collections;
 import java.util.List;
+import java.util.Map;
+import java.util.HashMap;
+
+
+import org.mockito.MockedStatic;
+import org.mockito.MockedConstruction;
+import com.cloud.utils.ssh.SSHCmdHelper;
+import com.cloud.host.HostVO;
+import com.cloud.vm.VMInstanceVO;
+import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
+import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
+import com.cloud.vm.dao.VMInstanceDao;
+import com.trilead.ssh2.Connection;
+import com.cloud.agent.api.routing.NetworkElementCommand;
+import org.apache.cloudstack.api.ApiConstants;
 
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyInt;
@@ -62,8 +81,15 @@ public class CAManagerImplTest {
     private AgentManager agentManager;
     @Mock
     private CAProvider caProvider;
-
-    private CAManagerImpl caManager;
+    @Mock
+    private VMInstanceDao vmInstanceDao;
+    @Mock
+    private NetworkOrchestrationService networkOrchestrationService;
+    @Mock
+    private ConfigurationDao configDao;
+    @InjectMocks
+    @Spy
+    private CAManagerImpl caManager = new CAManagerImpl();
 
     private void addField(final CAManagerImpl provider, final String name, final Object o) throws IllegalAccessException, NoSuchFieldException {
         Field f = CAManagerImpl.class.getDeclaredField(name);
@@ -73,10 +99,6 @@ private void addField(final CAManagerImpl provider, final String name, final Obj
 
     @Before
     public void setUp() throws Exception {
-        caManager = new CAManagerImpl();
-        addField(caManager, "crlDao", crlDao);
-        addField(caManager, "hostDao", hostDao);
-        addField(caManager, "agentManager", agentManager);
         addField(caManager, "configuredCaProvider", caProvider);
 
         Mockito.when(caProvider.getProviderName()).thenReturn("root");
@@ -91,19 +113,19 @@ public void tearDown() throws Exception {
     }
 
     @Test(expected = ServerApiException.class)
-    public void testIssueCertificateThrowsException() throws Exception {
+    public void testIssueCertificateThrowsException() {
         caManager.issueCertificate(null, null, null, 1, null);
     }
 
     @Test
-    public void testIssueCertificate() throws Exception {
+    public void testIssueCertificate() {
         caManager.issueCertificate(null, Collections.singletonList("domain.example"), null, 1, null);
         Mockito.verify(caProvider, Mockito.times(1)).issueCertificate(anyList(), nullable(List.class), anyInt());
         Mockito.verify(caProvider, Mockito.times(0)).issueCertificate(anyString(), anyList(), anyList(), anyInt());
     }
 
     @Test
-    public void testRevokeCertificate() throws Exception {
+    public void testRevokeCertificate() {
         final CrlVO crl = new CrlVO(CertUtils.generateRandomBigInt(), "some.domain", "some-uuid");
         Mockito.when(crlDao.revokeCertificate(Mockito.any(BigInteger.class), anyString())).thenReturn(crl);
         Mockito.when(caProvider.revokeCertificate(Mockito.any(BigInteger.class), anyString())).thenReturn(true);
@@ -121,9 +143,190 @@ public void testProvisionCertificate() throws Exception {
         Mockito.when(agentManager.send(anyLong(), any(SetupCertificateCommand.class))).thenReturn(new SetupCertificateAnswer(true));
         Mockito.when(agentManager.send(anyLong(), any(SetupKeyStoreCommand.class))).thenReturn(new SetupKeystoreAnswer("someCsr"));
         Mockito.doNothing().when(agentManager).reconnect(Mockito.anyLong());
-        Assert.assertTrue(caManager.provisionCertificate(host, true, null));
+        Assert.assertTrue(caManager.provisionCertificate(host, true, null, false));
         Mockito.verify(agentManager, Mockito.times(1)).send(Mockito.anyLong(), any(SetupKeyStoreCommand.class));
         Mockito.verify(agentManager, Mockito.times(1)).send(Mockito.anyLong(), any(SetupCertificateCommand.class));
         Mockito.verify(agentManager, Mockito.times(1)).reconnect(Mockito.anyLong());
     }
+
+
+    @Test
+    public void testProvisionCertificateForced() throws Exception {
+        final Host host = Mockito.mock(Host.class);
+        Mockito.doReturn(true).when(caManager).provisionCertificateForced(host, true, null);
+        Assert.assertTrue(caManager.provisionCertificate(host, true, null, true));
+        Mockito.verify(caManager, Mockito.times(1)).provisionCertificateForced(host, true, null);
+        Mockito.verify(agentManager, Mockito.never()).send(Mockito.anyLong(), any(SetupKeyStoreCommand.class));
+        Mockito.verify(agentManager, Mockito.never()).send(Mockito.anyLong(), any(SetupCertificateCommand.class));
+    }
+
+    @Test
+    public void testIssueCertificateWithCsr() throws Exception {
+        final KeyPair keyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate x509 = CertUtils.generateV3Certificate(null, keyPair, keyPair.getPublic(), "CN=ca", "SHA256withRSA", 365, null, null);
+        Mockito.when(caProvider.issueCertificate(anyString(), anyList(), anyList(), anyInt()))
+                .thenReturn(new Certificate(x509, null, Collections.singletonList(x509)));
+        final Certificate result = caManager.issueCertificate("someCsr", Collections.singletonList("domain.example"), Collections.singletonList("1.2.3.4"), 365, null);
+        Assert.assertNotNull(result);
+        Mockito.verify(caProvider, Mockito.times(1)).issueCertificate(anyString(), anyList(), anyList(), anyInt());
+        Mockito.verify(caProvider, Mockito.never()).issueCertificate(anyList(), nullable(List.class), anyInt());
+    }
+
+    @Test(expected = CloudRuntimeException.class)
+    public void testProvisionCertificateNullHost() {
+        caManager.provisionCertificate(null, true, null, false);
+    }
+
+    @Test
+    public void testProvisionCertificateForSystemVm() throws Exception {
+        final Host host = Mockito.mock(Host.class);
+        Mockito.when(host.getType()).thenReturn(Host.Type.ConsoleProxy);
+        Mockito.when(host.getPrivateIpAddress()).thenReturn("1.2.3.4");
+        final KeyPair keyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate x509 = CertUtils.generateV3Certificate(null, keyPair, keyPair.getPublic(), "CN=ca", "SHA256withRSA", 365, null, null);
+        Mockito.when(caProvider.issueCertificate(anyList(), anyList(), anyInt()))
+                .thenReturn(new Certificate(x509, null, Collections.singletonList(x509)));
+        Mockito.when(agentManager.send(anyLong(), any(SetupCertificateCommand.class))).thenReturn(new SetupCertificateAnswer(true));
+        Assert.assertTrue(caManager.provisionCertificate(host, false, null, false));
+        Mockito.verify(agentManager, Mockito.never()).send(Mockito.anyLong(), any(SetupKeyStoreCommand.class));
+        Mockito.verify(agentManager, Mockito.times(1)).send(Mockito.anyLong(), any(SetupCertificateCommand.class));
+        Mockito.verify(agentManager, Mockito.never()).reconnect(Mockito.anyLong());
+    }
+
+    @Test
+    public void testProvisionCertificateWithoutReconnect() throws Exception {
+        final Host host = Mockito.mock(Host.class);
+        Mockito.when(host.getPrivateIpAddress()).thenReturn("1.2.3.4");
+        final KeyPair keyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate x509 = CertUtils.generateV3Certificate(null, keyPair, keyPair.getPublic(), "CN=ca", "SHA256withRSA", 365, null, null);
+        Mockito.when(caProvider.issueCertificate(anyString(), anyList(), anyList(), anyInt()))
+                .thenReturn(new Certificate(x509, null, Collections.singletonList(x509)));
+        Mockito.when(agentManager.send(anyLong(), any(SetupCertificateCommand.class))).thenReturn(new SetupCertificateAnswer(true));
+        Mockito.when(agentManager.send(anyLong(), any(SetupKeyStoreCommand.class))).thenReturn(new SetupKeystoreAnswer("someCsr"));
+        Assert.assertTrue(caManager.provisionCertificate(host, false, null, false));
+        Mockito.verify(agentManager, Mockito.never()).reconnect(Mockito.anyLong());
+    }
+
+    @Test
+    public void testRevokeCertificateReturnsFalseWhenCrlIsNull() {
+        Mockito.when(crlDao.revokeCertificate(Mockito.any(BigInteger.class), anyString())).thenReturn(null);
+        Assert.assertFalse(caManager.revokeCertificate(BigInteger.ONE, "some.domain", null));
+        Mockito.verify(caProvider, Mockito.never()).revokeCertificate(Mockito.any(BigInteger.class), anyString());
+    }
+
+    @Test
+    public void testRevokeCertificateReturnsFalseWhenSerialMismatch() {
+        final CrlVO crl = new CrlVO(BigInteger.ONE, "some.domain", "some-uuid");
+        Mockito.when(crlDao.revokeCertificate(Mockito.any(BigInteger.class), anyString())).thenReturn(crl);
+        Assert.assertFalse(caManager.revokeCertificate(BigInteger.TWO, "some.domain", null));
+        Mockito.verify(caProvider, Mockito.never()).revokeCertificate(Mockito.any(BigInteger.class), anyString());
+    }
+
+    @Test
+    public void testPurgeHostCertificate() throws Exception {
+        final Host host = Mockito.mock(Host.class);
+        Mockito.when(host.getPrivateIpAddress()).thenReturn("10.0.0.1");
+        Mockito.when(host.getPublicIpAddress()).thenReturn("192.168.0.1");
+        final KeyPair keyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate x509 = CertUtils.generateV3Certificate(null, keyPair,
+                keyPair.getPublic(), "CN=ca", "SHA256withRSA",
+                365, null, null);
+        caManager.getActiveCertificatesMap().put("10.0.0.1", x509);
+        caManager.getActiveCertificatesMap().put("192.168.0.1", x509);
+        caManager.purgeHostCertificate(host);
+        Assert.assertFalse(caManager.getActiveCertificatesMap().containsKey("10.0.0.1"));
+        Assert.assertFalse(caManager.getActiveCertificatesMap().containsKey("192.168.0.1"));
+    }
+    @Test
+    public void testProvisionCertificateViaSsh() throws Exception {
+        Connection sshConnection = Mockito.mock(Connection.class);
+        final String agentIp = "192.168.1.1";
+        final String agentHostname = "host1";
+        final String caProviderStr = "root";
+
+        try (MockedStatic<SSHCmdHelper> sshCmdHelperMock = Mockito.mockStatic(SSHCmdHelper.class)) {
+            SSHCmdHelper.SSHCmdResult successResult = new SSHCmdHelper.SSHCmdResult(0, "someCsr", "");
+            sshCmdHelperMock.when(() -> SSHCmdHelper.sshExecuteCmdWithResult(Mockito.eq(sshConnection), Mockito.anyString()))
+                    .thenReturn(successResult);
+
+            final KeyPair keyPair = CertUtils.generateRandomKeyPair(1024);
+            final X509Certificate x509 = CertUtils.generateV3Certificate(null, keyPair, keyPair.getPublic(), "CN=ca", "SHA256withRSA", 365, null, null);
+            Mockito.doReturn(new Certificate(x509, null, Collections.singletonList(x509)))
+                   .when(caManager).issueCertificate(Mockito.anyString(), Mockito.anyList(), Mockito.anyList(), Mockito.nullable(Integer.class), Mockito.anyString());
+
+            caManager.provisionCertificateViaSsh(sshConnection, agentIp, agentHostname, caProviderStr);
+
+            sshCmdHelperMock.verify(() -> SSHCmdHelper.sshExecuteCmdWithResult(Mockito.eq(sshConnection), Mockito.contains("keystore-setup")), Mockito.times(1));
+            sshCmdHelperMock.verify(() -> SSHCmdHelper.sshExecuteCmdWithResult(Mockito.eq(sshConnection), Mockito.contains("keystore-cert-import")), Mockito.times(1));
+        }
+    }
+
+    @Test
+    public void testProvisionKvmHostViaSsh() throws Exception {
+        HostVO host = Mockito.mock(HostVO.class);
+        Mockito.when(host.getPrivateIpAddress()).thenReturn("192.168.1.1");
+        Mockito.when(host.getName()).thenReturn("host1");
+        Mockito.when(host.getClusterId()).thenReturn(1L);
+
+        Mockito.doNothing().when(hostDao).loadDetails(host);
+        Mockito.when(host.getDetail(ApiConstants.USERNAME)).thenReturn("root");
+        Mockito.when(host.getDetail(ApiConstants.PASSWORD)).thenReturn("password");
+
+        Mockito.when(configDao.getValue("ssh.privatekey")).thenReturn("privatekey");
+
+        try (MockedConstruction<Connection> ignored = Mockito.mockConstruction(Connection.class,
+                (mock, context) -> {
+                    // Do nothing on connect
+                });
+             MockedStatic<SSHCmdHelper> sshCmdHelperMock = Mockito.mockStatic(SSHCmdHelper.class)) {
+            sshCmdHelperMock.when(() -> SSHCmdHelper.acquireAuthorizedConnectionWithPublicKey(Mockito.any(Connection.class), Mockito.anyString(), Mockito.anyString()))
+                    .thenReturn(true);
+
+            Mockito.doNothing().when(caManager).provisionCertificateViaSsh(Mockito.any(Connection.class), Mockito.anyString(), Mockito.anyString(), Mockito.anyString());
+
+            Method method = CAManagerImpl.class.getDeclaredMethod("provisionKvmHostViaSsh", Host.class, String.class);
+            method.setAccessible(true);
+            boolean result = (Boolean) method.invoke(caManager, host, "root");
+
+            Assert.assertTrue(result);
+            Mockito.verify(caManager, Mockito.times(1)).provisionCertificateViaSsh(Mockito.any(Connection.class), Mockito.eq("192.168.1.1"), Mockito.eq("host1"), Mockito.eq("root"));
+            sshCmdHelperMock.verify(() -> SSHCmdHelper.sshExecuteCmd(Mockito.any(Connection.class), Mockito.eq("systemctl restart libvirtd")), Mockito.times(1));
+            sshCmdHelperMock.verify(() -> SSHCmdHelper.sshExecuteCmd(Mockito.any(Connection.class), Mockito.eq("systemctl restart cloudstack-agent")), Mockito.times(1));
+        }
+    }
+
+    @Test
+    public void testProvisionSystemVmViaSsh() throws Exception {
+        Host host = Mockito.mock(Host.class);
+        Mockito.when(host.getName()).thenReturn("v-1-VM");
+
+        VMInstanceVO vm = Mockito.mock(VMInstanceVO.class);
+        Mockito.when(vm.getHostId()).thenReturn(1L);
+        Mockito.when(vm.getHostName()).thenReturn("host1");
+        Mockito.when(vm.getInstanceName()).thenReturn("v-1-VM");
+        Mockito.when(vmInstanceDao.findVMByInstanceName("v-1-VM")).thenReturn(vm);
+
+        Map<String, String> accessDetails = new HashMap<>();
+        accessDetails.put(NetworkElementCommand.ROUTER_IP, "192.168.1.2");
+        Mockito.when(networkOrchestrationService.getSystemVMAccessDetails(vm)).thenReturn(accessDetails);
+
+        HostVO hypervisorHost = Mockito.mock(HostVO.class);
+        Mockito.when(hostDao.findById(1L)).thenReturn(hypervisorHost);
+
+        final KeyPair keyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate x509 = CertUtils.generateV3Certificate(null, keyPair, keyPair.getPublic(), "CN=ca", "SHA256withRSA", 365, null, null);
+        Certificate cert = new Certificate(x509, null, Collections.singletonList(x509));
+        Mockito.doReturn(cert)
+               .when(caManager).issueCertificate(Mockito.nullable(String.class), Mockito.anyList(), Mockito.anyList(), Mockito.nullable(Integer.class), Mockito.anyString());
+
+        Mockito.doReturn(true)
+               .when(caManager).deployCertificate(Mockito.eq(hypervisorHost), Mockito.eq(cert), Mockito.anyBoolean(), Mockito.eq(accessDetails));
+
+        Method method = CAManagerImpl.class.getDeclaredMethod("provisionSystemVmViaSsh", Host.class, Boolean.class, String.class);
+        method.setAccessible(true);
+        boolean result = (Boolean) method.invoke(caManager, host, true, "root");
+
+        Assert.assertTrue(result);
+        Mockito.verify(caManager, Mockito.times(1)).deployCertificate(Mockito.eq(hypervisorHost), Mockito.eq(cert), Mockito.eq(true), Mockito.eq(accessDetails));
+    }
 }
diff --git a/systemvm/patch-sysvms.sh b/systemvm/patch-sysvms.sh
index 88d720e0f32f..8d96de9ba3b8 100755
--- a/systemvm/patch-sysvms.sh
+++ b/systemvm/patch-sysvms.sh
@@ -126,7 +126,28 @@ patch_systemvm() {
 
   if [ "$TYPE" = "consoleproxy" ] || [ "$TYPE" = "secstorage" ]; then
     # Import global cacerts into 'cloud' service's keystore
-    keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts -destkeystore /usr/local/cloud/systemvm/certs/realhostip.keystore -srcstorepass changeit -deststorepass vmops.com -noprompt 2>/dev/null || true
+    REALHOSTIP_KS_FILE="/usr/local/cloud/systemvm/certs/realhostip.keystore"
+    REALHOSTIP_PASS="vmops.com"
+
+    keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts \
+        -destkeystore "$REALHOSTIP_KS_FILE" -srcstorepass changeit -deststorepass \
+        "$REALHOSTIP_PASS" -noprompt 2>/dev/null || true
+
+    # Import CA cert(s) into realhostip.keystore so the SSVM JVM
+    # (which overrides the truststore via -Djavax.net.ssl.trustStore in _run.sh)
+    # can trust servers signed by the CloudStack CA
+    CACERT_FILE="/usr/local/share/ca-certificates/cloudstack/ca.crt"
+
+    if [ -f "$CACERT_FILE" ] && [ -f "$REALHOSTIP_KS_FILE" ]; then
+        awk 'BEGIN{n=0} /-----BEGIN CERTIFICATE-----/{n++} n>0{print > "cloudca." n }' "$CACERT_FILE"
+        for caChain in $(ls cloudca.* 2>/dev/null); do
+            keytool -delete -noprompt -alias "$caChain" -keystore "$REALHOSTIP_KS_FILE" \
+                -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1 || true
+            keytool -import -noprompt -trustcacerts -alias "$caChain" -file "$caChain" \
+                -keystore "$REALHOSTIP_KS_FILE" -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1
+        done
+        rm -f cloudca.*
+    fi
   fi
 
   update_checksum $newpath/cloud-scripts.tgz
diff --git a/test/integration/smoke/test_certauthority_root.py b/test/integration/smoke/test_certauthority_root.py
index dc6420d6369f..491b8abeb2e8 100644
--- a/test/integration/smoke/test_certauthority_root.py
+++ b/test/integration/smoke/test_certauthority_root.py
@@ -15,9 +15,12 @@
 # specific language governing permissions and limitations
 # under the License.
 
+import re
+from datetime import datetime, timedelta
+
 from nose.plugins.attrib import attr
 from marvin.cloudstackTestCase import cloudstackTestCase
-from marvin.lib.utils import cleanup_resources
+from marvin.lib.utils import cleanup_resources, wait_until
 from marvin.lib.base import *
 from marvin.lib.common import list_hosts
 
@@ -60,6 +63,29 @@ def verifySignature(self, caCert, cert):
         except Exception as e:
             print(f"Certificate verification failed: {e}")
 
+
+    def parseCertificateChain(self, pem):
+        """Split a PEM blob containing one or more certificates into a list of x509 objects."""
+        certs = []
+        matches = re.findall(
+            r'-----BEGIN CERTIFICATE-----.*?-----END CERTIFICATE-----',
+            pem,
+            re.DOTALL
+        )
+        for match in matches:
+            certs.append(x509.load_pem_x509_certificate(match.encode(), default_backend()))
+        return certs
+
+
+    def assertSignatureValid(self, issuerCert, cert):
+        """Verify cert is signed by issuerCert; raise on failure."""
+        issuerCert.public_key().verify(
+            cert.signature,
+            cert.tbs_certificate_bytes,
+            padding.PKCS1v15(),
+            cert.signature_hash_algorithm,
+        )
+
     def setUp(self):
         self.apiclient = self.testClient.getApiClient()
         self.dbclient = self.testClient.getDbConnection()
@@ -224,3 +250,152 @@ def checkHostIsUp(hostId):
                 self.assertTrue(len(hosts) == 1)
             else:
                 self.fail("Failed to have systemvm host in Up state after cert provisioning")
+
+
+    @attr(tags=['advanced', 'simulator', 'basic', 'sg'], required_hardware=False)
+    def test_ca_certificate_chain_validity(self):
+        """
+            Tests that listCaCertificate returns a valid certificate chain.
+            When an intermediate CA is configured, the response is a PEM blob
+            containing multiple certificates. Each non-root cert must be signed
+            by the next cert in the chain, and the final cert must be self-signed.
+        """
+        pem = self.getCaCertificate()
+        self.assertTrue(len(pem) > 0)
+
+        chain = self.parseCertificateChain(pem)
+        self.assertTrue(len(chain) >= 1, "Expected at least one certificate in CA chain")
+
+        # Each non-root cert must be signed by the next cert in the chain
+        for i in range(len(chain) - 1):
+            child = chain[i]
+            parent = chain[i + 1]
+            self.assertEqual(
+                child.issuer, parent.subject,
+                f"Chain break: cert[{i}] issuer does not match cert[{i + 1}] subject"
+            )
+            try:
+                self.assertSignatureValid(parent, child)
+            except Exception as e:
+                self.fail(f"Signature verification failed for chain link {i} -> {i + 1}: {e}")
+
+        # The last cert in the chain must be self-signed (root CA)
+        root = chain[-1]
+        self.assertEqual(
+            root.issuer, root.subject,
+            "Final cert in CA chain is not self-signed"
+        )
+        try:
+            self.assertSignatureValid(root, root)
+        except Exception as e:
+            self.fail(f"Root CA self-signature verification failed: {e}")
+
+
+    @attr(tags=['advanced', 'simulator', 'basic', 'sg'], required_hardware=False)
+    def test_issue_certificate_issuer_matches_ca(self):
+        """
+            Tests that an issued certificate's issuer DN matches the subject DN
+            of the first cert in the returned CA chain, and that the signature
+            verifies against that cert's public key.
+        """
+        cmd = issueCertificate.issueCertificateCmd()
+        cmd.domain = 'apache.org'
+        cmd.ipaddress = '10.1.1.1'
+        cmd.provider = 'root'
+
+        response = self.apiclient.issueCertificate(cmd)
+        self.assertTrue(len(response.certificate) > 0)
+        self.assertTrue(len(response.cacertificates) > 0)
+
+        leaf = x509.load_pem_x509_certificate(response.certificate.encode(), default_backend())
+        caChain = self.parseCertificateChain(response.cacertificates)
+        self.assertTrue(len(caChain) >= 1, "Expected at least one CA certificate in response")
+
+        # The issuing CA is the first cert in the returned chain (intermediate
+        # if an intermediate CA is configured, otherwise the root).
+        issuingCa = caChain[0]
+        self.assertEqual(
+            leaf.issuer, issuingCa.subject,
+            "Leaf certificate issuer does not match issuing CA subject"
+        )
+        try:
+            self.assertSignatureValid(issuingCa, leaf)
+        except Exception as e:
+            self.fail(f"Leaf certificate signature does not verify against issuing CA: {e}")
+
+
+    @attr(tags=['advanced', 'simulator', 'basic', 'sg'], required_hardware=False)
+    def test_certificate_validity_period(self):
+        """
+            Tests that an issued certificate has sensible validity bounds:
+            not_valid_before <= now <= not_valid_after, and validity duration
+            is at least 300 days (CloudStack default is 1 year).
+        """
+        cmd = issueCertificate.issueCertificateCmd()
+        cmd.domain = 'apache.org'
+        cmd.provider = 'root'
+
+        response = self.apiclient.issueCertificate(cmd)
+        self.assertTrue(len(response.certificate) > 0)
+
+        cert = x509.load_pem_x509_certificate(response.certificate.encode(), default_backend())
+
+        # cryptography >= 42 prefers the *_utc variants; fall back for older versions.
+        notBefore = getattr(cert, 'not_valid_before_utc', None) or cert.not_valid_before
+        notAfter = getattr(cert, 'not_valid_after_utc', None) or cert.not_valid_after
+
+        now = datetime.now(notBefore.tzinfo) if notBefore.tzinfo else datetime.utcnow()
+        self.assertTrue(notBefore <= now, f"Certificate not_valid_before {notBefore} is in the future")
+        self.assertTrue(now <= notAfter, f"Certificate not_valid_after {notAfter} is in the past")
+
+        duration = notAfter - notBefore
+        self.assertTrue(
+            duration >= timedelta(days=300),
+            f"Certificate validity duration {duration} is less than expected minimum of 300 days"
+        )
+
+
+    def getUpKVMHosts(self, hostId=None):
+        hosts = list_hosts(
+            self.apiclient,
+            type='Routing',
+            hypervisor='KVM',
+            state='Up',
+            resourcestate='Enabled',
+            id=hostId
+        )
+        return hosts
+
+
+    @attr(tags=['advanced'], required_hardware=True)
+    def test_provision_certificate_kvm(self):
+        """
+            Tests certificate provisioning on a KVM host.
+            Exercises the keystore-cert-import + cloud.jks provisioning flow
+            against a real agent. Skipped when no KVM hosts are available.
+        """
+        if self.hypervisor.lower() != 'kvm':
+            raise self.skipTest("Hypervisor is not KVM, skipping test")
+
+        hosts = self.getUpKVMHosts()
+        if not hosts or len(hosts) < 1:
+            raise self.skipTest("No Up KVM hosts found, skipping test")
+
+        host = hosts[0]
+
+        cmd = provisionCertificate.provisionCertificateCmd()
+        cmd.hostid = host.id
+        cmd.reconnect = True
+        cmd.provider = 'root'
+
+        response = self.apiclient.provisionCertificate(cmd)
+        self.assertTrue(response.success)
+
+        def checkHostIsUp(hostId):
+            hosts = self.getUpKVMHosts(hostId)
+            return (hosts is not None and len(hosts) > 0), hosts
+
+        result, hosts = wait_until(2, 30, checkHostIsUp, host.id)
+        if not result:
+            self.fail("KVM host did not return to Up state after certificate provisioning")
+        self.assertEqual(len(hosts), 1)
diff --git a/ui/src/config/section/infra/hosts.js b/ui/src/config/section/infra/hosts.js
index 2f27db5780bc..48e850a22fbe 100644
--- a/ui/src/config/section/infra/hosts.js
+++ b/ui/src/config/section/infra/hosts.js
@@ -103,7 +103,7 @@ export default {
       show: (record) => {
         return record.hypervisor === 'KVM' || record.hypervisor === store.getters.customHypervisorName
       },
-      args: ['hostid'],
+      args: ['hostid', 'forced'],
       mapping: {
         hostid: {
           value: (record) => { return record.id }
diff --git a/utils/src/main/java/com/cloud/utils/nio/Link.java b/utils/src/main/java/com/cloud/utils/nio/Link.java
index 18bbb0533eeb..71bb0b7eda53 100644
--- a/utils/src/main/java/com/cloud/utils/nio/Link.java
+++ b/utils/src/main/java/com/cloud/utils/nio/Link.java
@@ -552,7 +552,7 @@ private static HandshakeHolder doHandshakeWrap(final SocketChannel socketChannel
             LOGGER.error(String.format("SSL error caught during wrap data: %s, for local address=%s, remote address=%s.",
                     sslException.getMessage(), socketChannel.getLocalAddress(), socketChannel.getRemoteAddress()));
             sslEngine.closeOutbound();
-            return new HandshakeHolder(myAppData, myNetData, true);
+            return new HandshakeHolder(myAppData, myNetData, false);
         }
         if (result == null) {
             return new HandshakeHolder(myAppData, myNetData, false);
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/security/CertUtils.java b/utils/src/main/java/org/apache/cloudstack/utils/security/CertUtils.java
index 6ff3d918f43a..84a4a1274406 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/security/CertUtils.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/security/CertUtils.java
@@ -98,9 +98,18 @@ public static KeyFactory getKeyFactory() {
         return keyFactory;
     }
 
-    public static X509Certificate pemToX509Certificate(final String pem) throws CertificateException, IOException {
-        final PEMParser pemParser = new PEMParser(new StringReader(pem));
-        return new JcaX509CertificateConverter().setProvider("BC").getCertificate((X509CertificateHolder) pemParser.readObject());
+    public static List<X509Certificate> pemToX509Certificates(final String pem) throws CertificateException, IOException {
+        final List<X509Certificate> certs = new ArrayList<>();
+        try (final PEMParser pemParser = new PEMParser(new StringReader(pem))) {
+            final JcaX509CertificateConverter certConverter = new JcaX509CertificateConverter().setProvider("BC");
+            Object parsedObj;
+            while ((parsedObj = pemParser.readObject()) != null) {
+                if (parsedObj instanceof X509CertificateHolder) {
+                    certs.add(certConverter.getCertificate((X509CertificateHolder) parsedObj));
+                }
+            }
+        }
+        return certs;
     }
 
     public static String x509CertificateToPem(final X509Certificate cert) throws IOException {
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/security/KeyStoreUtils.java b/utils/src/main/java/org/apache/cloudstack/utils/security/KeyStoreUtils.java
index e78d14adbb2d..c6f8d21918c4 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/security/KeyStoreUtils.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/security/KeyStoreUtils.java
@@ -26,7 +26,6 @@
 public class KeyStoreUtils {
     public static final String KS_SETUP_SCRIPT = "keystore-setup";
     public static final String KS_IMPORT_SCRIPT = "keystore-cert-import";
-    public static final String KS_SYSTEMVM_IMPORT_SCRIPT = "keystore-cert-import-sysvm";
 
     public static final String AGENT_PROPSFILE = "agent.properties";
     public static final String KS_PASSPHRASE_PROPERTY = "keystore.passphrase";
diff --git a/utils/src/test/java/org/apache/cloudstack/utils/security/CertUtilsTest.java b/utils/src/test/java/org/apache/cloudstack/utils/security/CertUtilsTest.java
index 691e7ea0f23f..8141c918c8a6 100644
--- a/utils/src/test/java/org/apache/cloudstack/utils/security/CertUtilsTest.java
+++ b/utils/src/test/java/org/apache/cloudstack/utils/security/CertUtilsTest.java
@@ -53,7 +53,7 @@ public void testGenerateRandomKeyPair() throws Exception {
     public void testCertificateConversionMethods() throws Exception {
         final X509Certificate in = caCertificate;
         final String pem = CertUtils.x509CertificateToPem(in);
-        final X509Certificate out = CertUtils.pemToX509Certificate(pem);
+        final X509Certificate out = CertUtils.pemToX509Certificates(pem).get(0);
         Assert.assertTrue(pem.startsWith("-----BEGIN CERTIFICATE-----\n"));
         Assert.assertTrue(pem.endsWith("-----END CERTIFICATE-----\n"));
         Assert.assertEquals(in.getSerialNumber(), out.getSerialNumber());
@@ -87,6 +87,21 @@ public void testGenerateRandomBigInt() throws Exception {
         Assert.assertNotEquals(CertUtils.generateRandomBigInt(), CertUtils.generateRandomBigInt());
     }
 
+    @Test
+    public void testPemToX509CertificatesWithChain() throws Exception {
+        final KeyPair intermediateKeyPair = CertUtils.generateRandomKeyPair(1024);
+        final X509Certificate intermediateCert = CertUtils.generateV3Certificate(caCertificate, caKeyPair,
+                intermediateKeyPair.getPublic(), "CN=intermediate", "SHA256withRSA", 365, null, null);
+
+        final String chainPem = CertUtils.x509CertificateToPem(intermediateCert)
+                + CertUtils.x509CertificateToPem(caCertificate);
+        final List<X509Certificate> parsed = CertUtils.pemToX509Certificates(chainPem);
+
+        Assert.assertEquals(2, parsed.size());
+        Assert.assertEquals(intermediateCert.getSerialNumber(), parsed.get(0).getSerialNumber());
+        Assert.assertEquals(caCertificate.getSerialNumber(), parsed.get(1).getSerialNumber());
+    }
+
     @Test
     public void testGenerateCertificate() throws Exception {
         final KeyPair clientKeyPair = CertUtils.generateRandomKeyPair(1024);

From d1e1aa5d2035e46af01059315b98f290909969d4 Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Thu, 21 May 2026 14:36:22 +0200
Subject: [PATCH 43/64] VM Deployment using snapshot in new zone (#13178)

---
 .../java/com/cloud/vm/UserVmManagerImpl.java  |  66 +-
 .../com/cloud/vm/UserVmManagerImplTest.java   | 608 ++++++++++--------
 2 files changed, 391 insertions(+), 283 deletions(-)

diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index b23291586ef3..83cce4351b24 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -155,7 +155,6 @@
 import org.apache.commons.collections.MapUtils;
 import org.apache.commons.lang.math.NumberUtils;
 import org.apache.commons.lang3.ObjectUtils;
-import org.apache.commons.lang3.StringUtils;
 import org.apache.commons.lang3.builder.ToStringBuilder;
 import org.apache.commons.lang3.builder.ToStringStyle;
 import org.jetbrains.annotations.NotNull;
@@ -376,6 +375,7 @@
 import com.cloud.utils.Journal;
 import com.cloud.utils.NumbersUtil;
 import com.cloud.utils.Pair;
+import com.cloud.utils.StringUtils;
 import com.cloud.utils.component.ComponentContext;
 import com.cloud.utils.component.ManagerBase;
 import com.cloud.utils.concurrency.NamedThreadFactory;
@@ -619,7 +619,7 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
     @Inject
     BackupScheduleDao backupScheduleDao;
     @Inject
-    private StatsCollector statsCollector;
+    StatsCollector statsCollector;
     @Inject
     private UserDataDao userDataDao;
     @Inject
@@ -903,10 +903,10 @@ public UserVm resetVMPassword(ResetVMPasswordCmd cmd, String password) throws Re
     }
 
     private boolean resetVMPasswordInternal(Long vmId, String password) throws ResourceUnavailableException, InsufficientCapacityException {
-        Long userId = CallContext.current().getCallingUserId();
+        long userId = CallContext.current().getCallingUserId();
         VMInstanceVO vmInstance = _vmDao.findById(vmId);
 
-        if (password == null || password.equals("")) {
+        if (StringUtils.isEmpty(password)) {
             return false;
         }
 
@@ -1091,7 +1091,7 @@ protected void removeEncryptedPasswordFromUserVmVoDetails(long vmId) {
     }
 
     private boolean resetVMSSHKeyInternal(Long vmId, String sshPublicKeys, String keypairnames) throws ResourceUnavailableException, InsufficientCapacityException {
-        Long userId = CallContext.current().getCallingUserId();
+        long userId = CallContext.current().getCallingUserId();
         VMInstanceVO vmInstance = _vmDao.findById(vmId);
 
         VMTemplateVO template = _templateDao.findByIdIncludingRemoved(vmInstance.getTemplateId());
@@ -1263,7 +1263,7 @@ public UserVm upgradeVirtualMachine(UpgradeVMCmd cmd) throws ResourceAllocationE
         if (vmInstance == null) {
             throw new InvalidParameterValueException("unable to find an Instance with id " + vmId);
         } else if (!(vmInstance.getState().equals(State.Stopped))) {
-            throw new InvalidParameterValueException("Unable to upgrade Instance " + vmInstance.toString() + " " + " in state " + vmInstance.getState()
+            throw new InvalidParameterValueException("Unable to upgrade Instance " + vmInstance + " " + " in state " + vmInstance.getState()
             + "; make sure the Instance is stopped");
         }
 
@@ -1756,7 +1756,7 @@ public UserVm updateDefaultNicForVirtualMachine(UpdateDefaultNicForVMCmd cmd) th
             oldNetworkOfferingId = oldDefaultNetwork.getNetworkOfferingId();
         }
         NicVO existingVO = _nicDao.findById(existing.id);
-        Integer chosenID = nic.getDeviceId();
+        int chosenID = nic.getDeviceId();
         Integer existingID = existing.getDeviceId();
 
         Network newdefault = null;
@@ -2136,14 +2136,14 @@ private boolean upgradeRunningVirtualMachine(Long vmId, Long newServiceOfferingI
 
             // Check vm flag
             if (!vmInstance.isDynamicallyScalable()) {
-                throw new CloudRuntimeException(String.format("Unable to scale %s as it does not have tools to support dynamic scaling.", vmInstance.toString()));
+                throw new CloudRuntimeException(String.format("Unable to scale %s as it does not have tools to support dynamic scaling.", vmInstance));
             }
 
             // Check disable threshold for cluster is not crossed
             HostVO host = _hostDao.findById(vmInstance.getHostId());
             _hostDao.loadDetails(host);
             if (_capacityMgr.checkIfClusterCrossesThreshold(host.getClusterId(), cpuDiff, memoryDiff)) {
-                throw new CloudRuntimeException(String.format("Unable to scale %s due to insufficient resources.", vmInstance.toString()));
+                throw new CloudRuntimeException(String.format("Unable to scale %s due to insufficient resources.", vmInstance));
             }
 
             while (retry-- != 0) { // It's != so that it can match -1.
@@ -2180,7 +2180,7 @@ private boolean upgradeRunningVirtualMachine(Long vmId, Long newServiceOfferingI
                     success = true;
                     return success;
                 } catch (InsufficientCapacityException | ResourceUnavailableException | ConcurrentOperationException e) {
-                    logger.error(String.format("Unable to scale %s due to [%s].", vmInstance.toString(), e.getMessage()), e);
+                    logger.error(String.format("Unable to scale %s due to [%s].", vmInstance, e.getMessage()), e);
                 } finally {
                     if (!success) {
                         // Decrement CPU and Memory count accordingly.
@@ -4485,7 +4485,7 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
                     }
 
                     NetworkOffering ntwkOffering = _networkOfferingDao.findById(network.getNetworkOfferingId());
-                    Long physicalNetworkId = _networkModel.findPhysicalNetworkId(zone.getId(), ntwkOffering.getTags(), ntwkOffering.getTrafficType());
+                    long physicalNetworkId = _networkModel.findPhysicalNetworkId(zone.getId(), ntwkOffering.getTags(), ntwkOffering.getTrafficType());
 
                     String provider = _ntwkSrvcDao.getProviderForServiceInNetwork(network.getId(), Service.Connectivity);
                     if (!_networkModel.isProviderEnabledInPhysicalNetwork(physicalNetworkId, provider)) {
@@ -4703,7 +4703,7 @@ protected long configureCustomRootDiskSize(Map<String, String> customParameters,
         }
 
         if (customParameters.containsKey(VmDetailConstants.ROOT_DISK_SIZE)) {
-            Long rootDiskSize = NumbersUtil.parseLong(customParameters.get(VmDetailConstants.ROOT_DISK_SIZE), -1);
+            long rootDiskSize = NumbersUtil.parseLong(customParameters.get(VmDetailConstants.ROOT_DISK_SIZE), -1);
             if (rootDiskSize <= 0) {
                 throw new InvalidParameterValueException("Root disk size should be a positive number.");
             }
@@ -4822,7 +4822,7 @@ private UserVmVO commitUserVm(final boolean isImport, final DataCenter zone, fin
                                   final Map<String, Map<Integer, String>> extraDhcpOptionMap, final Map<Long, DiskOffering> dataDiskTemplateToDiskOfferingMap,
                                   final Map<String, String> userVmOVFPropertiesMap, final VirtualMachine.PowerState powerState, final boolean dynamicScalingEnabled, String vmType, final Long rootDiskOfferingId, String sshkeypairs,
                                   List<VmDiskInfo> dataDiskInfoList, Volume volume, Snapshot snapshot) throws InsufficientCapacityException {
-        Long selectedGuestOsId = guestOsId != null ? guestOsId : template.getGuestOSId();
+        long selectedGuestOsId = guestOsId != null ? guestOsId : template.getGuestOSId();
         UserVmVO vm = new UserVmVO(id, instanceName, displayName, template.getId(), hypervisorType, selectedGuestOsId, offering.isOfferHA(),
                 offering.getLimitCpuUse(), owner.getDomainId(), owner.getId(), userId, offering.getId(), userData, userDataId, userDataDetails, hostName);
         vm.setUuid(uuidName);
@@ -5381,7 +5381,7 @@ private void addUserVMCmdlineArgs(Long vmId, VirtualMachineProfile profile, Depl
         if (dc.getDns2() != null) {
             buf.append(" dns2=").append(dc.getDns2());
         }
-        logger.info("cmdline details: "+ buf.toString());
+        logger.info("cmdline details: "+ buf);
     }
 
     @Override
@@ -5641,7 +5641,7 @@ private void checkForceStopVmPermission(Account callingAccount) {
     public UserVm stopVirtualMachine(long vmId, boolean forced) throws ConcurrentOperationException {
         // Input validation
         Account caller = CallContext.current().getCallingAccount();
-        Long userId = CallContext.current().getCallingUserId();
+        long userId = CallContext.current().getCallingUserId();
 
         // if account is removed, return error
         if (caller != null && caller.getRemoved() != null) {
@@ -6413,7 +6413,13 @@ public UserVm createVirtualMachine(DeployVMCmd cmd) throws InsufficientCapacityE
             }
             _accountMgr.checkAccess(caller, null, true, snapshot);
             VolumeInfo volumeOfSnapshot = getVolume(snapshot.getVolumeId(), templateId, true);
-            templateId = volumeOfSnapshot.getTemplateId();
+            if (volumeOfSnapshot != null) {
+                templateId = volumeOfSnapshot.getTemplateId();
+            } else if (templateId == null) {
+                throw new InvalidParameterValueException(
+                        "Could not determine template from snapshot id=" + cmd.getSnapshotId() +
+                                "; the source volume no longer exists. Please specify a templateId.");
+            }
         }
 
         VirtualMachineTemplate template = null;
@@ -6695,7 +6701,9 @@ protected void addLeaseDetailsForInstance(UserVm vm, Integer leaseDuration, VMLe
     private VolumeInfo getVolume(long id, Long templateId, boolean isSnapshot) {
         VolumeInfo volume = volFactory.getVolume(id);
         if (volume != null) {
-            if (volume.getDataStore() == null || !ScopeType.ZONE.equals(volume.getDataStore().getScope().getScopeType())) {
+            if (!isSnapshot
+                    && (volume.getDataStore() == null
+                    || !ScopeType.ZONE.equals(volume.getDataStore().getScope().getScopeType()))) {
                 throw new InvalidParameterValueException("Deployment of virtual machine is supported only for Zone-wide storage pools");
             }
             checkIfVolumeTemplateIsTheSameAsTheProvided(volume, templateId);
@@ -6911,7 +6919,7 @@ protected void addExtraConfig(UserVm vm, String extraConfig) {
         } else if (hypervisorType.equals(HypervisorType.VMware)) {
             persistExtraConfigVmware(decodedUrl, vm);
         } else {
-            String msg = String.format("This hypervisor %s is not supported for use with this feature", hypervisorType.toString());
+            String msg = String.format("This hypervisor %s is not supported for use with this feature", hypervisorType);
             throw new CloudRuntimeException(msg);
         }
     }
@@ -7257,7 +7265,7 @@ private DeployDestination chooseVmMigrationDestination(VMInstanceVO vm, Host src
         vm.setLastHostId(null); // Last host does not have higher priority in vm migration
         final ServiceOfferingVO offering = serviceOfferingDao.findById(vm.getId(), vm.getServiceOfferingId());
         final VirtualMachineProfile profile = new VirtualMachineProfileImpl(vm, null, offering, null, null);
-        final Long srcHostId = srcHost.getId();
+        final long srcHostId = srcHost.getId();
         final Host host = _hostDao.findById(srcHostId);
         ExcludeList excludes = new ExcludeList();
         excludes.addHost(srcHostId);
@@ -7910,7 +7918,7 @@ public UserVm moveVmToUser(final AssignVMCmd cmd) throws ResourceAllocationExcep
 
         Long domainId = cmd.getDomainId();
         Long projectId = cmd.getProjectId();
-        Long oldAccountId = vm.getAccountId();
+        long oldAccountId = vm.getAccountId();
         String newAccountName = cmd.getAccountName();
         final Account oldAccount = _accountService.getActiveAccountById(oldAccountId);
         final Account newAccount = _accountMgr.finalizeOwner(caller, newAccountName, domainId, projectId);
@@ -8539,7 +8547,7 @@ protected void selectApplicableNetworkToCreateVm(Account newAccount, DataCenterV
     protected void addDefaultSecurityGroupToSecurityGroupIdList(Account newAccount, List<Long> securityGroupIdList) {
         logger.debug("Adding default security group to security group list if not already in it.");
 
-        Long newAccountId = newAccount.getId();
+        long newAccountId = newAccount.getId();
         SecurityGroup defaultGroup = _securityGroupMgr.getDefaultSecurityGroup(newAccountId);
         boolean defaultGroupPresent = false;
 
@@ -8686,7 +8694,7 @@ protected NetworkVO createApplicableNetworkToCreateVm(Account newAccount, DataCe
         logger.trace("Creating an applicable network to create the VM.");
 
         NetworkVO defaultNetwork;
-        Long zoneId = zone.getId();
+        long zoneId = zone.getId();
         Account caller = CallContext.current().getCallingAccount();
         NetworkOfferingVO requiredOffering = getOfferingWithRequiredAvailabilityForNetworkCreation();
         String requiredOfferingTags = requiredOffering.getTags();
@@ -9446,7 +9454,7 @@ private boolean checkStatusOfVolumeSnapshots(VirtualMachine vm, Volume.Type type
         }
         logger.debug("Found {} no. of volumes of type {} for vm with VM ID {}", listVolumes.size(), type, vm);
         for (VolumeVO volume : listVolumes) {
-            Long volumeId = volume.getId();
+            long volumeId = volume.getId();
             logger.debug("Checking status of snapshots for Volume: {}", volume);
             List<SnapshotVO> ongoingSnapshots = _snapshotDao.listByStatus(volumeId, Snapshot.State.Creating, Snapshot.State.CreatedOnPrimary, Snapshot.State.BackingUp);
             int ongoingSnapshotsCount = ongoingSnapshots.size();
@@ -9465,12 +9473,12 @@ private void checkForUnattachedVolumes(long vmId, List<VolumeVO> volumes) {
 
         for (VolumeVO volume : volumes) {
             if (volume.getInstanceId() == null || vmId != volume.getInstanceId() || volume.getVolumeType() != Volume.Type.DATADISK) {
-                sb.append(volume.toString() + "; ");
+                sb.append(volume + "; ");
             }
         }
 
         if (!StringUtils.isEmpty(sb.toString())) {
-            throw new InvalidParameterValueException("The following supplied volumes are not DATADISK attached to the VM: " + sb.toString());
+            throw new InvalidParameterValueException("The following supplied volumes are not DATADISK attached to the VM: " + sb);
         }
     }
 
@@ -9478,7 +9486,7 @@ private void validateVolumes(List<VolumeVO> volumes) {
 
         for (VolumeVO volume : volumes) {
             if (!(volume.getVolumeType() == Volume.Type.ROOT || volume.getVolumeType() == Volume.Type.DATADISK)) {
-                throw new InvalidParameterValueException("Please specify volume of type " + Volume.Type.DATADISK.toString() + " or " + Volume.Type.ROOT.toString());
+                throw new InvalidParameterValueException("Please specify volume of type " + Volume.Type.DATADISK + " or " + Volume.Type.ROOT);
             }
             if (volume.isDeleteProtection()) {
                 throw new InvalidParameterValueException(String.format(
@@ -9572,7 +9580,7 @@ public UserVm importVM(final DataCenter zone, final Host host, final VirtualMach
 
             final String uuidName = _uuidMgr.generateUuid(UserVm.class, null);
             final Host lastHost = powerState != VirtualMachine.PowerState.PowerOn ? host : null;
-            final Boolean dynamicScalingEnabled = checkIfDynamicScalingCanBeEnabled(null, serviceOffering, template, zone.getId());
+            final boolean dynamicScalingEnabled = checkIfDynamicScalingCanBeEnabled(null, serviceOffering, template, zone.getId());
             return commitUserVm(true, zone, host, lastHost, template, hostName, displayName, owner,
                     null, null, userData, null, null, isDisplayVm, keyboard,
                     accountId, userId, serviceOffering, template.getFormat().equals(ImageFormat.ISO), guestOsId, sshPublicKeys, networkNicMap,
@@ -9634,7 +9642,7 @@ private void updateDetailsWithRootDiskAttributes(Map<String, String> details, Vm
     }
 
     private void checkRootDiskSizeAgainstBackup(Long instanceVolumeSize,DiskOffering rootDiskOffering, Long backupVolumeSize) {
-        Long instanceRootDiskSize = rootDiskOffering.isCustomized() ? instanceVolumeSize : rootDiskOffering.getDiskSize() / GiB_TO_BYTES;
+        long instanceRootDiskSize = rootDiskOffering.isCustomized() ? instanceVolumeSize : rootDiskOffering.getDiskSize() / GiB_TO_BYTES;
         if (instanceRootDiskSize < backupVolumeSize) {
             throw new InvalidParameterValueException(
                     String.format("Instance volume root disk size %d[GiB] cannot be less than the backed-up volume size %d[GiB].",
@@ -9711,7 +9719,7 @@ public UserVm allocateVMFromBackup(CreateVMFromBackupCmd cmd) throws Insufficien
         Long size = cmd.getSize();
 
         Long diskOfferingId = cmd.getDiskOfferingId();
-        Boolean isIso = template.getFormat().equals(ImageFormat.ISO);
+        boolean isIso = template.getFormat().equals(ImageFormat.ISO);
         if (diskOfferingId != null) {
             if (!isIso) {
                 throw new InvalidParameterValueException(ApiConstants.DISK_OFFERING_ID + " parameter is supported for creating instance from backup only for ISO. For creating VMs with templates, please use the parameter " + ApiConstants.DATADISKS_DETAILS);
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index cb15298fbf33..f752dc31f181 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -59,12 +59,6 @@
 import java.util.TimeZone;
 import java.util.UUID;
 
-import com.cloud.network.as.AutoScaleManager;
-import com.cloud.network.dao.FirewallRulesDao;
-import com.cloud.network.dao.IPAddressDao;
-import com.cloud.network.dao.IPAddressVO;
-import com.cloud.network.dao.LoadBalancerVMMapDao;
-import com.cloud.network.dao.LoadBalancerVMMapVO;
 import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.acl.SecurityChecker;
 import org.apache.cloudstack.api.ApiCommandResourceType;
@@ -99,6 +93,7 @@
 import org.apache.cloudstack.userdata.UserDataManager;
 import org.apache.cloudstack.vm.UnmanagedVMsManager;
 import org.apache.cloudstack.vm.lease.VMLeaseManager;
+
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -141,11 +136,17 @@
 import com.cloud.kubernetes.cluster.KubernetesServiceHelper;
 import com.cloud.network.Network;
 import com.cloud.network.NetworkModel;
+import com.cloud.network.as.AutoScaleManager;
+import com.cloud.network.dao.FirewallRulesDao;
+import com.cloud.network.dao.IPAddressDao;
+import com.cloud.network.dao.IPAddressVO;
+import com.cloud.network.dao.LoadBalancerVMMapDao;
+import com.cloud.network.dao.LoadBalancerVMMapVO;
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
-import com.cloud.network.element.UserDataServiceProvider;
 import com.cloud.network.dao.PhysicalNetworkDao;
 import com.cloud.network.dao.PhysicalNetworkVO;
+import com.cloud.network.element.UserDataServiceProvider;
 import com.cloud.network.guru.NetworkGuru;
 import com.cloud.network.rules.FirewallRuleVO;
 import com.cloud.network.rules.PortForwardingRule;
@@ -455,7 +456,7 @@ public class UserVmManagerImplTest {
     @Mock
     ServiceOfferingDetailsDao serviceOfferingDetailsDao;
 
-    private static final long vmId = 1l;
+    private static final long vmId = 1L;
     private static final long zoneId = 2L;
     private static final long accountId = 3L;
     private static final long serviceOfferingId = 10L;
@@ -470,8 +471,8 @@ public class UserVmManagerImplTest {
 
     String[] detailsConstants = {VmDetailConstants.MEMORY, VmDetailConstants.CPU_NUMBER, VmDetailConstants.CPU_SPEED};
 
-    private DiskOfferingVO smallerDisdkOffering = prepareDiskOffering(5l * GiB_TO_BYTES, 1l, 1L, 2L);
-    private DiskOfferingVO largerDisdkOffering = prepareDiskOffering(10l * GiB_TO_BYTES, 2l, 10L, 20L);
+    private DiskOfferingVO smallerDisdkOffering = prepareDiskOffering(5L * GiB_TO_BYTES, 1L, 1L, 2L);
+    private DiskOfferingVO largerDisdkOffering = prepareDiskOffering(10L * GiB_TO_BYTES, 2L, 10L, 20L);
     Class<InvalidParameterValueException> expectedInvalidParameterValueException = InvalidParameterValueException.class;
     Class<CloudRuntimeException> expectedCloudRuntimeException = CloudRuntimeException.class;
 
@@ -514,15 +515,15 @@ public void validateGuestOsIdForUpdateVirtualMachineCommandTestOsTypeNull() {
 
     @Test(expected = InvalidParameterValueException.class)
     public void validateGuestOsIdForUpdateVirtualMachineCommandTestOsTypeNotFound() {
-        Mockito.when(updateVmCommand.getOsTypeId()).thenReturn(1l);
+        Mockito.when(updateVmCommand.getOsTypeId()).thenReturn(1L);
 
         userVmManagerImpl.validateGuestOsIdForUpdateVirtualMachineCommand(updateVmCommand);
     }
 
     @Test
     public void validateGuestOsIdForUpdateVirtualMachineCommandTestOsTypeFound() {
-        Mockito.when(updateVmCommand.getOsTypeId()).thenReturn(1l);
-        Mockito.when(guestOSDao.findById(1l)).thenReturn(Mockito.mock(GuestOSVO.class));
+        Mockito.when(updateVmCommand.getOsTypeId()).thenReturn(1L);
+        Mockito.when(guestOSDao.findById(1L)).thenReturn(Mockito.mock(GuestOSVO.class));
 
         userVmManagerImpl.validateGuestOsIdForUpdateVirtualMachineCommand(updateVmCommand);
     }
@@ -541,11 +542,10 @@ private ServiceOfferingVO getSvcoffering(int ramSize) {
         int speed = 128;
 
         boolean ha = false;
-        boolean useLocalStorage = false;
 
         ServiceOfferingVO serviceOffering = new ServiceOfferingVO(name, cpu, ramSize, speed, null, null, ha, displayText, false, null,
                 false);
-        serviceOffering.setDiskOfferingId(1l);
+        serviceOffering.setDiskOfferingId(1L);
         return serviceOffering;
     }
 
@@ -686,7 +686,6 @@ private void verifyMethodsThatAreAlwaysExecuted() throws ResourceUnavailableExce
 
     }
 
-    @SuppressWarnings("unchecked")
     private void configureDoNothingForMethodsThatWeDoNotWantToTest() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
         Mockito.doNothing().when(userVmManagerImpl).validateInputsAndPermissionForUpdateVirtualMachineCommand(updateVmCommand);
         Mockito.doReturn(new ArrayList<Long>()).when(userVmManagerImpl).getSecurityGroupIdList(updateVmCommand);
@@ -758,7 +757,7 @@ private void configureValidateOrReplaceMacAddressTest(int times, String macAddre
     }
 
     @Test
-    public void testValidatekeyValuePair() throws Exception {
+    public void testValidatekeyValuePair() {
         assertTrue(userVmManagerImpl.isValidKeyValuePair("is-a-template=true\nHVM-boot-policy=\nPV-bootloader=pygrub\nPV-args=hvc0"));
         assertTrue(userVmManagerImpl.isValidKeyValuePair("is-a-template=true HVM-boot-policy= PV-bootloader=pygrub PV-args=hvc0"));
         assertTrue(userVmManagerImpl.isValidKeyValuePair("nvp.vm-uuid=34b3d5ea-1c25-4bb0-9250-8dc3388bfa9b"));
@@ -774,8 +773,8 @@ public void configureCustomRootDiskSizeTest() {
         String vmDetailsRootDiskSize = "123";
         Map<String, String> customParameters = new HashMap<>();
         customParameters.put(VmDetailConstants.ROOT_DISK_SIZE, vmDetailsRootDiskSize);
-        long expectedRootDiskSize = 123l * GiB_TO_BYTES;
-        long offeringRootDiskSize = 0l;
+        long expectedRootDiskSize = 123L * GiB_TO_BYTES;
+        long offeringRootDiskSize = 0L;
         prepareAndRunConfigureCustomRootDiskSizeTest(customParameters, expectedRootDiskSize, 1, offeringRootDiskSize);
     }
 
@@ -784,8 +783,8 @@ public void configureCustomRootDiskSizeTestExpectExceptionZero() {
         String vmDetailsRootDiskSize = "0";
         Map<String, String> customParameters = new HashMap<>();
         customParameters.put(VmDetailConstants.ROOT_DISK_SIZE, vmDetailsRootDiskSize);
-        long expectedRootDiskSize = 0l;
-        long offeringRootDiskSize = 0l;
+        long expectedRootDiskSize = 0L;
+        long offeringRootDiskSize = 0L;
         prepareAndRunConfigureCustomRootDiskSizeTest(customParameters, expectedRootDiskSize, 1, offeringRootDiskSize);
     }
 
@@ -794,31 +793,31 @@ public void configureCustomRootDiskSizeTestExpectExceptionNegativeNum() {
         String vmDetailsRootDiskSize = "-123";
         Map<String, String> customParameters = new HashMap<>();
         customParameters.put(VmDetailConstants.ROOT_DISK_SIZE, vmDetailsRootDiskSize);
-        long expectedRootDiskSize = -123l * GiB_TO_BYTES;
-        long offeringRootDiskSize = 0l;
+        long expectedRootDiskSize = -123L * GiB_TO_BYTES;
+        long offeringRootDiskSize = 0L;
         prepareAndRunConfigureCustomRootDiskSizeTest(customParameters, expectedRootDiskSize, 1, offeringRootDiskSize);
     }
 
     @Test
     public void configureCustomRootDiskSizeTestEmptyParameters() {
         Map<String, String> customParameters = new HashMap<>();
-        long expectedRootDiskSize = 99l * GiB_TO_BYTES;
-        long offeringRootDiskSize = 0l;
+        long expectedRootDiskSize = 99L * GiB_TO_BYTES;
+        long offeringRootDiskSize = 0L;
         prepareAndRunConfigureCustomRootDiskSizeTest(customParameters, expectedRootDiskSize, 1, offeringRootDiskSize);
     }
 
     @Test
     public void configureCustomRootDiskSizeTestEmptyParametersAndOfferingRootSize() {
         Map<String, String> customParameters = new HashMap<>();
-        long expectedRootDiskSize = 10l * GiB_TO_BYTES;
-        long offeringRootDiskSize = 10l * GiB_TO_BYTES;
+        long expectedRootDiskSize = 10L * GiB_TO_BYTES;
+        long offeringRootDiskSize = 10L * GiB_TO_BYTES;
 
         prepareAndRunConfigureCustomRootDiskSizeTest(customParameters, expectedRootDiskSize, 1, offeringRootDiskSize);
     }
 
     private void prepareAndRunConfigureCustomRootDiskSizeTest(Map<String, String> customParameters, long expectedRootDiskSize, int timesVerifyIfHypervisorSupports, Long offeringRootDiskSize) {
         VMTemplateVO template = Mockito.mock(VMTemplateVO.class);
-        Mockito.when(template.getId()).thenReturn(1l);
+        Mockito.when(template.getId()).thenReturn(1L);
         Mockito.when(template.getSize()).thenReturn(99L * GiB_TO_BYTES);
         Mockito.when(templateDao.findById(Mockito.anyLong())).thenReturn(template);
 
@@ -887,7 +886,7 @@ public void prepareResizeVolumeCmdTestSameOfferingSize() {
 
     @Test
     public void prepareResizeVolumeCmdTestOfferingRootSizeZero() {
-        DiskOfferingVO rootSizeZero = prepareDiskOffering(0l, 3l, 100L, 200L);
+        DiskOfferingVO rootSizeZero = prepareDiskOffering(0L, 3L, 100L, 200L);
         prepareAndRunResizeVolumeTest(null, 100L, 200L, smallerDisdkOffering, rootSizeZero);
     }
 
@@ -897,7 +896,7 @@ public void prepareResizeVolumeCmdTestNewOfferingSmaller() {
     }
 
     private void prepareAndRunResizeVolumeTest(Long expectedOfferingId, long expectedMinIops, long expectedMaxIops, DiskOfferingVO currentRootDiskOffering, DiskOfferingVO newRootDiskOffering) {
-        long rootVolumeId = 1l;
+        long rootVolumeId = 1L;
         VolumeVO rootVolumeOfVm = Mockito.mock(VolumeVO.class);
         Mockito.when(rootVolumeOfVm.getId()).thenReturn(rootVolumeId);
 
@@ -944,7 +943,7 @@ public void testUserDataAllowOverride() {
 
         String finalUserdata = userVmManagerImpl.finalizeUserData(null, userDataId, template);
 
-        Assert.assertEquals(finalUserdata, templateUserData);
+        Assert.assertEquals(templateUserData, finalUserdata);
     }
 
     @Test
@@ -961,7 +960,7 @@ public void testUserDataWithoutTemplate() {
 
         String finalUserdata = userVmManagerImpl.finalizeUserData(null, userDataId, template);
 
-        Assert.assertEquals(finalUserdata, userData);
+        Assert.assertEquals(userData, finalUserdata);
     }
 
     @Test
@@ -977,7 +976,7 @@ public void testUserDataAllowOverrideWithoutAPIuserdata() {
 
         String finalUserdata = userVmManagerImpl.finalizeUserData(null, null, template);
 
-        Assert.assertEquals(finalUserdata, templateUserData);
+        Assert.assertEquals(templateUserData, finalUserdata);
     }
 
     @Test
@@ -988,7 +987,7 @@ public void testUserDataAllowOverrideWithUserdataText() {
 
         String finalUserdata = userVmManagerImpl.finalizeUserData(userData, null, template);
 
-        Assert.assertEquals(finalUserdata, userData);
+        Assert.assertEquals(userData, finalUserdata);
     }
 
     @Test(expected = InvalidParameterValueException.class)
@@ -1009,9 +1008,7 @@ public void testResetVMUserDataVMStateNotStopped() {
 
         try {
             userVmManagerImpl.resetVMUserData(cmd);
-        } catch (ResourceUnavailableException e) {
-            throw new RuntimeException(e);
-        } catch (InsufficientCapacityException e) {
+        } catch (ResourceUnavailableException | InsufficientCapacityException e) {
             throw new RuntimeException(e);
         }
     }
@@ -1037,9 +1034,7 @@ public void testResetVMUserDataDontAcceptBothUserdataAndUserdataId() {
 
         try {
             userVmManagerImpl.resetVMUserData(cmd);
-        } catch (ResourceUnavailableException e) {
-            throw new RuntimeException(e);
-        } catch (InsufficientCapacityException e) {
+        } catch (ResourceUnavailableException | InsufficientCapacityException e) {
             throw new RuntimeException(e);
         }
     }
@@ -1073,14 +1068,12 @@ public void testResetVMUserDataSuccessResetWithUserdata() {
         try {
             doNothing().when(userVmManagerImpl).updateUserData(userVmVO);
             userVmManagerImpl.resetVMUserData(cmd);
-        } catch (ResourceUnavailableException e) {
-            throw new RuntimeException(e);
-        } catch (InsufficientCapacityException e) {
+        } catch (ResourceUnavailableException | InsufficientCapacityException e) {
             throw new RuntimeException(e);
         }
 
         Assert.assertEquals("testUserdata", userVmVO.getUserData());
-        Assert.assertEquals(null, userVmVO.getUserDataId());
+        Assert.assertNull(userVmVO.getUserDataId());
     }
 
     @Test
@@ -1114,9 +1107,7 @@ public void testResetVMUserDataSuccessResetWithUserdataId() {
         try {
             doNothing().when(userVmManagerImpl).updateUserData(userVmVO);
             userVmManagerImpl.resetVMUserData(cmd);
-        } catch (ResourceUnavailableException e) {
-            throw new RuntimeException(e);
-        } catch (InsufficientCapacityException e) {
+        } catch (ResourceUnavailableException | InsufficientCapacityException e) {
             throw new RuntimeException(e);
         }
 
@@ -1491,10 +1482,10 @@ public void testRestoreVMWithVolumeSnapshots() throws ResourceUnavailableExcepti
     }
 
     @Test(expected = InvalidParameterValueException.class)
-    public void testRestoreVirtualMachineNoOwner() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        long userId = 1l;
-        long accountId = 2l;
-        long newTemplateId = 2l;
+    public void testRestoreVirtualMachineNoOwner() throws ResourceUnavailableException, InsufficientCapacityException {
+        long userId = 1L;
+        long accountId = 2L;
+        long newTemplateId = 2L;
         when(accountMock.getId()).thenReturn(userId);
         when(userVmDao.findById(vmId)).thenReturn(userVmVoMock);
         when(userVmVoMock.getAccountId()).thenReturn(accountId);
@@ -1504,10 +1495,10 @@ public void testRestoreVirtualMachineNoOwner() throws ResourceUnavailableExcepti
     }
 
     @Test(expected = PermissionDeniedException.class)
-    public void testRestoreVirtualMachineOwnerDisabled() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        long userId = 1l;
-        long accountId = 2l;
-        long newTemplateId = 2l;
+    public void testRestoreVirtualMachineOwnerDisabled() throws ResourceUnavailableException, InsufficientCapacityException {
+        long userId = 1L;
+        long accountId = 2L;
+        long newTemplateId = 2L;
         when(accountMock.getId()).thenReturn(userId);
         when(userVmDao.findById(vmId)).thenReturn(userVmVoMock);
         when(userVmVoMock.getAccountId()).thenReturn(accountId);
@@ -1518,10 +1509,10 @@ public void testRestoreVirtualMachineOwnerDisabled() throws ResourceUnavailableE
     }
 
     @Test(expected = CloudRuntimeException.class)
-    public void testRestoreVirtualMachineNotInRightState() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        long userId = 1l;
-        long accountId = 2l;
-        long newTemplateId = 2l;
+    public void testRestoreVirtualMachineNotInRightState() throws ResourceUnavailableException, InsufficientCapacityException {
+        long userId = 1L;
+        long accountId = 2L;
+        long newTemplateId = 2L;
         when(accountMock.getId()).thenReturn(userId);
         when(userVmDao.findById(vmId)).thenReturn(userVmVoMock);
         when(userVmVoMock.getAccountId()).thenReturn(accountId);
@@ -1533,11 +1524,11 @@ public void testRestoreVirtualMachineNotInRightState() throws ResourceUnavailabl
     }
 
     @Test(expected = InvalidParameterValueException.class)
-    public void testRestoreVirtualMachineNoRootVolume() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        long userId = 1l;
-        long accountId = 2l;
-        long currentTemplateId = 1l;
-        long newTemplateId = 2l;
+    public void testRestoreVirtualMachineNoRootVolume() throws ResourceUnavailableException, InsufficientCapacityException {
+        long userId = 1L;
+        long accountId = 2L;
+        long currentTemplateId = 1L;
+        long newTemplateId = 2L;
         when(accountMock.getId()).thenReturn(userId);
         when(userVmDao.findById(vmId)).thenReturn(userVmVoMock);
         when(userVmVoMock.getAccountId()).thenReturn(accountId);
@@ -1548,17 +1539,17 @@ public void testRestoreVirtualMachineNoRootVolume() throws ResourceUnavailableEx
 
         VMTemplateVO currentTemplate = Mockito.mock(VMTemplateVO.class);
         when(templateDao.findById(currentTemplateId)).thenReturn(currentTemplate);
-        when(volumeDaoMock.findByInstanceAndType(vmId, Volume.Type.ROOT)).thenReturn(new ArrayList<VolumeVO>());
+        when(volumeDaoMock.findByInstanceAndType(vmId, Volume.Type.ROOT)).thenReturn(new ArrayList<>());
 
         userVmManagerImpl.restoreVirtualMachine(accountMock, vmId, newTemplateId, null, false, null);
     }
 
     @Test(expected = InvalidParameterValueException.class)
-    public void testRestoreVirtualMachineMoreThanOneRootVolume() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        long userId = 1l;
-        long accountId = 2l;
-        long currentTemplateId = 1l;
-        long newTemplateId = 2l;
+    public void testRestoreVirtualMachineMoreThanOneRootVolume() throws ResourceUnavailableException, InsufficientCapacityException {
+        long userId = 1L;
+        long accountId = 2L;
+        long currentTemplateId = 1L;
+        long newTemplateId = 2L;
         when(accountMock.getId()).thenReturn(userId);
         when(userVmDao.findById(vmId)).thenReturn(userVmVoMock);
         when(userVmVoMock.getAccountId()).thenReturn(accountId);
@@ -1581,11 +1572,11 @@ public void testRestoreVirtualMachineMoreThanOneRootVolume() throws ResourceUnav
     }
 
     @Test(expected = InvalidParameterValueException.class)
-    public void testRestoreVirtualMachineWithVMSnapshots() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        long userId = 1l;
-        long accountId = 2l;
-        long currentTemplateId = 1l;
-        long newTemplateId = 2l;
+    public void testRestoreVirtualMachineWithVMSnapshots() throws ResourceUnavailableException, InsufficientCapacityException {
+        long userId = 1L;
+        long accountId = 2L;
+        long currentTemplateId = 1L;
+        long newTemplateId = 2L;
         when(accountMock.getId()).thenReturn(userId);
         when(userVmDao.findById(vmId)).thenReturn(userVmVoMock);
         when(userVmVoMock.getAccountId()).thenReturn(accountId);
@@ -1615,9 +1606,9 @@ public void addCurrentDetailValueToInstanceDetailsMapIfNewValueWasNotSpecifiedTe
             userVmManagerImpl.addCurrentDetailValueToInstanceDetailsMapIfNewValueWasNotSpecified(null, customParameters, detailsConstant, currentValue);
         }
 
-        Assert.assertEquals(customParameters.get(VmDetailConstants.MEMORY), "2048");
-        Assert.assertEquals(customParameters.get(VmDetailConstants.CPU_NUMBER), "4");
-        Assert.assertEquals(customParameters.get(VmDetailConstants.CPU_SPEED), "1000");
+        Assert.assertEquals("2048", customParameters.get(VmDetailConstants.MEMORY));
+        Assert.assertEquals("4", customParameters.get(VmDetailConstants.CPU_NUMBER));
+        Assert.assertEquals("1000", customParameters.get(VmDetailConstants.CPU_SPEED));
     }
 
     @Test
@@ -1656,9 +1647,9 @@ public void addCurrentDetailValueToInstanceDetailsMapIfNewValueWasNotSpecifiedTe
             userVmManagerImpl.addCurrentDetailValueToInstanceDetailsMapIfNewValueWasNotSpecified(321, customParameters, detailsConstant, currentValue);
         }
 
-        Assert.assertEquals(customParameters.get(VmDetailConstants.MEMORY), "2048");
-        Assert.assertEquals(customParameters.get(VmDetailConstants.CPU_NUMBER), "4");
-        Assert.assertEquals(customParameters.get(VmDetailConstants.CPU_SPEED),"1000");
+        Assert.assertEquals("2048", customParameters.get(VmDetailConstants.MEMORY));
+        Assert.assertEquals("4", customParameters.get(VmDetailConstants.CPU_NUMBER));
+        Assert.assertEquals("1000", customParameters.get(VmDetailConstants.CPU_SPEED));
     }
 
     @Test
@@ -1667,7 +1658,7 @@ public void updateInstanceDetailsMapWithCurrentValuesForAbsentDetailsTestAllCons
         Mockito.doReturn(1L).when(vmInstanceMock).getId();
         Mockito.doReturn(1L).when(vmInstanceMock).getServiceOfferingId();
         Mockito.doReturn(serviceOffering).when(_serviceOfferingDao).findByIdIncludingRemoved(Mockito.anyLong(), Mockito.anyLong());
-        userVmManagerImpl.updateInstanceDetailsMapWithCurrentValuesForAbsentDetails(null, vmInstanceMock, 0l);
+        userVmManagerImpl.updateInstanceDetailsMapWithCurrentValuesForAbsentDetails(null, vmInstanceMock, 0L);
 
         Mockito.verify(userVmManagerImpl).addCurrentDetailValueToInstanceDetailsMapIfNewValueWasNotSpecified(Mockito.any(), Mockito.any(), Mockito.eq(VmDetailConstants.CPU_SPEED), Mockito.any());
         Mockito.verify(userVmManagerImpl).addCurrentDetailValueToInstanceDetailsMapIfNewValueWasNotSpecified(Mockito.any(), Mockito.any(), Mockito.eq(VmDetailConstants.MEMORY), Mockito.any());
@@ -1830,10 +1821,10 @@ public void checkExpungeVmPermissionTestAccountIsAdminHasApiAccessReturnNothing
 
     @Test
     public void validateIfVmSupportsMigrationTestVmIsNullThrowsInvalidParameterValueException() {
-        String expectedMessage = String.format("There is no VM by ID [%s].", 1l);
+        String expectedMessage = String.format("There is no VM by ID [%s].", 1L);
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateIfVmSupportsMigration(null, 1l);
+            userVmManagerImpl.validateIfVmSupportsMigration(null, 1L);
         });
 
         Assert.assertEquals(expectedMessage, assertThrows.getMessage());
@@ -1845,7 +1836,7 @@ public void validateIfVmSupportsMigrationTestVmIsRunningThrowsInvalidParameterVa
         Mockito.doReturn(VirtualMachine.State.Running).when(userVmVoMock).getState();
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateIfVmSupportsMigration(userVmVoMock, 1l);
+            userVmManagerImpl.validateIfVmSupportsMigration(userVmVoMock, 1L);
         });
 
         Assert.assertEquals(expectedMessage, assertThrows.getMessage());
@@ -1856,7 +1847,7 @@ public void validateIfVmSupportsMigrationTestVmIsSharedFileSystemInstanceThrowsI
         Mockito.doReturn(UserVmManager.SHAREDFSVM).when(userVmVoMock).getUserVmType();
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateIfVmSupportsMigration(userVmVoMock, 1l);
+            userVmManagerImpl.validateIfVmSupportsMigration(userVmVoMock, 1L);
         });
 
         Assert.assertEquals("Migration is not supported for Shared FileSystem Instances.", assertThrows.getMessage());
@@ -1864,13 +1855,13 @@ public void validateIfVmSupportsMigrationTestVmIsSharedFileSystemInstanceThrowsI
 
     @Test
     public void validateIfVmSupportsMigrationTestVmIsNotRunningDoesNotThrowInvalidParameterValueException() {
-        userVmManagerImpl.validateIfVmSupportsMigration(userVmVoMock, 1l);
+        userVmManagerImpl.validateIfVmSupportsMigration(userVmVoMock, 1L);
     }
 
     @Test
     public void validateOldAndNewAccountsTestBothAreValidDoNothing() {
         Account newAccount = Mockito.mock(Account.class);
-        Mockito.doReturn(1l).when(newAccount).getAccountId();
+        Mockito.doReturn(1L).when(newAccount).getAccountId();
 
         userVmManagerImpl.validateOldAndNewAccounts(accountMock, newAccount, 1L, "", 1L);
     }
@@ -1891,7 +1882,7 @@ public void validateOldAndNewAccountsTestNewAccountIsNullThrowsInvalidParameterV
         String expectedMessage = String.format("Invalid new account [%s] for VM in domain [%s].", assignVmCmdMock.getAccountName(), assignVmCmdMock.getDomainId());
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateOldAndNewAccounts(accountMock, null, 1l, assignVmCmdMock.getAccountName(), assignVmCmdMock.getDomainId());
+            userVmManagerImpl.validateOldAndNewAccounts(accountMock, null, 1L, assignVmCmdMock.getAccountName(), assignVmCmdMock.getDomainId());
         });
 
         Assert.assertEquals(expectedMessage, assertThrows.getMessage());
@@ -1899,12 +1890,12 @@ public void validateOldAndNewAccountsTestNewAccountIsNullThrowsInvalidParameterV
 
     @Test
     public void validateOldAndNewAccountsTestNewAccountStateIsDisabledThrowsInvalidParameterValueException() {
-        String expectedMessage = String.format("The new account owner [%s] is disabled.", accountMock.toString());
+        String expectedMessage = String.format("The new account owner [%s] is disabled.", accountMock);
 
         Mockito.doReturn(Account.State.DISABLED).when(accountMock).getState();
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateOldAndNewAccounts(accountMock, accountMock, 1l, "", 1l);
+            userVmManagerImpl.validateOldAndNewAccounts(accountMock, accountMock, 1L, "", 1L);
         });
 
         Assert.assertEquals(expectedMessage, assertThrows.getMessage());
@@ -1912,12 +1903,12 @@ public void validateOldAndNewAccountsTestNewAccountStateIsDisabledThrowsInvalidP
 
     @Test
     public void validateOldAndNewAccountsTestOldAccountIsTheSameAsNewAccountThrowsInvalidParameterValueException() {
-        String expectedMessage = String.format("The new account [%s] is the same as the old account.", accountMock.toString());
+        String expectedMessage = String.format("The new account [%s] is the same as the old account.", accountMock);
 
         Mockito.doReturn(Account.State.ENABLED).when(accountMock).getState();
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateOldAndNewAccounts(accountMock, accountMock, 1l, "", 1l);
+            userVmManagerImpl.validateOldAndNewAccounts(accountMock, accountMock, 1L, "", 1L);
         });
 
         Assert.assertEquals(expectedMessage, assertThrows.getMessage());
@@ -1926,9 +1917,9 @@ public void validateOldAndNewAccountsTestOldAccountIsTheSameAsNewAccountThrowsIn
     @Test
     public void validateOldAndNewAccountsTestOldAccountIsNotTheSameAsNewAccountDoesNotThrowInvalidParameterValueException() {
         AccountVO oldAccount = new AccountVO();
-        Mockito.doReturn(1l).when(accountMock).getAccountId();
+        Mockito.doReturn(1L).when(accountMock).getAccountId();
 
-        userVmManagerImpl.validateOldAndNewAccounts(oldAccount, accountMock, 1l, "", 1l);
+        userVmManagerImpl.validateOldAndNewAccounts(oldAccount, accountMock, 1L, "", 1L);
     }
 
     @Test
@@ -1948,7 +1939,7 @@ public void validateIfVmHasNoRulesTestPortForwardingRulesExistThrowsInvalidParam
         Mockito.doReturn(portForwardingRulesListMock).when(portForwardingRulesDaoMock).listByVm(Mockito.anyLong());
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1l);
+            userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1L);
         });
 
         Assert.assertEquals(expectedMessage, assertThrows.getMessage());
@@ -1961,7 +1952,7 @@ public void validateIfVmHasNoRulesTestStaticNatRulesExistThrowsInvalidParameterV
         Mockito.doReturn(firewallRuleVoListMock).when(firewallRulesDaoMock).listStaticNatByVmId(Mockito.anyLong());
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1l);
+            userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1L);
         });
 
         Assert.assertEquals(expectedMessage, assertThrows.getMessage());
@@ -1974,7 +1965,7 @@ public void validateIfVmHasNoRulesTestLoadBalancingRulesExistThrowsInvalidParame
         Mockito.doReturn(loadBalancerVmMapVoListMock).when(loadBalancerVmMapDaoMock).listByInstanceId(Mockito.anyLong());
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1l);
+            userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1L);
         });
 
         Assert.assertEquals(expectedMessage, assertThrows.getMessage());
@@ -1984,14 +1975,14 @@ public void validateIfVmHasNoRulesTestLoadBalancingRulesExistThrowsInvalidParame
     public void validateIfVmHasNoRulesTestOneToOneNatRulesExistThrowsInvalidParameterValueException() {
         String expectedMessage = String.format("Remove the One to One Nat rule for VM [%s] for IP [%s].", userVmVoMock, ipAddressVoMock.toString());
 
-        LinkedList<IPAddressVO> ipAddressVoList = new LinkedList<IPAddressVO>();
+        LinkedList<IPAddressVO> ipAddressVoList = new LinkedList<>();
 
         Mockito.doReturn(ipAddressVoList).when(ipAddressDaoMock).findAllByAssociatedVmId(Mockito.anyLong());
         ipAddressVoList.add(ipAddressVoMock);
         Mockito.doReturn(true).when(ipAddressVoMock).isOneToOneNat();
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
-            userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1l);
+            userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1L);
         });
 
         Assert.assertEquals(expectedMessage, assertThrows.getMessage());
@@ -1999,13 +1990,13 @@ public void validateIfVmHasNoRulesTestOneToOneNatRulesExistThrowsInvalidParamete
 
     @Test
     public void validateIfVmHasNoRulesTestOneToOneNatRulesDoNotExistDoesNotThrowInvalidParameterValueException() {
-        userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1l);
+        userVmManagerImpl.validateIfVmHasNoRules(userVmVoMock, 1L);
     }
 
     @Test
     public void verifyResourceLimitsForAccountAndStorageTestCountOnlyRunningVmsInResourceLimitationIsTrueDoesNotCallVmResourceLimitCheck() throws ResourceAllocationException {
         List<Reserver> reservations = new ArrayList<>();
-        LinkedList<VolumeVO> volumeVoList = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumeVoList = new LinkedList<>();
         Mockito.doReturn(true).when(userVmManagerImpl).countOnlyRunningVmsInResourceLimitation();
 
         userVmManagerImpl.verifyResourceLimitsForAccountAndStorage(accountMock, userVmVoMock, serviceOfferingVoMock, volumeVoList, virtualMachineTemplateMock, reservations);
@@ -2017,7 +2008,7 @@ public void verifyResourceLimitsForAccountAndStorageTestCountOnlyRunningVmsInRes
     @Test
     public void verifyResourceLimitsForAccountAndStorageTestCountOnlyRunningVmsInResourceLimitationIsFalseCallsVmResourceLimitCheck() throws ResourceAllocationException {
         List<Reserver> reservations = new ArrayList<>();
-        LinkedList<VolumeVO> volumeVoList = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumeVoList = new LinkedList<>();
         Mockito.doReturn(false).when(userVmManagerImpl).countOnlyRunningVmsInResourceLimitation();
 
         userVmManagerImpl.verifyResourceLimitsForAccountAndStorage(accountMock, userVmVoMock, serviceOfferingVoMock, volumeVoList, virtualMachineTemplateMock, reservations);
@@ -2046,7 +2037,7 @@ public void validateIfNewOwnerHasAccessToTemplateTestCallCheckAccessWhenTemplate
 
     @Test
     public void updateVmOwnerTestCallsSetAccountIdSetDomainIdAndPersist() {
-        userVmManagerImpl.updateVmOwner(accountMock, userVmVoMock, 1l, 1l);
+        userVmManagerImpl.updateVmOwner(accountMock, userVmVoMock, 1L, 1L);
 
         Mockito.verify(userVmVoMock).setAccountId(Mockito.anyLong());
         Mockito.verify(userVmVoMock).setDomainId(Mockito.anyLong());
@@ -2107,7 +2098,7 @@ public void addDefaultNetworkToNetworkListTestDefaultNetworkIsNotNullAddNetworkT
 
     @Test
     public void allocateNetworksForVmTestCallsNetworkManagerAllocate() throws InsufficientCapacityException {
-        LinkedHashMap<Network, List<? extends NicProfile>> networks = new LinkedHashMap<Network, List<? extends NicProfile>>();
+        LinkedHashMap<Network, List<? extends NicProfile>> networks = new LinkedHashMap<>();
 
         Mockito.doReturn(userVmVoMock).when(virtualMachineManager).findById(Mockito.anyLong());
 
@@ -2119,7 +2110,7 @@ public void allocateNetworksForVmTestCallsNetworkManagerAllocate() throws Insuff
     @Test
     public void addSecurityGroupsToVmTestIsVmWareAndSecurityGroupIdListIsNotNullThrowsInvalidParameterValueException() {
         String expectedMessage = "Security group feature is not supported for VMWare hypervisor.";
-        LinkedList<Long> securityGroupIdList = new LinkedList<Long>();
+        LinkedList<Long> securityGroupIdList = new LinkedList<>();
 
         Mockito.doReturn(Hypervisor.HypervisorType.VMware).when(virtualMachineTemplateMock).getHypervisorType();
 
@@ -2132,7 +2123,7 @@ public void addSecurityGroupsToVmTestIsVmWareAndSecurityGroupIdListIsNotNullThro
 
     @Test
     public void addSecurityGroupsToVmTestIsNotVmWareDefaultNetworkIsNullAndNetworkModelCanAddDefaultSecurityGroupCallsAddDefaultSecurityGroupToSecurityGroupIdList() {
-        LinkedList<Long> securityGroupIdList = new LinkedList<Long>();
+        LinkedList<Long> securityGroupIdList = new LinkedList<>();
 
         Mockito.doReturn(Hypervisor.HypervisorType.KVM).when(virtualMachineTemplateMock).getHypervisorType();
         Mockito.doReturn(true).when(networkModel).canAddDefaultSecurityGroup();
@@ -2146,10 +2137,10 @@ public void addSecurityGroupsToVmTestIsNotVmWareDefaultNetworkIsNullAndNetworkMo
 
     @Test
     public void addNetworksToNetworkIdListTestCallsKeepOldSharedNetworkForVmAndAddAdditionalNetworksToVm() {
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = new HashSet<NetworkVO>();
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = new HashSet<>();
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
         userVmManagerImpl.addNetworksToNetworkIdList(userVmVoMock, accountMock, networkIdList, applicableNetworks, requestedIPv4ForNics,
                 requestedIPv6ForNics);
@@ -2175,14 +2166,14 @@ public void getOfferingWithRequiredAvailabilityForNetworkCreationTestRequiredOff
 
     @Test
     public void getOfferingWithRequiredAvailabilityForNetworkCreationTestFirstOfferingIsNotEnabledThrowsInvalidParameterValueException() {
-        String expectedMessage = String.format("Required network offering ID [%s] is not in [%s] state.", 1l, NetworkOffering.State.Enabled);
+        String expectedMessage = String.format("Required network offering ID [%s] is not in [%s] state.", 1L, NetworkOffering.State.Enabled);
 
         Mockito.doReturn(networkOfferingVoListMock).when(networkOfferingDaoMock).listByAvailability(NetworkOffering.Availability.Required, false);
         Mockito.doReturn(networkOfferingVoMock).when(networkOfferingVoListMock).get(0);
 
         Mockito.doReturn(NetworkOffering.State.Disabled).when(networkOfferingVoMock).getState();
 
-        Mockito.doReturn(1l).when(networkOfferingVoMock).getId();
+        Mockito.doReturn(1L).when(networkOfferingVoMock).getId();
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
             userVmManagerImpl.getOfferingWithRequiredAvailabilityForNetworkCreation();
@@ -2205,9 +2196,9 @@ public void selectApplicableNetworkToCreateVmTestVirtualNetworkIsEmptyThrowsExce
 
     @Test
     public void selectApplicableNetworkToCreateVmTestVirtualNetworkHasMultipleNetworksThrowsInvalidParameterValueException() {
-        String expectedMessage = String.format("More than one default isolated network has been found for account [%s]; please specify networkIDs.", accountMock.toString());
-        HashSet<NetworkVO> applicableNetworks = new HashSet<NetworkVO>();
-        LinkedList<NetworkVO> virtualNetworks = new LinkedList<NetworkVO>();
+        String expectedMessage = String.format("More than one default isolated network has been found for account [%s]; please specify networkIDs.", accountMock);
+        HashSet<NetworkVO> applicableNetworks = new HashSet<>();
+        LinkedList<NetworkVO> virtualNetworks = new LinkedList<>();
 
         Mockito.doReturn(virtualNetworks).when(networkModel).listNetworksForAccount(Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
 
@@ -2223,7 +2214,7 @@ public void selectApplicableNetworkToCreateVmTestVirtualNetworkHasMultipleNetwor
 
     @Test
     public void selectApplicableNetworkToCreateVmTestVirtualNetworkHasOneNetworkCallsNetworkDaoFindById() throws InsufficientCapacityException, ResourceAllocationException {
-        HashSet<NetworkVO> applicableNetworks = new HashSet<NetworkVO>();
+        HashSet<NetworkVO> applicableNetworks = new HashSet<>();
 
         Mockito.doReturn(networkVoListMock).when(networkModel).listNetworksForAccount(Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
 
@@ -2239,30 +2230,30 @@ public void selectApplicableNetworkToCreateVmTestVirtualNetworkHasOneNetworkCall
     @Test
     public void addDefaultSecurityGroupToSecurityGroupIdListTestDefaultGroupIsNullCallsCreateSecurityGroup() {
         String expected = "";
-        LinkedList<Long> securityGroupIdList = Mockito.spy(new LinkedList<Long>());
+        LinkedList<Long> securityGroupIdList = Mockito.spy(new LinkedList<>());
 
         Mockito.doReturn(null).when(securityGroupManagerMock).getDefaultSecurityGroup(Mockito.anyLong());
         Mockito.doReturn(securityGroupVoMock).when(securityGroupManagerMock).createSecurityGroup(SecurityGroupManager.DEFAULT_GROUP_NAME,
-                SecurityGroupManager.DEFAULT_GROUP_DESCRIPTION, 1l, 1l, expected);
+                SecurityGroupManager.DEFAULT_GROUP_DESCRIPTION, 1L, 1L, expected);
 
-        Mockito.doReturn(1l).when(accountMock).getDomainId();
-        Mockito.doReturn(1l).when(accountMock).getId();
+        Mockito.doReturn(1L).when(accountMock).getDomainId();
+        Mockito.doReturn(1L).when(accountMock).getId();
         Mockito.doReturn(expected).when(accountMock).getAccountName();
-        Mockito.doReturn(1l).when(securityGroupVoMock).getId();
+        Mockito.doReturn(1L).when(securityGroupVoMock).getId();
 
         userVmManagerImpl.addDefaultSecurityGroupToSecurityGroupIdList(accountMock, securityGroupIdList);
 
-        Mockito.verify(securityGroupManagerMock).createSecurityGroup(SecurityGroupManager.DEFAULT_GROUP_NAME, SecurityGroupManager.DEFAULT_GROUP_DESCRIPTION, 1l, 1l, expected);
-        Mockito.verify(securityGroupIdList).add(1l);
+        Mockito.verify(securityGroupManagerMock).createSecurityGroup(SecurityGroupManager.DEFAULT_GROUP_NAME, SecurityGroupManager.DEFAULT_GROUP_DESCRIPTION, 1L, 1L, expected);
+        Mockito.verify(securityGroupIdList).add(1L);
     }
 
     @Test
     public void addDefaultSecurityGroupToSecurityGroupIdListTestDefaultGroupIsPresentDoesNotCallAddIdToSecurityGroupIdList() {
-        LinkedList<Long> securityGroupIdList = Mockito.spy(new LinkedList<Long>());
+        LinkedList<Long> securityGroupIdList = Mockito.spy(new LinkedList<>());
 
-        securityGroupIdList.addFirst(1l);
+        securityGroupIdList.addFirst(1L);
         Mockito.doReturn(securityGroupVoMock).when(securityGroupManagerMock).getDefaultSecurityGroup(Mockito.anyLong());
-        Mockito.doReturn(1l).when(securityGroupVoMock).getId();
+        Mockito.doReturn(1L).when(securityGroupVoMock).getId();
 
         userVmManagerImpl.addDefaultSecurityGroupToSecurityGroupIdList(accountMock, securityGroupIdList);
 
@@ -2271,24 +2262,24 @@ public void addDefaultSecurityGroupToSecurityGroupIdListTestDefaultGroupIsPresen
 
     @Test
     public void addDefaultSecurityGroupToSecurityGroupIdListTestDefaultGroupIsNotPresentCallsAddIdToSecurityGroupIdList() {
-        LinkedList<Long> securityGroupIdList = Mockito.spy(new LinkedList<Long>());
+        LinkedList<Long> securityGroupIdList = Mockito.spy(new LinkedList<>());
 
         Mockito.doReturn(securityGroupVoMock).when(securityGroupManagerMock).getDefaultSecurityGroup(Mockito.anyLong());
-        Mockito.doReturn(1l).when(securityGroupVoMock).getId();
+        Mockito.doReturn(1L).when(securityGroupVoMock).getId();
 
         userVmManagerImpl.addDefaultSecurityGroupToSecurityGroupIdList(accountMock, securityGroupIdList);
 
-        Mockito.verify(securityGroupIdList).add(1l);
+        Mockito.verify(securityGroupIdList).add(1L);
     }
 
     @Test
     public void keepOldSharedNetworkForVmTestNetworkIdListIsNotNullOrEmptyDoesNotCallFindDefaultNicForVm() {
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = new HashSet<NetworkVO>();
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = new HashSet<>();
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
-        networkIdList.add(1l);
+        networkIdList.add(1L);
 
         userVmManagerImpl.keepOldSharedNetworkForVm(userVmVoMock, accountMock, networkIdList, applicableNetworks, requestedIPv4ForNics, requestedIPv6ForNics);
 
@@ -2297,9 +2288,9 @@ public void keepOldSharedNetworkForVmTestNetworkIdListIsNotNullOrEmptyDoesNotCal
 
     @Test
     public void keepOldSharedNetworkForVmTestNetworkIdListIsNullCallsFindDefaultNicForVm() {
-        HashSet<NetworkVO> applicableNetworks = new HashSet<NetworkVO>();
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        HashSet<NetworkVO> applicableNetworks = new HashSet<>();
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
         userVmManagerImpl.keepOldSharedNetworkForVm(userVmVoMock, accountMock, null, applicableNetworks, requestedIPv4ForNics, requestedIPv6ForNics);
 
@@ -2308,10 +2299,10 @@ public void keepOldSharedNetworkForVmTestNetworkIdListIsNullCallsFindDefaultNicF
 
     @Test
     public void keepOldSharedNetworkForVmTestNetworkIdListIsEmptyCallsFindDefaultNicForVm() {
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = new HashSet<NetworkVO>();
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = new HashSet<>();
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
         userVmManagerImpl.keepOldSharedNetworkForVm(userVmVoMock, accountMock, networkIdList, applicableNetworks, requestedIPv4ForNics, requestedIPv6ForNics);
 
@@ -2320,9 +2311,9 @@ public void keepOldSharedNetworkForVmTestNetworkIdListIsEmptyCallsFindDefaultNic
 
     @Test
     public void keepOldSharedNetworkForVmTestDefaultNicOldIsNullDoesNotCallNetworkDaoFindById() {
-        HashSet<NetworkVO> applicableNetworks = new HashSet<NetworkVO>();
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        HashSet<NetworkVO> applicableNetworks = new HashSet<>();
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
         Mockito.doReturn(null).when(nicDao).findDefaultNicForVM(Mockito.anyLong());
 
@@ -2333,9 +2324,9 @@ public void keepOldSharedNetworkForVmTestDefaultNicOldIsNullDoesNotCallNetworkDa
 
     @Test
     public void keepOldSharedNetworkForVmTestDefaultNicOldIsNotNullCallsNetworkDaoFindById() {
-        HashSet<NetworkVO> applicableNetworks = new HashSet<NetworkVO>();
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        HashSet<NetworkVO> applicableNetworks = new HashSet<>();
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
         Mockito.doReturn(new NicVO()).when(nicDao).findDefaultNicForVM(Mockito.anyLong());
 
@@ -2346,9 +2337,9 @@ public void keepOldSharedNetworkForVmTestDefaultNicOldIsNotNullCallsNetworkDaoFi
 
     @Test
     public void keepOldSharedNetworkForVmTestAccountCanNotUseNetworkDoesNotAddNetworkToApplicableNetworks() {
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
         Mockito.doReturn(new NicVO()).when(nicDao).findDefaultNicForVM(Mockito.anyLong());
         Mockito.doReturn(networkMock).when(_networkDao).findById(Mockito.anyLong());
@@ -2361,9 +2352,9 @@ public void keepOldSharedNetworkForVmTestAccountCanNotUseNetworkDoesNotAddNetwor
 
     @Test
     public void keepOldSharedNetworkForVmTestAccountCanUseNetworkAddsNetworkToApplicableNetworks() {
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
         Mockito.doReturn(new NicVO()).when(nicDao).findDefaultNicForVM(Mockito.anyLong());
         Mockito.doReturn(networkMock).when(_networkDao).findById(Mockito.anyLong());
@@ -2376,9 +2367,9 @@ public void keepOldSharedNetworkForVmTestAccountCanUseNetworkAddsNetworkToApplic
 
     @Test
     public void addAdditionalNetworksToVmTestNetworkIdListIsNullDoesNotCallCheckNetworkPermissions() {
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
         userVmManagerImpl.addAdditionalNetworksToVm(userVmVoMock, accountMock, null, applicableNetworks, requestedIPv4ForNics, requestedIPv6ForNics);
 
@@ -2387,10 +2378,10 @@ public void addAdditionalNetworksToVmTestNetworkIdListIsNullDoesNotCallCheckNetw
 
     @Test
     public void addAdditionalNetworksToVmTestNetworkIdListIsEmptyDoesNotCallCheckNetworkPermissions() {
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
         userVmManagerImpl.addAdditionalNetworksToVm(userVmVoMock, accountMock, networkIdList, applicableNetworks, requestedIPv4ForNics, requestedIPv6ForNics);
 
@@ -2400,12 +2391,12 @@ public void addAdditionalNetworksToVmTestNetworkIdListIsEmptyDoesNotCallCheckNet
     @Test
     public void addAdditionalNetworksToVmTestNetworkIsNullThrowsInvalidParameterValueException() {
         String expectedMessage = "Unable to find specified Network ID.";
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
-        networkIdList.add(1l);
+        networkIdList.add(1L);
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
             userVmManagerImpl.addAdditionalNetworksToVm(userVmVoMock, accountMock, networkIdList, applicableNetworks, requestedIPv4ForNics, requestedIPv6ForNics);
@@ -2417,12 +2408,12 @@ public void addAdditionalNetworksToVmTestNetworkIsNullThrowsInvalidParameterValu
     @Test
     public void addAdditionalNetworksToVmTestNetworkOfferingIsSystemOnlyThrowsInvalidParameterValueException() {
         String expectedMessage = String.format("Specified network [%s] is system only and cannot be used for VM deployment.", networkMock);
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
-        networkIdList.add(1l);
+        networkIdList.add(1L);
 
         Mockito.doReturn(networkMock).when(_networkDao).findById(Mockito.anyLong());
         Mockito.doReturn(networkOfferingVoMock).when(entityManager).findById(Mockito.any(), Mockito.anyLong());
@@ -2437,12 +2428,12 @@ public void addAdditionalNetworksToVmTestNetworkOfferingIsSystemOnlyThrowsInvali
 
     @Test
     public void addAdditionalNetworksToVmTestNetworkIsNotSharedGuestTypeDoesNotCallNicDaoFindByNtwkIdAndInstanceId() {
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
-        networkIdList.add(1l);
+        networkIdList.add(1L);
 
         Mockito.doReturn(networkMock).when(_networkDao).findById(Mockito.anyLong());
         Mockito.doReturn(networkOfferingVoMock).when(entityManager).findById(Mockito.any(), Mockito.anyLong());
@@ -2456,12 +2447,12 @@ public void addAdditionalNetworksToVmTestNetworkIsNotSharedGuestTypeDoesNotCallN
 
     @Test
     public void addAdditionalNetworksToVmTestNetworkIsNotDomainAclTypeDoesNotCallNicDaoFindByNtwkIdAndInstanceId() {
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
-        networkIdList.add(1l);
+        networkIdList.add(1L);
 
         Mockito.doReturn(networkMock).when(_networkDao).findById(Mockito.anyLong());
         Mockito.doReturn(networkOfferingVoMock).when(entityManager).findById(Mockito.any(), Mockito.anyLong());
@@ -2476,12 +2467,12 @@ public void addAdditionalNetworksToVmTestNetworkIsNotDomainAclTypeDoesNotCallNic
 
     @Test
     public void addAdditionalNetworksToVmTestOldNicIsNullDoesNotPutIpv4InRequestIpv4ForNics() {
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = Mockito.spy(new HashMap<Long, String>());
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = Mockito.spy(new HashMap<>());
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
-        networkIdList.add(1l);
+        networkIdList.add(1L);
 
         Mockito.doReturn(networkMock).when(_networkDao).findById(Mockito.anyLong());
         Mockito.doReturn(networkOfferingVoMock).when(entityManager).findById(Mockito.any(), Mockito.anyLong());
@@ -2498,12 +2489,12 @@ public void addAdditionalNetworksToVmTestOldNicIsNullDoesNotPutIpv4InRequestIpv4
 
     @Test
     public void addAdditionalNetworksToVmTestOldNicIsNotNullPutsIpv4InRequestIpv4ForNics() {
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<NetworkVO>());
-        HashMap<Long, String> requestedIPv4ForNics = Mockito.spy(new HashMap<Long, String>());
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        HashSet<NetworkVO> applicableNetworks = Mockito.spy(new HashSet<>());
+        HashMap<Long, String> requestedIPv4ForNics = Mockito.spy(new HashMap<>());
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
 
-        networkIdList.add(1l);
+        networkIdList.add(1L);
 
         Mockito.doReturn(networkMock).when(_networkDao).findById(Mockito.anyLong());
         Mockito.doReturn(networkOfferingVoMock).when(entityManager).findById(Mockito.any(), Mockito.anyLong());
@@ -2522,7 +2513,7 @@ public void addAdditionalNetworksToVmTestOldNicIsNotNullPutsIpv4InRequestIpv4For
     public void createApplicableNetworkToCreateVmTestPhysicalNetworkIsNullThrowsInvalidParameterValueException() {
         Mockito.doReturn(networkOfferingVoMock).when(userVmManagerImpl).getOfferingWithRequiredAvailabilityForNetworkCreation();
 
-        String expectedMessage = String.format("Unable to find physical network with ID [%s] and tag [%s].", 0l, null);
+        String expectedMessage = String.format("Unable to find physical network with ID [%s] and tag [%s].", 0L, null);
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
             userVmManagerImpl.createApplicableNetworkToCreateVm(accountMock, _dcMock);
         });
@@ -2562,7 +2553,7 @@ public void createApplicableNetworkToCreateVmTestFirstNetworkOfferingIsNotPersis
                 Mockito.any(), Mockito.any(), Mockito.anyBoolean(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(),
                 Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
         Mockito.doReturn(networkOfferingVoMock).when(userVmManagerImpl).getOfferingWithRequiredAvailabilityForNetworkCreation();
-        Mockito.doReturn(1l).when(networkMock).getId();
+        Mockito.doReturn(1L).when(networkMock).getId();
         Mockito.doReturn(networkMock).when(_networkDao).findById(Mockito.anyLong());
 
         userVmManagerImpl.createApplicableNetworkToCreateVm(accountMock, _dcMock);
@@ -2638,7 +2629,7 @@ public void implementNetworkTestImplementedNetworkIsNullReturnCurrentNewNetwork(
         try (MockedStatic<CallContext> ignored = mockStatic(CallContext.class)) {
             Mockito.when(CallContext.current()).thenReturn(callContextMock);
 
-            Mockito.doReturn(1l).when(callContextMock).getCallingUserId();
+            Mockito.doReturn(1L).when(callContextMock).getCallingUserId();
 
             Mockito.doReturn(callerUser).when(userDao).findById(Mockito.anyLong());
             Mockito.doReturn(null).when(_networkMgr).implementNetwork(Mockito.anyLong(), Mockito.any(), Mockito.any());
@@ -2657,7 +2648,7 @@ public void implementNetworkTestImplementedNetworkFirstIsNullReturnCurrentNewNet
         try (MockedStatic<CallContext> ignored = mockStatic(CallContext.class)) {
             Mockito.when(CallContext.current()).thenReturn(callContextMock);
 
-            Mockito.doReturn(1l).when(callContextMock).getCallingUserId();
+            Mockito.doReturn(1L).when(callContextMock).getCallingUserId();
 
             Pair<? extends NetworkGuru, ? extends Network> implementedNetwork = Mockito.mock(Pair.class);
 
@@ -2679,7 +2670,7 @@ public void implementNetworkTestImplementedNetworkSecondIsNullReturnCurrentNewNe
         try (MockedStatic<CallContext> ignored = mockStatic(CallContext.class)) {
             Mockito.when(CallContext.current()).thenReturn(callContextMock);
 
-            Mockito.doReturn(1l).when(callContextMock).getCallingUserId();
+            Mockito.doReturn(1L).when(callContextMock).getCallingUserId();
 
             Pair<? extends NetworkGuru, ? extends Network> implementedNetwork = Mockito.mock(Pair.class);
 
@@ -2702,7 +2693,7 @@ public void implementNetworkTestImplementedNetworkSecondIsNotNullReturnImplement
         try (MockedStatic<CallContext> ignored = mockStatic(CallContext.class)) {
             Mockito.when(CallContext.current()).thenReturn(callContextMock);
 
-            Mockito.doReturn(1l).when(callContextMock).getCallingUserId();
+            Mockito.doReturn(1L).when(callContextMock).getCallingUserId();
 
             Pair<? extends NetworkGuru, ? extends Network> implementedNetwork = Mockito.mock(Pair.class);
 
@@ -2726,7 +2717,7 @@ public void implementNetworkTestImplementedNetworkCatchException() throws Resour
         try (MockedStatic<CallContext> ignored = mockStatic(CallContext.class)) {
             Mockito.when(CallContext.current()).thenReturn(callContextMock);
 
-            Mockito.doReturn(1l).when(callContextMock).getCallingUserId();
+            Mockito.doReturn(1L).when(callContextMock).getCallingUserId();
 
             Pair<? extends NetworkGuru, ? extends Network> implementedNetwork = Mockito.mock(Pair.class);
 
@@ -2744,10 +2735,10 @@ public void implementNetworkTestImplementedNetworkCatchException() throws Resour
     @Test
     public void updateBasicTypeNetworkForVmTestNetworkIdListIsNotEmptyThrowsInvalidParameterValueException() {
         String expectedMessage = "Cannot move VM with Network IDs; this is a basic zone VM.";
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
-        LinkedList<Long> securityGroupIdList = new LinkedList<Long>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
+        LinkedList<Long> securityGroupIdList = new LinkedList<>();
 
-        networkIdList.add(1l);
+        networkIdList.add(1L);
 
         InvalidParameterValueException assertThrows = Assert.assertThrows(expectedInvalidParameterValueException, () -> {
             userVmManagerImpl.updateBasicTypeNetworkForVm(userVmVoMock, accountMock, virtualMachineTemplateMock, virtualMachineProfileMock, _dcMock, networkIdList,
@@ -2779,7 +2770,7 @@ public void updateBasicTypeNetworkForVmTestNetworkIdListIsEmptyCallsCleanupOfOld
             throws InsufficientCapacityException {
 
         LinkedList<Long> securityGroupIdList = Mockito.mock(LinkedList.class);
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
 
         Mockito.doReturn(networkMock).when(networkModel).getExclusiveGuestNetwork(Mockito.anyLong());
 
@@ -2796,7 +2787,7 @@ public void updateBasicTypeNetworkForVmTestNetworkIdListIsEmptyCallsCleanupOfOld
     public void updateAdvancedTypeNetworkForVmTestSecurityGroupIsEnabledApplicableNetworksIsEmptyThrowsInvalidParameterValueException() {
         String expectedMessage = "No network is specified, please specify one when you move the VM. For now, please add a network to VM on NICs tab.";
         LinkedList<Long> securityGroupIdList = Mockito.mock(LinkedList.class);
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
 
         Mockito.doReturn(true).when(networkModel).checkSecurityGroupSupportForNetwork(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
 
@@ -2814,7 +2805,7 @@ public void updateAdvancedTypeNetworkForVmTestSecurityGroupIsEnabledApplicableNe
             ResourceAllocationException {
 
         LinkedList<Long> securityGroupIdList = Mockito.mock(LinkedList.class);
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
 
         Mockito.doReturn(new NicVO()).when(nicDao).findDefaultNicForVM(Mockito.anyLong());
         Mockito.doReturn(networkMock).when(_networkDao).findById(Mockito.anyLong());
@@ -2834,9 +2825,9 @@ public void updateAdvancedTypeNetworkForVmTestSecurityGroupIsEnabledApplicableNe
     public void updateAdvancedTypeNetworkForVmTestSecurityGroupIsNotEnabledSecurityGroupIdListIsNotEmptyThrowsInvalidParameterValueException() {
         String expectedMessage = "Cannot move VM with security groups; security group feature is not enabled in this zone.";
         LinkedList<Long> securityGroupIdList = Mockito.mock(LinkedList.class);
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
 
-        securityGroupIdList.add(1l);
+        securityGroupIdList.add(1L);
 
         Mockito.doReturn(false).when(networkModel).checkSecurityGroupSupportForNetwork(accountMock, _dcMock, networkIdList, securityGroupIdList);
 
@@ -2853,7 +2844,7 @@ public void updateAdvancedTypeNetworkForVmTestSecurityGroupIsNotEnabledApplicabl
             ResourceAllocationException {
 
         LinkedList<Long> securityGroupIdList = Mockito.mock(LinkedList.class);
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
 
         Mockito.doReturn(networkMock).when(userVmManagerImpl).addNicsToApplicableNetworksAndReturnDefaultNetwork(Mockito.any(), Mockito.anyMap(), Mockito.anyMap(), Mockito.any());
         Mockito.doNothing().when(userVmManagerImpl).selectApplicableNetworkToCreateVm(Mockito.any(), Mockito.any(), Mockito.any());
@@ -2876,7 +2867,7 @@ public void updateAdvancedTypeNetworkForVmTestSecurityGroupIsNotEnabledApplicabl
             throws InsufficientCapacityException, ResourceAllocationException {
 
         LinkedList<Long> securityGroupIdList = Mockito.mock(LinkedList.class);
-        LinkedList<Long> networkIdList = new LinkedList<Long>();
+        LinkedList<Long> networkIdList = new LinkedList<>();
 
         Mockito.doReturn(false).when(networkModel).checkSecurityGroupSupportForNetwork(accountMock, _dcMock, networkIdList, securityGroupIdList);
         Mockito.doReturn(true).when(securityGroupIdList).isEmpty();
@@ -2897,10 +2888,10 @@ public void updateAdvancedTypeNetworkForVmTestSecurityGroupIsNotEnabledApplicabl
 
     @Test
     public void addNicsToApplicableNetworksAndReturnDefaultNetworkTestApplicableNetworkIsEmptyReturnNull() {
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
-        LinkedHashSet<NetworkVO> applicableNetworks = new LinkedHashSet<NetworkVO>();
-        LinkedHashMap<Network, List<? extends NicProfile>> networks = new LinkedHashMap<Network, List<? extends NicProfile>>();
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
+        LinkedHashSet<NetworkVO> applicableNetworks = new LinkedHashSet<>();
+        LinkedHashMap<Network, List<? extends NicProfile>> networks = new LinkedHashMap<>();
 
         NetworkVO defaultNetwork = userVmManagerImpl.addNicsToApplicableNetworksAndReturnDefaultNetwork(applicableNetworks, requestedIPv4ForNics, requestedIPv6ForNics, networks);
 
@@ -2909,9 +2900,9 @@ public void addNicsToApplicableNetworksAndReturnDefaultNetworkTestApplicableNetw
 
     @Test
     public void addNicsToApplicableNetworksAndReturnDefaultNetworkTestApplicableNetworkIsNotEmptyReturnFirstElement() {
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
-        LinkedHashSet<NetworkVO> applicableNetworks = new LinkedHashSet<NetworkVO>();
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
+        LinkedHashSet<NetworkVO> applicableNetworks = new LinkedHashSet<>();
         LinkedHashMap<Network, List<? extends NicProfile>> networks = Mockito.spy(LinkedHashMap.class);
 
         applicableNetworks.add(networkMock);
@@ -2924,9 +2915,9 @@ public void addNicsToApplicableNetworksAndReturnDefaultNetworkTestApplicableNetw
 
     @Test
     public void addNicsToApplicableNetworksAndReturnDefaultNetworkTestApplicableNetworkIsNotEmptyPutTwoNetworksInNetworksMapAndReturnFirst() {
-        HashMap<Long, String> requestedIPv4ForNics = new HashMap<Long, String>();
-        HashMap<Long, String> requestedIPv6ForNics = new HashMap<Long, String>();
-        LinkedHashSet<NetworkVO> applicableNetworks = new LinkedHashSet<NetworkVO>();
+        HashMap<Long, String> requestedIPv4ForNics = new HashMap<>();
+        HashMap<Long, String> requestedIPv6ForNics = new HashMap<>();
+        LinkedHashSet<NetworkVO> applicableNetworks = new LinkedHashSet<>();
         LinkedHashMap<Network, List<? extends NicProfile>> networks = Mockito.spy(LinkedHashMap.class);
 
         NetworkVO networkVoMock2 = Mockito.mock(NetworkVO.class);
@@ -2944,9 +2935,9 @@ public void validateIfVolumesHaveNoSnapshotsTestVolumeHasSnapshotsThrowsInvalidP
         String expectedMessage = String.format("Snapshots exist for volume [%s]. Detach volume or remove snapshots for the volume before assigning VM to another user.",
                 volumeVOMock.getName());
 
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
         volumes.add(volumeVOMock);
-        LinkedList<SnapshotVO> snapshots = new LinkedList<SnapshotVO>();
+        LinkedList<SnapshotVO> snapshots = new LinkedList<>();
         snapshots.add(snapshotVoMock);
 
         Mockito.doReturn(snapshots).when(snapshotDaoMock).listByStatusNotIn(Mockito.anyLong(), Mockito.any(), Mockito.any());
@@ -2960,9 +2951,9 @@ public void validateIfVolumesHaveNoSnapshotsTestVolumeHasSnapshotsThrowsInvalidP
 
     @Test
     public void validateIfVolumesHaveNoSnapshotsTestVolumeHasNoSnapshotsDoesNotThrowInvalidParameterException() {
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
         volumes.add(volumeVOMock);
-        LinkedList<SnapshotVO> snapshots = new LinkedList<SnapshotVO>();
+        LinkedList<SnapshotVO> snapshots = new LinkedList<>();
 
         Mockito.doReturn(snapshots).when(snapshotDaoMock).listByStatusNotIn(Mockito.anyLong(), Mockito.any(), Mockito.any());
 
@@ -3008,7 +2999,7 @@ public void moveVmToUserTestProjectIdProvidedAndDomainIdIsNullThrowsInvalidParam
 
         Mockito.doReturn(true).when(accountManager).isRootAdmin(Mockito.anyLong());
         Mockito.doReturn(userVmVoMock).when(userVmDao).findById(Mockito.anyLong());
-        Mockito.doReturn(1l).when(assignVmCmdMock).getProjectId();
+        Mockito.doReturn(1L).when(assignVmCmdMock).getProjectId();
         Mockito.doReturn(null).when(assignVmCmdMock).getDomainId();
 
         configureDoNothingForMethodsThatWeDoNotWantToTest();
@@ -3039,7 +3030,7 @@ public void moveVmToUserTestValidateIfVmHasNoRulesThrowsInvalidParameterValueExc
     public void moveVmToUserTestSnapshotsForVolumeExistThrowsInvalidParameterValueException() throws ResourceUnavailableException, InsufficientCapacityException,
             ResourceAllocationException {
 
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
         volumes.add(volumeVOMock);
 
         Mockito.doReturn(true).when(accountManager).isRootAdmin(Mockito.anyLong());
@@ -3058,7 +3049,7 @@ public void moveVmToUserTestSnapshotsForVolumeExistThrowsInvalidParameterValueEx
     public void moveVmToUserTestVerifyResourceLimitsForAccountAndStorageThrowsResourceAllocationException() throws ResourceUnavailableException, InsufficientCapacityException,
             ResourceAllocationException {
 
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
 
         Mockito.doReturn(true).when(accountManager).isRootAdmin(Mockito.anyLong());
         Mockito.doReturn(userVmVoMock).when(userVmDao).findById(Mockito.anyLong());
@@ -3077,7 +3068,7 @@ public void moveVmToUserTestVerifyResourceLimitsForAccountAndStorageThrowsResour
     public void moveVmToUserTestVerifyValidateIfNewOwnerHasAccessToTemplateThrowsInvalidParameterValueException() throws ResourceUnavailableException,
             InsufficientCapacityException, ResourceAllocationException {
 
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
 
         Mockito.doReturn(true).when(accountManager).isRootAdmin(Mockito.anyLong());
         Mockito.doReturn(userVmVoMock).when(userVmDao).findById(Mockito.anyLong());
@@ -3095,7 +3086,7 @@ public void moveVmToUserTestVerifyValidateIfNewOwnerHasAccessToTemplateThrowsInv
     public void moveVmToUserTestAccountManagerCheckAccessThrowsPermissionDeniedException() throws ResourceUnavailableException, InsufficientCapacityException,
             ResourceAllocationException {
 
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
 
         Mockito.doReturn(true).when(accountManager).isRootAdmin(Mockito.anyLong());
         Mockito.doReturn(userVmVoMock).when(userVmDao).findById(Mockito.anyLong());
@@ -3115,7 +3106,7 @@ public void moveVmToUserTestAccountManagerCheckAccessThrowsPermissionDeniedExcep
     public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsInsufficientCapacityException() throws ResourceUnavailableException, InsufficientCapacityException,
             ResourceAllocationException {
 
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
 
         try (MockedStatic<UsageEventUtils> ignored = mockStatic(UsageEventUtils.class)) {
             Mockito.doReturn(Hypervisor.HypervisorType.KVM).when(userVmVoMock).getHypervisorType();
@@ -3126,7 +3117,7 @@ public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsInsufficie
                     Mockito.any());
 
             Assert.assertThrows(CloudRuntimeException.class, () -> userVmManagerImpl.executeStepsToChangeOwnershipOfVm(assignVmCmdMock, callerAccount, accountMock, accountMock,
-                    userVmVoMock, serviceOfferingVoMock, volumes, virtualMachineTemplateMock, 1l));
+                    userVmVoMock, serviceOfferingVoMock, volumes, virtualMachineTemplateMock, 1L));
 
             Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
             Mockito.verify(userVmManagerImpl).updateVmOwner(Mockito.any(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
@@ -3138,7 +3129,7 @@ public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsInsufficie
     public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsResourceAllocationException() throws ResourceUnavailableException, InsufficientCapacityException,
             ResourceAllocationException {
 
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
 
         try (MockedStatic<UsageEventUtils> ignored = mockStatic(UsageEventUtils.class)) {
             Mockito.doReturn(Hypervisor.HypervisorType.KVM).when(userVmVoMock).getHypervisorType();
@@ -3149,7 +3140,7 @@ public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsResourceAl
                     Mockito.any());
 
             Assert.assertThrows(CloudRuntimeException.class, () -> userVmManagerImpl.executeStepsToChangeOwnershipOfVm(assignVmCmdMock, callerAccount, accountMock, accountMock,
-                    userVmVoMock, serviceOfferingVoMock, volumes, virtualMachineTemplateMock, 1l));
+                    userVmVoMock, serviceOfferingVoMock, volumes, virtualMachineTemplateMock, 1L));
 
             Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
             Mockito.verify(userVmManagerImpl).updateVmOwner(Mockito.any(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
@@ -3161,7 +3152,7 @@ public void executeStepsToChangeOwnershipOfVmTestUpdateVmNetworkThrowsResourceAl
     public void executeStepsToChangeOwnershipOfVmTestResourceCountRunningVmsOnlyEnabledIsFalseCallsResourceCountIncrement() throws ResourceUnavailableException,
             InsufficientCapacityException, ResourceAllocationException {
 
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
 
 
         try (MockedStatic<UsageEventUtils> ignored = mockStatic(UsageEventUtils.class)) {
@@ -3185,7 +3176,7 @@ public void executeStepsToChangeOwnershipOfVmTestResourceCountRunningVmsOnlyEnab
     public void executeStepsToChangeOwnershipOfVmTestResourceCountRunningVmsOnlyEnabledIsTrueDoesNotCallResourceCountIncrement() throws ResourceUnavailableException,
             InsufficientCapacityException, ResourceAllocationException {
 
-        LinkedList<VolumeVO> volumes = new LinkedList<VolumeVO>();
+        LinkedList<VolumeVO> volumes = new LinkedList<>();
 
         try (MockedStatic<UsageEventUtils> ignored = mockStatic(UsageEventUtils.class)) {
             Mockito.doReturn(Hypervisor.HypervisorType.KVM).when(userVmVoMock).getHypervisorType();
@@ -3194,7 +3185,7 @@ public void executeStepsToChangeOwnershipOfVmTestResourceCountRunningVmsOnlyEnab
             configureDoNothingForMethodsThatWeDoNotWantToTest();
 
             userVmManagerImpl.executeStepsToChangeOwnershipOfVm(assignVmCmdMock, callerAccount, accountMock, accountMock, userVmVoMock, serviceOfferingVoMock, volumes,
-                    virtualMachineTemplateMock, 1l);
+                    virtualMachineTemplateMock, 1L);
 
             Mockito.verify(userVmManagerImpl).resourceCountDecrement(Mockito.anyLong(), Mockito.any(), Mockito.any(), Mockito.any());
             Mockito.verify(userVmManagerImpl).updateVmOwner(Mockito.any(), Mockito.any(), Mockito.anyLong(), Mockito.anyLong());
@@ -3458,9 +3449,9 @@ public void testResetVMSSHKey() throws ResourceUnavailableException, Insufficien
 
         assertNotNull(result);
         Map<String, String> details = result.getDetails();
-        Assert.assertEquals(details.get(VmDetailConstants.SSH_PUBLIC_KEY), "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAr...\n" +
-                "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAr...");
-        Assert.assertEquals(details.get(VmDetailConstants.SSH_KEY_PAIR_NAMES), "keypair1,keypair2");
+        Assert.assertEquals("ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAr...\n" +
+                "ssh-rsa AAAAB3NzaC1yc2EAAAABIwAAAQEAr...", details.get(VmDetailConstants.SSH_PUBLIC_KEY));
+        Assert.assertEquals("keypair1,keypair2", details.get(VmDetailConstants.SSH_KEY_PAIR_NAMES));
     }
 
     @Test
@@ -3853,15 +3844,38 @@ Map<String, String> getLeaseDetails(int leaseDuration, String leaseExecution) {
         return leaseDetails;
     }
 
+    private static DeployVMCmd buildDeployVMCmd(Long volumeId, Long snapshotId) {
+        DeployVMCmd deployVMCmd = mock(DeployVMCmd.class);
+        when(deployVMCmd.getEntityOwnerId()).thenReturn(accountId);
+        when(deployVMCmd.getZoneId()).thenReturn(zoneId);
+        when(deployVMCmd.getServiceOfferingId()).thenReturn(serviceOfferingId);
+        when(deployVMCmd.getVolumeId()).thenReturn(volumeId);
+        when(deployVMCmd.getSnapshotId()).thenReturn(snapshotId);
+        when(deployVMCmd.getTemplateId()).thenReturn(null);
+        when(deployVMCmd.isVolumeOrSnapshotProvided()).thenReturn(true);
+        when(deployVMCmd.getNetworkIds()).thenReturn(null);
+        when(deployVMCmd.getSecurityGroupNameList()).thenReturn(null);
+        // Long methods default to 0L in Mockito; null is required to match real DeployVMCmd field-unset behaviour
+        when(deployVMCmd.getDiskOfferingId()).thenReturn(null);
+        when(deployVMCmd.getUserdataId()).thenReturn(null);
+        when(deployVMCmd.getHostId()).thenReturn(null);
+        // boolean method defaults to false; real DeployVMCmd returns true when field is null
+        when(deployVMCmd.isDynamicScalingEnabled()).thenReturn(true);
+        return deployVMCmd;
+    }
+
+    private static DeployVMCmd getDeployVMCmdFromSnapshot() {
+        return buildDeployVMCmd(null, snashotId);
+    }
+
+    private static DeployVMCmd getDeployVMCmdFromVolume() {
+        return buildDeployVMCmd(volumeId, null);
+    }
+
     @Test
     public void createVirtualMachineWithExistingVolume() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        DeployVMCmd deployVMCmd = new DeployVMCmd();
-        ReflectionTestUtils.setField(deployVMCmd, "zoneId", zoneId);
-        ReflectionTestUtils.setField(deployVMCmd, "serviceOfferingId", serviceOfferingId);
-        ReflectionTestUtils.setField(deployVMCmd, "volumeId", volumeId);
-        deployVMCmd._accountService = accountService;
+        DeployVMCmd deployVMCmd = getDeployVMCmdFromVolume();
 
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
         when(accountService.getActiveAccountById(accountId)).thenReturn(account);
         when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
         when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
@@ -3890,15 +3904,11 @@ public void createVirtualMachineWithExistingVolume() throws ResourceUnavailableE
     }
 
     @Test
-    public void createVirtualMachineWithExistingSnapshot() throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
-        DeployVMCmd deployVMCmd = new DeployVMCmd();
-        ReflectionTestUtils.setField(deployVMCmd, "zoneId", zoneId);
-        ReflectionTestUtils.setField(deployVMCmd, "serviceOfferingId", serviceOfferingId);
-        ReflectionTestUtils.setField(deployVMCmd, "snapshotId", snashotId);
-        deployVMCmd._accountService = accountService;
+    public void createVirtualMachineWithExistingSnapshot()
+            throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
+        DeployVMCmd deployVMCmd = getDeployVMCmdFromSnapshot();                                    // mock, no field hacks
 
-        when(accountService.finalyzeAccountId(nullable(String.class), nullable(Long.class), nullable(Long.class), eq(true))).thenReturn(accountId);
-        when(accountService.getActiveAccountById(accountId)).thenReturn(account);
+        when(accountService.getActiveAccountById(accountId)).thenReturn(account);      // keep
         when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
         when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
         when(entityManager.findById(DiskOffering.class, serviceOffering.getId())).thenReturn(smallerDisdkOffering);
@@ -3908,9 +3918,6 @@ public void createVirtualMachineWithExistingSnapshot() throws ResourceUnavailabl
         when(snapshotMock.getVolumeId()).thenReturn(volumeId);
         when(volumeInfo.getTemplateId()).thenReturn(templateId);
         when(volumeInfo.getInstanceId()).thenReturn(null);
-        when(volumeInfo.getDataStore()).thenReturn(primaryDataStore);
-        when(primaryDataStore.getScope()).thenReturn(scopeMock);
-        when(primaryDataStore.getScope().getScopeType()).thenReturn(ScopeType.ZONE);
         when(templateMock.getTemplateType()).thenReturn(Storage.TemplateType.VNF);
         when(templateMock.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
         when(templateMock.isDeployAsIs()).thenReturn(false);
@@ -3923,10 +3930,103 @@ public void createVirtualMachineWithExistingSnapshot() throws ResourceUnavailabl
                 any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), nullable(Boolean.class), any(), any(), any(),
                 any(), any(), any(), any(), eq(true), any(), any(), any());
 
+        userVmManagerImpl.createVirtualMachine(deployVMCmd);
+    }
+
+    @Test
+    public void createVirtualMachineWithSnapshotFromExpungedLocalStorageVolumeSucceeds()
+            throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
+        DeployVMCmd deployVMCmd = getDeployVMCmdFromSnapshot();                                    // mock, no field hacks
+
+        when(accountService.getActiveAccountById(accountId)).thenReturn(account);
+        when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
+        when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
+        when(snapshotDaoMock.findById(snashotId)).thenReturn(snapshotMock);
+        when(snapshotMock.getVolumeId()).thenReturn(volumeId);
+        when(volumeDataFactory.getVolume(volumeId)).thenReturn(volumeInfo);
+        when(volumeInfo.getTemplateId()).thenReturn(templateId);
+        when(volumeInfo.getInstanceId()).thenReturn(null);
+        when(entityManager.findByIdIncludingRemoved(VirtualMachineTemplate.class, templateId)).thenReturn(templateMock);
+        when(templateMock.getTemplateType()).thenReturn(Storage.TemplateType.VNF);
+        when(templateMock.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
+        when(templateMock.isDeployAsIs()).thenReturn(false);
+        when(templateMock.getFormat()).thenReturn(Storage.ImageFormat.QCOW2);
+        when(templateMock.getUserDataId()).thenReturn(null);
+        Mockito.doNothing().when(vnfTemplateManager).validateVnfApplianceNics(any(), nullable(List.class), any());
+        when(_dcMock.isLocalStorageEnabled()).thenReturn(true);
+        when(_dcMock.getNetworkType()).thenReturn(DataCenter.NetworkType.Basic);
+        Mockito.doReturn(userVmVoMock).when(userVmManagerImpl).createBasicSecurityGroupVirtualMachine(any(), any(), any(), any(), any(), any(), any(),
+                any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), nullable(Boolean.class), any(), any(), any(),
+                any(), any(), any(), any(), eq(true), any(), any(), any());
+
+        // Must NOT throw "Deployment of virtual machine is supported only for Zone-wide storage pools"
+        userVmManagerImpl.createVirtualMachine(deployVMCmd);
+    }
+
+    @Test
+    public void createVirtualMachineWithSnapshotFromVolumeWithNullDataStoreSucceeds()
+            throws ResourceUnavailableException, InsufficientCapacityException, ResourceAllocationException {
+        DeployVMCmd deployVMCmd = getDeployVMCmdFromSnapshot();                                    // mock, no field hacks
+
+        when(accountService.getActiveAccountById(accountId)).thenReturn(account);
+        when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
+        when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
+        when(snapshotDaoMock.findById(snashotId)).thenReturn(snapshotMock);
+        when(snapshotMock.getVolumeId()).thenReturn(volumeId);
+        when(volumeDataFactory.getVolume(volumeId)).thenReturn(volumeInfo);
+        when(volumeInfo.getTemplateId()).thenReturn(templateId);
+        when(volumeInfo.getInstanceId()).thenReturn(null);
+        when(entityManager.findByIdIncludingRemoved(VirtualMachineTemplate.class, templateId)).thenReturn(templateMock);
+        when(templateMock.getTemplateType()).thenReturn(Storage.TemplateType.VNF);
+        when(templateMock.getHypervisorType()).thenReturn(Hypervisor.HypervisorType.KVM);
+        when(templateMock.isDeployAsIs()).thenReturn(false);
+        when(templateMock.getFormat()).thenReturn(Storage.ImageFormat.QCOW2);
+        when(templateMock.getUserDataId()).thenReturn(null);
+        Mockito.doNothing().when(vnfTemplateManager).validateVnfApplianceNics(any(), nullable(List.class), any());
+        when(_dcMock.isLocalStorageEnabled()).thenReturn(true);
+        when(_dcMock.getNetworkType()).thenReturn(DataCenter.NetworkType.Basic);
+        Mockito.doReturn(userVmVoMock).when(userVmManagerImpl).createBasicSecurityGroupVirtualMachine(any(), any(), any(), any(), any(), any(), any(),
+                any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), any(), nullable(Boolean.class), any(), any(), any(),
+                any(), any(), any(), any(), eq(true), any(), any(), any());
 
+        // Must NOT throw "Deployment of virtual machine is supported only for Zone-wide storage pools"
         userVmManagerImpl.createVirtualMachine(deployVMCmd);
     }
 
+    @Test
+    public void createVirtualMachineWithVolumeFromNonZoneScopedStorageFails() {
+        DeployVMCmd deployVMCmd = getDeployVMCmdFromVolume();
+
+        when(accountService.getActiveAccountById(accountId)).thenReturn(account);
+        when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
+        when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
+        when(volumeDataFactory.getVolume(volumeId)).thenReturn(volumeInfo);
+        // Volume lives on HOST-scoped (local) storage
+        when(volumeInfo.getDataStore()).thenReturn(primaryDataStore);
+        when(primaryDataStore.getScope()).thenReturn(scopeMock);
+        when(scopeMock.getScopeType()).thenReturn(ScopeType.HOST);
+
+        InvalidParameterValueException ex = assertThrows(InvalidParameterValueException.class,
+                () -> userVmManagerImpl.createVirtualMachine(deployVMCmd));
+        assertEquals("Deployment of virtual machine is supported only for Zone-wide storage pools", ex.getMessage());
+    }
+
+    @Test
+    public void createVirtualMachineWithVolumeWithNullDataStoreFails() {
+        DeployVMCmd deployVMCmd = getDeployVMCmdFromVolume();
+
+        when(accountService.getActiveAccountById(accountId)).thenReturn(account);
+        when(entityManager.findById(DataCenter.class, zoneId)).thenReturn(_dcMock);
+        when(entityManager.findById(ServiceOffering.class, serviceOfferingId)).thenReturn(serviceOffering);
+        when(volumeDataFactory.getVolume(volumeId)).thenReturn(volumeInfo);
+        // Volume's data store is null (pool was deleted)
+        when(volumeInfo.getDataStore()).thenReturn(null);
+
+        InvalidParameterValueException ex = assertThrows(InvalidParameterValueException.class,
+                () -> userVmManagerImpl.createVirtualMachine(deployVMCmd));
+        assertEquals("Deployment of virtual machine is supported only for Zone-wide storage pools", ex.getMessage());
+    }
+
     @Test
     public void testAllocateVMFromBackupWithVmSettingsRestoration() throws InsufficientCapacityException, ResourceAllocationException, ResourceUnavailableException {
         Long backupId = 10L;

From 850b44317a4c7e4f57b9d03f6890fd143bbd63a8 Mon Sep 17 00:00:00 2001
From: James Peru Mmbono <jmsperu@gmail.com>
Date: Thu, 21 May 2026 17:57:33 +0300
Subject: [PATCH 44/64] fix(linstor): verify resource deletion completes; warn
 if stuck in DELETING (#13076)

Co-authored-by: jmsperu <jmsperu@users.noreply.github.com>
---
 .../kvm/storage/LinstorStorageAdaptor.java    | 11 ++++
 .../LinstorPrimaryDataStoreDriverImpl.java    | 14 +++++
 .../storage/datastore/util/LinstorUtil.java   | 52 +++++++++++++++++++
 3 files changed, 77 insertions(+)

diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
index 77953a32e63a..31a41cd94079 100644
--- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
+++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
@@ -514,6 +514,17 @@ private boolean deRefOrDeleteResource(DevelopersApi api, String rscName, String
                 ApiCallRcList answers = api.resourceDefinitionDelete(rd.getName());
                 checkLinstorAnswersThrow(answers);
                 deleted = true;
+
+                // LINSTOR can return success here while the resource lingers in DELETING state
+                // on the controller (down peer, lost quorum, etc.). Confirm it's actually gone
+                // — if not, log a WARN so operators can clear it manually. Don't throw: the
+                // CloudStack-side accounting has already moved on.
+                if (!LinstorUtil.waitForResourceDefinitionDeleted(api, rd.getName(),
+                        LinstorUtil.DEFAULT_RD_DELETE_VERIFY_TIMEOUT_MILLIS)) {
+                    logger.warn("Linstor: resource {} still present {}ms after delete returned success — " +
+                            "may be stuck in DELETING. Check the LINSTOR controller (linstor resource list).",
+                            rd.getName(), LinstorUtil.DEFAULT_RD_DELETE_VERIFY_TIMEOUT_MILLIS);
+                }
             }
         }
         return deleted;
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
index 83dacf74e8df..d7451fab18f8 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/driver/LinstorPrimaryDataStoreDriverImpl.java
@@ -232,6 +232,20 @@ private void deleteResourceDefinition(StoragePoolVO storagePoolVO, String rscDef
                 throw new CloudRuntimeException("Linstor: Unable to delete resource definition: " + rscDefName);
             }
             logger.info("Linstor: Deleted resource {}", rscDefName);
+
+            // LINSTOR can return success on the delete API call while the resource lingers in
+            // DELETING state (peer issues, lost quorum, satellite down). Verify the resource is
+            // actually gone — if not, log a WARN so operators see it. We deliberately do NOT
+            // throw here: the volume is already considered gone on the CloudStack side, and
+            // throwing would leave the CS DB and LINSTOR in different states.
+            if (!LinstorUtil.waitForResourceDefinitionDeleted(linstorApi, rscDefName,
+                    LinstorUtil.DEFAULT_RD_DELETE_VERIFY_TIMEOUT_MILLIS))
+            {
+                logger.warn("Linstor: resource {} still present {}ms after delete returned success — " +
+                        "may be stuck in DELETING. Check the LINSTOR controller (linstor resource list) " +
+                        "and clear manually if the resource has no live peers.",
+                        rscDefName, LinstorUtil.DEFAULT_RD_DELETE_VERIFY_TIMEOUT_MILLIS);
+            }
         } catch (ApiException apiEx)
         {
             logger.error("Linstor: ApiEx - " + apiEx.getMessage());
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
index 7c45493dddc4..239331077e1b 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
@@ -401,6 +401,58 @@ public static List<ResourceDefinition> getRDListStartingWith(DevelopersApi api,
                 .collect(Collectors.toList());
     }
 
+    /**
+     * Default per-call timeout for {@link #waitForResourceDefinitionDeleted}. Long enough for a
+     * healthy LINSTOR controller to finish a normal delete; short enough not to block the calling
+     * thread for too long if the delete is genuinely stuck. Used both from the management server
+     * (e.g. {@code LinstorPrimaryDataStoreDriverImpl}) and from KVM agent paths.
+     */
+    public static final long DEFAULT_RD_DELETE_VERIFY_TIMEOUT_MILLIS = 30_000L;
+
+    /**
+     * Returns {@code true} if the named resource definition is no longer present on the LINSTOR
+     * controller. Used after a {@code resourceDefinitionDelete} to verify the delete actually
+     * completed (LINSTOR can return success on the API call while the resource lingers in
+     * DELETING state due to peer issues, lost quorum, or down satellites). Uses the
+     * controller-side name filter rather than scanning every RD on the cluster (cheap even
+     * when polled once per second from {@link #waitForResourceDefinitionDeleted}).
+     */
+    public static boolean isResourceDefinitionGone(DevelopersApi api, String rscName) throws ApiException {
+        List<ResourceDefinition> matching =
+                api.resourceDefinitionList(Collections.singletonList(rscName), false, null, null, null);
+        return matching == null || matching.isEmpty();
+    }
+
+    /**
+     * Polls the controller until the named resource definition is gone or the timeout elapses.
+     * Returns {@code true} if the resource was confirmed gone, {@code false} if it was still
+     * present (or the controller kept erroring) at the deadline. Callers should NOT throw on a
+     * {@code false} return — the upstream API call already reported success and the operator
+     * may need to investigate manually. Log a WARN with the resource name instead.
+     */
+    public static boolean waitForResourceDefinitionDeleted(DevelopersApi api, String rscName, long timeoutMillis) {
+        final long deadline = System.currentTimeMillis() + timeoutMillis;
+        while (true) {
+            try {
+                if (isResourceDefinitionGone(api, rscName)) {
+                    return true;
+                }
+            } catch (ApiException e) {
+                LOGGER.debug("LINSTOR delete-verify poll failed for {}: {}", rscName, e.getMessage());
+                // Keep polling — controller may be transiently unavailable.
+            }
+            if (System.currentTimeMillis() >= deadline) {
+                return false;
+            }
+            try {
+                Thread.sleep(1_000L);
+            } catch (InterruptedException ie) {
+                Thread.currentThread().interrupt();
+                return false;
+            }
+        }
+    }
+
     /**
      * Returns a pair list of resource-definitions with ther 1:1 mapped resource-group objects that start with the
      * resource name `startWith`

From 6b831f5196c3cfcc2d7aaf3fc2150c069d125fdc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Bernardo=20De=20Marco=20Gon=C3=A7alves?=
 <bernardomg2004@gmail.com>
Date: Fri, 22 May 2026 08:19:21 -0300
Subject: [PATCH 45/64] Live scaling for VMs with fixed service offerings on
 KVM (#12975)

---
 .../cloud/agent/api/to/VirtualMachineTO.java  |   8 +-
 .../com/cloud/agent/api/ScaleVmCommand.java   |   9 +-
 .../com/cloud/capacity/CapacityManager.java   |  14 ++
 .../cloud/vm/VirtualMachineManagerImpl.java   |  40 +++--
 .../META-INF/db/schema-42210to42300.sql       |  18 ++
 .../resource/LibvirtComputingResource.java    | 157 ++++++++++++++----
 .../kvm/resource/LibvirtDomainXMLParser.java  |   2 +-
 .../hypervisor/kvm/resource/LibvirtVMDef.java |  17 +-
 .../wrapper/LibvirtScaleVmCommandWrapper.java |   5 +-
 .../LibvirtComputingResourceTest.java         | 116 +++++++++++--
 .../cloud/capacity/CapacityManagerImpl.java   |   2 +-
 .../java/com/cloud/hypervisor/KVMGuru.java    | 148 ++++++++---------
 .../main/java/com/cloud/vm/UserVmManager.java |   4 +
 .../java/com/cloud/vm/UserVmManagerImpl.java  |  36 ++--
 .../com/cloud/hypervisor/KVMGuruTest.java     | 123 +++++++-------
 .../component/test_escalations_instances.py   |   3 -
 .../component/test_escalations_ipaddresses.py |   9 +-
 ui/public/locales/el_GR.json                  |   2 -
 ui/public/locales/en.json                     |   1 -
 ui/public/locales/ja_JP.json                  |   1 -
 ui/public/locales/pt_BR.json                  |   1 -
 ui/public/locales/te.json                     |   1 -
 ui/public/locales/zh_CN.json                  |   1 -
 ui/src/views/compute/ScaleVM.vue              |  37 ++---
 .../views/compute/wizard/ComputeSelection.vue |  12 +-
 25 files changed, 502 insertions(+), 265 deletions(-)

diff --git a/api/src/main/java/com/cloud/agent/api/to/VirtualMachineTO.java b/api/src/main/java/com/cloud/agent/api/to/VirtualMachineTO.java
index e26cc1e9f029..9af6c731fd24 100644
--- a/api/src/main/java/com/cloud/agent/api/to/VirtualMachineTO.java
+++ b/api/src/main/java/com/cloud/agent/api/to/VirtualMachineTO.java
@@ -51,6 +51,7 @@ public class VirtualMachineTO {
 
     private long minRam;
     private long maxRam;
+    private long requestedRam;
     private String hostName;
     private String arch;
     private String os;
@@ -207,15 +208,20 @@ public long getMinRam() {
         return minRam;
     }
 
-    public void setRam(long minRam, long maxRam) {
+    public void setRam(long minRam, long maxRam, long requestedRam) {
         this.minRam = minRam;
         this.maxRam = maxRam;
+        this.requestedRam = requestedRam;
     }
 
     public long getMaxRam() {
         return maxRam;
     }
 
+    public long getRequestedRam() {
+        return requestedRam;
+    }
+
     public String getHostName() {
         return hostName;
     }
diff --git a/core/src/main/java/com/cloud/agent/api/ScaleVmCommand.java b/core/src/main/java/com/cloud/agent/api/ScaleVmCommand.java
index dc63b1ee746d..e2953e9c7ad7 100644
--- a/core/src/main/java/com/cloud/agent/api/ScaleVmCommand.java
+++ b/core/src/main/java/com/cloud/agent/api/ScaleVmCommand.java
@@ -30,6 +30,7 @@ public class ScaleVmCommand extends Command {
     Integer maxSpeed;
     long minRam;
     long maxRam;
+    private boolean limitCpuUseChange;
 
     public VirtualMachineTO getVm() {
         return vm;
@@ -43,7 +44,7 @@ public int getCpus() {
         return cpus;
     }
 
-    public ScaleVmCommand(String vmName, int cpus, Integer minSpeed, Integer maxSpeed, long minRam, long maxRam, boolean limitCpuUse) {
+    public ScaleVmCommand(String vmName, int cpus, Integer minSpeed, Integer maxSpeed, long minRam, long maxRam, boolean limitCpuUse, Double cpuQuotaPercentage, boolean limitCpuUseChange) {
         super();
         this.vmName = vmName;
         this.cpus = cpus;
@@ -52,6 +53,8 @@ public ScaleVmCommand(String vmName, int cpus, Integer minSpeed, Integer maxSpee
         this.minRam = minRam;
         this.maxRam = maxRam;
         this.vm = new VirtualMachineTO(1L, vmName, null, cpus, minSpeed, maxSpeed, minRam, maxRam, null, null, false, limitCpuUse, null);
+        this.vm.setCpuQuotaPercentage(cpuQuotaPercentage);
+        this.limitCpuUseChange = limitCpuUseChange;
     }
 
     public void setCpus(int cpus) {
@@ -102,6 +105,10 @@ public VirtualMachineTO getVirtualMachine() {
         return vm;
     }
 
+    public boolean getLimitCpuUseChange() {
+        return limitCpuUseChange;
+    }
+
     @Override
     public boolean executeInSequence() {
         return true;
diff --git a/engine/components-api/src/main/java/com/cloud/capacity/CapacityManager.java b/engine/components-api/src/main/java/com/cloud/capacity/CapacityManager.java
index 4c81c7359f25..abaf6ea967d0 100644
--- a/engine/components-api/src/main/java/com/cloud/capacity/CapacityManager.java
+++ b/engine/components-api/src/main/java/com/cloud/capacity/CapacityManager.java
@@ -133,6 +133,20 @@ public interface CapacityManager {
             "capacity.calculate.workers", "1",
             "Number of worker threads to be used for capacities calculation", true);
 
+    ConfigKey<Integer> KvmMemoryDynamicScalingCapacity = new ConfigKey<>(ConfigKey.CATEGORY_ADVANCED,
+            Integer.class, "kvm.memory.dynamic.scaling.capacity", "0",
+            "Defines the maximum memory capacity in MiB for which VMs can be dynamically scaled to with KVM. " +
+                    "The 'kvm.memory.dynamic.scaling.capacity' setting's value will be used to define the value of the " +
+                    "'<maxMemory />' element of domain XMLs. If it is set to a value less than or equal to '0', then the host's memory capacity will be considered.",
+            true, ConfigKey.Scope.Cluster);
+
+    ConfigKey<Integer> KvmCpuDynamicScalingCapacity = new ConfigKey<>(ConfigKey.CATEGORY_ADVANCED,
+            Integer.class, "kvm.cpu.dynamic.scaling.capacity", "0",
+            "Defines the maximum vCPU capacity for which VMs can be dynamically scaled to with KVM. " +
+                    "The 'kvm.cpu.dynamic.scaling.capacity' setting's value will be used to define the value of the " +
+                    "'<vcpu />' element of domain XMLs. If it is set to a value less than or equal to '0', then the host's CPU cores capacity will be considered.",
+            true, ConfigKey.Scope.Cluster);
+
     public boolean releaseVmCapacity(VirtualMachine vm, boolean moveFromReserved, boolean moveToReservered, Long hostId);
 
     void allocateVmCapacity(VirtualMachine vm, boolean fromLastHost);
diff --git a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
index 17ddf8706702..ead990b42b86 100755
--- a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
+++ b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
@@ -50,6 +50,7 @@
 import javax.naming.ConfigurationException;
 import javax.persistence.EntityExistsException;
 
+import com.cloud.hypervisor.KVMGuru;
 import org.apache.cloudstack.affinity.dao.AffinityGroupVMMapDao;
 import org.apache.cloudstack.annotation.AnnotationService;
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
@@ -5162,7 +5163,7 @@ public VMInstanceVO reConfigureVm(final String vmUuid, final ServiceOffering old
             try {
                 result = retrieveResultFromJobOutcomeAndThrowExceptionIfNeeded(outcome);
             } catch (Exception ex) {
-                throw new RuntimeException("Unhandled exception", ex);
+                throw new RuntimeException("Unable to reconfigure VM.", ex);
             }
 
             if (result != null) {
@@ -5175,22 +5176,29 @@ public VMInstanceVO reConfigureVm(final String vmUuid, final ServiceOffering old
 
     private VMInstanceVO orchestrateReConfigureVm(String vmUuid, ServiceOffering oldServiceOffering, ServiceOffering newServiceOffering,
                                                   boolean reconfiguringOnExistingHost) throws ResourceUnavailableException, ConcurrentOperationException {
-        final VMInstanceVO vm = _vmDao.findByUuid(vmUuid);
+        VMInstanceVO vm = _vmDao.findByUuid(vmUuid);
 
         HostVO hostVo = _hostDao.findById(vm.getHostId());
 
-        Long clustedId = hostVo.getClusterId();
-        Float memoryOvercommitRatio = CapacityManager.MemOverprovisioningFactor.valueIn(clustedId);
-        Float cpuOvercommitRatio = CapacityManager.CpuOverprovisioningFactor.valueIn(clustedId);
-        boolean divideMemoryByOverprovisioning = HypervisorGuruBase.VmMinMemoryEqualsMemoryDividedByMemOverprovisioningFactor.valueIn(clustedId);
-        boolean divideCpuByOverprovisioning = HypervisorGuruBase.VmMinCpuSpeedEqualsCpuSpeedDividedByCpuOverprovisioningFactor.valueIn(clustedId);
+        Long clusterId = hostVo.getClusterId();
+        Float memoryOvercommitRatio = CapacityManager.MemOverprovisioningFactor.valueIn(clusterId);
+        Float cpuOvercommitRatio = CapacityManager.CpuOverprovisioningFactor.valueIn(clusterId);
+        boolean divideMemoryByOverprovisioning = HypervisorGuruBase.VmMinMemoryEqualsMemoryDividedByMemOverprovisioningFactor.valueIn(clusterId);
+        boolean divideCpuByOverprovisioning = HypervisorGuruBase.VmMinCpuSpeedEqualsCpuSpeedDividedByCpuOverprovisioningFactor.valueIn(clusterId);
 
         int minMemory = (int)(newServiceOffering.getRamSize() / (divideMemoryByOverprovisioning ? memoryOvercommitRatio : 1));
         int minSpeed = (int)(newServiceOffering.getSpeed() / (divideCpuByOverprovisioning ? cpuOvercommitRatio : 1));
 
-        ScaleVmCommand scaleVmCommand =
-                new ScaleVmCommand(vm.getInstanceName(), newServiceOffering.getCpu(), minSpeed,
-                        newServiceOffering.getSpeed(), minMemory * 1024L * 1024L, newServiceOffering.getRamSize() * 1024L * 1024L, newServiceOffering.getLimitCpuUse());
+        Double cpuQuotaPercentage = null;
+        if (newServiceOffering.getLimitCpuUse() && vm.getHypervisorType().equals(HypervisorType.KVM)) {
+            KVMGuru kvmGuru = (KVMGuru) _hvGuruMgr.getGuru(vm.getHypervisorType());
+            cpuQuotaPercentage = kvmGuru.getCpuQuotaPercentage(minSpeed, hostVo.getSpeed());
+        }
+
+        boolean limitCpuUseChange = oldServiceOffering.getLimitCpuUse() != newServiceOffering.getLimitCpuUse();
+        ScaleVmCommand scaleVmCommand = new ScaleVmCommand(vm.getInstanceName(), newServiceOffering.getCpu(), minSpeed, newServiceOffering.getSpeed(),
+                minMemory * 1024L * 1024L, newServiceOffering.getRamSize() * 1024L * 1024L,
+                newServiceOffering.getLimitCpuUse(), cpuQuotaPercentage, limitCpuUseChange);
 
         scaleVmCommand.getVirtualMachine().setId(vm.getId());
         scaleVmCommand.getVirtualMachine().setUuid(vm.getUuid());
@@ -5219,16 +5227,20 @@ private VMInstanceVO orchestrateReConfigureVm(String vmUuid, ServiceOffering old
                 throw new CloudRuntimeException("Unable to scale vm due to " + (reconfigureAnswer == null ? "" : reconfigureAnswer.getDetails()));
             }
 
-            upgradeVmDb(vm.getId(), newServiceOffering, oldServiceOffering);
+            if (reconfiguringOnExistingHost) {
+                _capacityMgr.releaseVmCapacity(vm, false, false, vm.getHostId());
+            }
+
+            boolean vmUpgraded = upgradeVmDb(vm.getId(), newServiceOffering, oldServiceOffering);
+            if (vmUpgraded) {
+                vm = _vmDao.findById(vm.getId());
+            }
 
             if (vm.getType().equals(VirtualMachine.Type.User)) {
                 _userVmMgr.generateUsageEvent(vm, vm.isDisplayVm(), EventTypes.EVENT_VM_DYNAMIC_SCALE);
             }
 
             if (reconfiguringOnExistingHost) {
-                vm.setServiceOfferingId(oldServiceOffering.getId());
-                _capacityMgr.releaseVmCapacity(vm, false, false, vm.getHostId());
-                vm.setServiceOfferingId(newServiceOffering.getId());
                 _capacityMgr.allocateVmCapacity(vm, false);
             }
 
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
index c99f798d3d56..dfa5fa8f3a14 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
@@ -131,3 +131,21 @@ CREATE TABLE IF NOT EXISTS `cloud_usage`.`quota_tariff_usage` (
 -- Add the 'keep_mac_address_on_public_nic' column to the 'cloud.networks' and 'cloud.vpc' tables
 CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.networks', 'keep_mac_address_on_public_nic', 'TINYINT(1) NOT NULL DEFAULT 1');
 CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vpc', 'keep_mac_address_on_public_nic', 'TINYINT(1) NOT NULL DEFAULT 1');
+
+-- Creates the 'kvm.memory.dynamic.scaling.capacity' and, for already active ACS environments,
+-- initializes it with the value of the setting 'vm.serviceoffering.ram.size.max'
+INSERT INTO `cloud`.`configuration` (`category`, `instance`, `component`, `name`, `value`, `default_value`, `updated`, `scope`, `is_dynamic`, `group_id`, `subgroup_id`, `display_text`, `description`)
+SELECT 'Advanced', 'DEFAULT', 'CapacityManager', 'kvm.memory.dynamic.scaling.capacity', `cfg`.`value`, 0, NULL, 4, 1, 6, 27,
+       'KVM memory dynamic scaling capacity', 'Defines the maximum memory capacity in MiB for which VMs can be dynamically scaled to with KVM. The ''kvm.memory.dynamic.scaling.capacity'' setting''s value will be used to define the value of the ''<maxMemory />'' element of domain XMLs. If it is set to a value less than or equal to ''0'', then the host''s memory capacity will be considered.'
+FROM `cloud`.`configuration` `cfg`
+WHERE NOT EXISTS (SELECT 1 FROM `cloud`.`configuration` WHERE `name` = 'kvm.memory.dynamic.scaling.capacity')
+  AND `cfg`.`name` = 'vm.serviceoffering.ram.size.max';
+
+-- Creates the 'kvm.cpu.dynamic.scaling.capacity' and, for already active ACS environments,
+-- initializes it with the value of the setting 'vm.serviceoffering.cpu.cores.max'
+INSERT INTO `cloud`.`configuration` (`category`, `instance`, `component`, `name`, `value`, `default_value`, `updated`, `scope`, `is_dynamic`, `group_id`, `subgroup_id`, `display_text`, `description`)
+SELECT 'Advanced', 'DEFAULT', 'CapacityManager', 'kvm.cpu.dynamic.scaling.capacity', `cfg`.`value`, 0, NULL, 4, 1, 6, 27,
+       'KVM CPU dynamic scaling capacity', 'Defines the maximum vCPU capacity for which VMs can be dynamically scaled to with KVM. The ''kvm.cpu.dynamic.scaling.capacity'' setting''s value will be used to define the value of the ''<vcpu />'' element of domain XMLs. If it is set to a value less than or equal to ''0'', then the host''s CPU cores capacity will be considered.'
+FROM `cloud`.`configuration` `cfg`
+WHERE NOT EXISTS (SELECT 1 FROM `cloud`.`configuration` WHERE `name` = 'kvm.cpu.dynamic.scaling.capacity')
+  AND `cfg`.`name` = 'vm.serviceoffering.cpu.cores.max';
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index 64ec0ed95d2e..06b668b801d3 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -124,6 +124,7 @@
 import org.libvirt.LibvirtException;
 import org.libvirt.MemoryStatistic;
 import org.libvirt.Network;
+import org.libvirt.SchedLongParameter;
 import org.libvirt.SchedParameter;
 import org.libvirt.SchedUlongParameter;
 import org.libvirt.Secret;
@@ -883,6 +884,25 @@ protected enum HealthCheckResult {
         SUCCESS, FAILURE, IGNORE
     }
 
+    public enum CpuSchedulerParameter {
+        CPU_SHARES("cpu_shares"), PERIOD("vcpu_period"), QUOTA("vcpu_quota");
+
+        private String name;
+
+        CpuSchedulerParameter(String name) {
+            this.name = name;
+        }
+
+        public String getName() {
+            return name;
+        }
+
+        @Override
+        public String toString() {
+            return getName();
+        }
+    }
+
     protected BridgeType bridgeType;
 
     protected StorageSubsystemCommandHandler storageHandler;
@@ -2965,23 +2985,61 @@ protected String getUuid(String uuid) {
     protected void setQuotaAndPeriod(VirtualMachineTO vmTO, CpuTuneDef ctd) {
         if (vmTO.isLimitCpuUse() && vmTO.getCpuQuotaPercentage() != null) {
             Double cpuQuotaPercentage = vmTO.getCpuQuotaPercentage();
-            int period = CpuTuneDef.DEFAULT_PERIOD;
-            int quota = (int) (period * cpuQuotaPercentage);
-            if (quota < CpuTuneDef.MIN_QUOTA) {
-                LOGGER.info("Calculated quota (" + quota + ") below the minimum (" + CpuTuneDef.MIN_QUOTA + ") for VM domain " + vmTO.getUuid() + ", setting it to minimum " +
-                        "and calculating period instead of using the default");
-                quota = CpuTuneDef.MIN_QUOTA;
-                period = (int) ((double) quota / cpuQuotaPercentage);
-                if (period > CpuTuneDef.MAX_PERIOD) {
-                    LOGGER.info("Calculated period (" + period + ") exceeds the maximum (" + CpuTuneDef.MAX_PERIOD +
-                            "), setting it to the maximum");
-                    period = CpuTuneDef.MAX_PERIOD;
-                }
+            Pair<Integer, Long> periodAndQuota = getPeriodAndQuota(cpuQuotaPercentage);
+            ctd.setPeriod(periodAndQuota.first());
+            ctd.setQuota(periodAndQuota.second());
+            LOGGER.info("Setting quota = [{}] and period = [{}] to VM domain [{}].", periodAndQuota.second(), periodAndQuota.first(), vmTO.getUuid());
+        }
+    }
+
+    /**
+     * Calculates the CPU period and quota based on the quota percentage defined by the Management Server
+     * @param cpuQuotaPercentage CPU quota percentage defined by the Management Server
+     * @return The period and quota to be defined for the VM's domain
+     */
+    protected Pair<Integer, Long> getPeriodAndQuota(double cpuQuotaPercentage) {
+        int period = CpuTuneDef.DEFAULT_PERIOD;
+        long quota = (long) (period * cpuQuotaPercentage);
+        if (quota < CpuTuneDef.MIN_QUOTA) {
+            LOGGER.info("Calculated quota ({}) below the minimum ({}), setting it to minimum and calculating period instead of using the default", quota, CpuTuneDef.MIN_QUOTA);
+            quota = CpuTuneDef.MIN_QUOTA;
+            period = (int) ((double) quota / cpuQuotaPercentage);
+            if (period > CpuTuneDef.MAX_PERIOD) {
+                LOGGER.info("Calculated period ({}) exceeds the maximum ({}), setting it to the maximum", period, CpuTuneDef.MAX_PERIOD);
+                period = CpuTuneDef.MAX_PERIOD;
             }
-            ctd.setQuota(quota);
-            ctd.setPeriod(period);
-            LOGGER.info("Setting quota=" + quota + ", period=" + period + " to VM domain " + vmTO.getUuid());
         }
+
+        LOGGER.info("Calculated period = [{}] and quota = [{}] given the [{}] quota percentage.", period, quota, cpuQuotaPercentage);
+        return new Pair<>(period, quota);
+    }
+
+    /**
+     * Dynamically updates the domain's "vcpu_quota" and "period" fields of the CPU tune definition.
+     * This is required because the values of the fields must change according to the new CPU speed of the VM.
+     * When the CPU limitation is removed from the domain, the "vcpu_quota" field is set to 17,592,186,044,415.
+     * @param domain VM's domain.
+     * @param vmTO VM's transfer object, which contains the required fields to update the "vcpu_quota" and "period" fields.
+     * @param limitCpuUseChange Indicates whether the CPU limitation for the VM has changed.
+     * @throws org.libvirt.LibvirtException
+     **/
+    public void updateCpuQuotaAndPeriod(Domain domain, VirtualMachineTO vmTO, boolean limitCpuUseChange) throws LibvirtException {
+        if (hypervisorLibvirtVersion < MIN_LIBVIRT_VERSION_FOR_GUEST_CPU_TUNE || (!limitCpuUseChange && !vmTO.isLimitCpuUse())) {
+            logger.info("Not updating the [{}] and [{}] for the [{}] domain, because [{}].",
+                    CpuSchedulerParameter.QUOTA, CpuSchedulerParameter.PERIOD, domain.getName(), hypervisorLibvirtVersion < MIN_LIBVIRT_VERSION_FOR_GUEST_CPU_TUNE ?
+                            "the current Libvirt version does not support CPU tune" : "it was not requested to remove, change or apply CPU limitation for the instance.");
+            return;
+        }
+
+        if (limitCpuUseChange && !vmTO.isLimitCpuUse()) {
+            logger.info("Updating the [{}] of the [{}] domain to [{}], because CPU limitation has been removed.", CpuSchedulerParameter.QUOTA, domain.getName(), CpuTuneDef.MAX_CPU_QUOTA);
+            LibvirtComputingResource.setQuota(domain, CpuTuneDef.MAX_CPU_QUOTA);
+            return;
+        }
+
+        Pair<Integer, Long> periodAndQuota = getPeriodAndQuota(vmTO.getCpuQuotaPercentage());
+        LibvirtComputingResource.setPeriod(domain, periodAndQuota.first());
+        LibvirtComputingResource.setQuota(domain, periodAndQuota.second());
     }
 
     protected void enlightenWindowsVm(VirtualMachineTO vmTO, FeaturesDef features) {
@@ -3445,10 +3503,10 @@ protected GuestResourceDef createGuestResourceDef(VirtualMachineTO vmTO){
 
         grd.setMemBalloning(!noMemBalloon);
 
-        Long maxRam = ByteScaleUtils.bytesToKibibytes(vmTO.getMaxRam());
-
-        grd.setMemorySize(maxRam);
-        grd.setCurrentMem(getCurrentMemAccordingToMemBallooning(vmTO, maxRam));
+        long requestedRam = ByteScaleUtils.bytesToKibibytes(vmTO.getRequestedRam());
+        long minRam = ByteScaleUtils.bytesToKibibytes(vmTO.getMinRam());
+        grd.setCurrentMem(getCurrentMemAccordingToMemBallooning(vmTO, requestedRam, minRam));
+        grd.setMaxMemory(ByteScaleUtils.bytesToKibibytes(vmTO.getMaxRam()));
 
         int vcpus = vmTO.getCpus();
         Integer maxVcpus = vmTO.getVcpuMaxLimit();
@@ -3459,18 +3517,19 @@ protected GuestResourceDef createGuestResourceDef(VirtualMachineTO vmTO){
         return grd;
     }
 
-    protected long getCurrentMemAccordingToMemBallooning(VirtualMachineTO vmTO, long maxRam) {
-        long retVal = maxRam;
+    protected long getCurrentMemAccordingToMemBallooning(VirtualMachineTO vmTO, long requestedRam, long minRam) {
         if (noMemBalloon) {
-            LOGGER.warn(String.format("Setting VM's [%s] current memory as max memory [%s] due to memory ballooning is disabled. If you are using a custom service offering, verify if memory ballooning really should be disabled.", vmTO.toString(), maxRam));
-        } else if (vmTO != null && vmTO.getType() != VirtualMachine.Type.User) {
-            LOGGER.warn(String.format("Setting System VM's [%s] current memory as max memory [%s].", vmTO.toString(), maxRam));
-        } else {
-            long minRam = ByteScaleUtils.bytesToKibibytes(vmTO.getMinRam());
-            LOGGER.debug(String.format("Setting VM's [%s] current memory as min memory [%s] due to memory ballooning is enabled.", vmTO.toString(), minRam));
-            retVal = minRam;
+            LOGGER.warn("Setting VM's [{}] current memory as requested memory [{}] due to memory ballooning is disabled.", vmTO.toString(), requestedRam);
+            return requestedRam;
+        }
+
+        if (vmTO != null && vmTO.getType() != VirtualMachine.Type.User) {
+            LOGGER.warn("Setting System VM's [{}] current memory as requested memory [{}].", vmTO.toString(), requestedRam);
+            return requestedRam;
         }
-        return retVal;
+
+        LOGGER.debug("Setting VM's [{}] current memory as min memory [{}] due to memory ballooning is enabled.", vmTO.toString(), minRam);
+        return minRam;
     }
 
     /**
@@ -6255,29 +6314,59 @@ public static long countDomainRunningVcpus(Domain dm) throws LibvirtException {
      **/
     public static Integer getCpuShares(Domain dm) throws LibvirtException {
         for (SchedParameter c : dm.getSchedulerParameters()) {
-            if (c.field.equals("cpu_shares")) {
+            if (c.field.equals(CpuSchedulerParameter.CPU_SHARES.getName())) {
                 return Integer.parseInt(c.getValueAsString());
             }
         }
-        LOGGER.warn(String.format("Could not get cpu_shares of domain: [%s]. Returning default value of 0. ", dm.getName()));
+        LOGGER.warn("Could not get [{}] of domain: [{}]. Returning default value of 0. ", CpuSchedulerParameter.CPU_SHARES.getName(), dm.getName());
         return 0;
     }
 
     /**
-     * Sets the cpu_shares (priority) of the running VM <br/>
+     * Updates the cpu_shares (priority) of the running VM.
      * @param dm domain of the VM.
      * @param cpuShares new priority of the running VM.
-     * @throws org.libvirt.LibvirtException
      **/
     public static void setCpuShares(Domain dm, Integer cpuShares) throws LibvirtException {
+        LOGGER.info("Dynamically updating the [{}] of the [{}] VM to [{}].", CpuSchedulerParameter.CPU_SHARES.getName(), dm.getName(), cpuShares);
         SchedUlongParameter[] params = new SchedUlongParameter[1];
         params[0] = new SchedUlongParameter();
-        params[0].field = "cpu_shares";
+        params[0].field = CpuSchedulerParameter.CPU_SHARES.getName();
         params[0].value = cpuShares;
 
         dm.setSchedulerParameters(params);
     }
 
+    /**
+     * Updates the period of the running VM.
+     * @param domain domain of the VM.
+     * @param period new period of the running VM.
+     **/
+    public static void setPeriod(Domain domain, int period) throws LibvirtException {
+        LOGGER.info("Dynamically updating the [{}] of the [{}] VM to [{}].", CpuSchedulerParameter.PERIOD.getName(), domain.getName(), period);
+        SchedUlongParameter[] params = new SchedUlongParameter[1];
+        params[0] = new SchedUlongParameter();
+        params[0].field = CpuSchedulerParameter.PERIOD.getName();
+        params[0].value = period;
+
+        domain.setSchedulerParameters(params);
+    }
+
+    /**
+     * Updates the quota of the running VM.
+     * @param domain domain of the VM.
+     * @param quota new quota of the running VM.
+     **/
+    public static void setQuota(Domain domain, long quota) throws LibvirtException {
+        LOGGER.info("Dynamically updating the [{}] of the [{}] VM to [{}].", CpuSchedulerParameter.QUOTA.getName(), domain.getName(), quota);
+        SchedLongParameter[] params = new SchedLongParameter[1];
+        params[0] = new SchedLongParameter();
+        params[0].field = CpuSchedulerParameter.QUOTA.getName();
+        params[0].value = quota;
+
+        domain.setSchedulerParameters(params);
+    }
+
     /**
      * Set up a libvirt secret for a volume. If Libvirt says that a secret already exists for this volume path, we use its uuid.
      * The UUID of the secret needs to be prescriptive such that we can register the same UUID on target host during live migration
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java
index 4d823783a99a..e114669b8b56 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtDomainXMLParser.java
@@ -542,7 +542,7 @@ private void extractCpuTuneDef(final Element rootElement) {
 
             final String quota = getTagValue("quota", cpuTuneDefElement);
             if (StringUtils.isNotBlank(quota)) {
-                cpuTuneDef.setQuota((Integer.parseInt(quota)));
+                cpuTuneDef.setQuota((Long.parseLong(quota)));
             }
 
             final String period = getTagValue("period", cpuTuneDefElement);
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java
index 097a9b8dd322..bf8b1af6c18d 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtVMDef.java
@@ -443,15 +443,15 @@ public String toString() {
     }
 
     public static class GuestResourceDef {
-        private long memory;
+        private long maxMemory;
         private long currentMemory = -1;
         private int vcpu = -1;
         private int maxVcpu = -1;
         private boolean memoryBalloning = false;
         private int memoryBalloonStatsPeriod = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.VM_MEMBALLOON_STATS_PERIOD);
 
-        public void setMemorySize(long mem) {
-            this.memory = mem;
+        public void setMaxMemory(long mem) {
+            this.maxMemory = mem;
         }
 
         public void setCurrentMem(long currMem) {
@@ -484,8 +484,8 @@ public String toString() {
             response.append(String.format("<memory>%s</memory>\n", this.currentMemory));
             response.append(String.format("<currentMemory>%s</currentMemory>\n", this.currentMemory));
 
-            if (this.memory > this.currentMemory) {
-                response.append(String.format("<maxMemory slots='16' unit='KiB'>%s</maxMemory>\n", this.memory));
+            if (this.maxMemory > this.currentMemory) {
+                response.append(String.format("<maxMemory slots='16' unit='KiB'>%s</maxMemory>\n", this.maxMemory));
                 response.append(String.format("<cpu> <numa> <cell id='0' cpus='0-%s' memory='%s' unit='KiB'/> </numa> </cpu>\n", this.maxVcpu - 1, this.currentMemory));
             }
 
@@ -1920,11 +1920,12 @@ public String toString() {
 
     public static class CpuTuneDef {
         private int _shares = 0;
-        private int quota = 0;
+        private long quota = 0;
         private int period = 0;
         static final int DEFAULT_PERIOD = 10000;
         static final int MIN_QUOTA = 1000;
         static final int MAX_PERIOD = 1000000;
+        public static final long MAX_CPU_QUOTA = 17592186044415L;
 
         public void setShares(int shares) {
             _shares = shares;
@@ -1934,11 +1935,11 @@ public int getShares() {
             return _shares;
         }
 
-        public int getQuota() {
+        public long getQuota() {
             return quota;
         }
 
-        public void setQuota(int quota) {
+        public void setQuota(long quota) {
             this.quota = quota;
         }
 
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtScaleVmCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtScaleVmCommandWrapper.java
index 1536984f2e85..b1f64c8c6dbb 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtScaleVmCommandWrapper.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtScaleVmCommandWrapper.java
@@ -49,10 +49,11 @@ public Answer execute(ScaleVmCommand command, LibvirtComputingResource libvirtCo
             conn = libvirtUtilitiesHelper.getConnectionByVmName(vmName);
             Domain dm = conn.domainLookupByName(vmName);
 
-            logger.debug(String.format("Scaling %s.", scalingDetails));
+            logger.debug("Scaling {}.", scalingDetails);
             scaleMemory(dm, newMemory, vmDefinition);
             scaleVcpus(dm, newVcpus, vmDefinition);
             updateCpuShares(dm, newCpuShares);
+            libvirtComputingResource.updateCpuQuotaAndPeriod(dm, vmSpec, command.getLimitCpuUseChange());
 
             return new ScaleVmAnswer(command, true, String.format("Successfully scaled %s.", scalingDetails));
         } catch (LibvirtException | CloudRuntimeException e) {
@@ -74,7 +75,7 @@ protected void updateCpuShares(Domain dm, int newCpuShares) throws LibvirtExcept
 
         if (oldCpuShares < newCpuShares) {
             LibvirtComputingResource.setCpuShares(dm, newCpuShares);
-            logger.info(String.format("Successfully increased cpu_shares of VM [%s] from [%s] to [%s].", dm.getName(), oldCpuShares, newCpuShares));
+            logger.info("Successfully increased cpu_shares of VM [{}] from [{}] to [{}].", dm.getName(), oldCpuShares, newCpuShares);
         }
     }
 
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
index f35230f8c6b2..b3bdafb73751 100644
--- a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResourceTest.java
@@ -5642,35 +5642,45 @@ public void testAddExtraConfigComponentNotEmptyExtraConfig() {
         Mockito.verify(vmDef, times(1)).addComp(any());
     }
 
-    public void validateGetCurrentMemAccordingToMemBallooningWithoutMemBalooning(){
+    @Test
+    public void getCurrentMemAccordingToMemBallooningTestValidateCurrentMemoryWithoutMemBallooning(){
         VirtualMachineTO vmTo = Mockito.mock(VirtualMachineTO.class);
-        Mockito.when(vmTo.getType()).thenReturn(Type.User);
         LibvirtComputingResource libvirtComputingResource = new LibvirtComputingResource();
         libvirtComputingResource.noMemBalloon = true;
-        long maxMemory = 2048;
+        long requestedMemory = 1024 * 1024;
+        long minMemory = 512 * 1024;
 
-        long currentMemory = libvirtComputingResource.getCurrentMemAccordingToMemBallooning(vmTo, maxMemory);
-        Assert.assertEquals(maxMemory, currentMemory);
-        Mockito.verify(vmTo, Mockito.times(0)).getMinRam();
+        long currentMemory = libvirtComputingResource.getCurrentMemAccordingToMemBallooning(vmTo, requestedMemory, minMemory);
+        Assert.assertEquals(requestedMemory, currentMemory);
     }
 
     @Test
-    public void validateGetCurrentMemAccordingToMemBallooningWithtMemBalooning(){
+    public void getCurrentMemAccordingToMemBallooningTestValidateCurrentMemoryWithMemoryBallooning(){
         LibvirtComputingResource libvirtComputingResource = new LibvirtComputingResource();
         libvirtComputingResource.noMemBalloon = false;
 
-        long maxMemory = 2048;
-        long minMemory = ByteScaleUtils.mebibytesToBytes(64);
-
         VirtualMachineTO vmTo = Mockito.mock(VirtualMachineTO.class);
         Mockito.when(vmTo.getType()).thenReturn(Type.User);
-        Mockito.when(vmTo.getMinRam()).thenReturn(minMemory);
+        long requestedMemory = 1024 * 1024;
+        long minMemory = 512 * 1024;
 
-        long currentMemory = libvirtComputingResource.getCurrentMemAccordingToMemBallooning(vmTo, maxMemory);
-        Assert.assertEquals(ByteScaleUtils.bytesToKibibytes(minMemory), currentMemory);
-        Mockito.verify(vmTo).getMinRam();
+        long currentMemory = libvirtComputingResource.getCurrentMemAccordingToMemBallooning(vmTo, requestedMemory, minMemory);
+        Assert.assertEquals(minMemory, currentMemory);
     }
 
+    @Test
+    public void getCurrentMemAccordingToMemBallooningTestValidateCurrentMemoryForSystemVms() {
+        LibvirtComputingResource libvirtComputingResource = new LibvirtComputingResource();
+        libvirtComputingResource.noMemBalloon = false;
+
+        VirtualMachineTO vmTo = Mockito.mock(VirtualMachineTO.class);
+        Mockito.when(vmTo.getType()).thenReturn(Type.SecondaryStorageVm);
+        long requestedMemory = 1024 * 1024;
+        long minMemory = 512 * 1024;
+
+        long currentMemory = libvirtComputingResource.getCurrentMemAccordingToMemBallooning(vmTo, requestedMemory, minMemory);
+        Assert.assertEquals(requestedMemory, currentMemory);
+    }
     @Test
     public void validateCreateGuestResourceDefWithVcpuMaxLimit(){
         LibvirtComputingResource libvirtComputingResource = new LibvirtComputingResource();
@@ -7234,4 +7244,82 @@ public void getInterfaceTestInvalidMacAddressThrowCloudRuntimeException() {
 
         libvirtComputingResourceSpy.getInterface(connMock, vmName, invalidMacAddress);
     }
+
+    @Test
+    public void updateCpuQuotaAndPeriodTestAssertPeriodAndQuotaAreNotUpdatedWhenLibvirtVersionIsLessThanTheMinimum() throws LibvirtException {
+        libvirtComputingResourceSpy.hypervisorLibvirtVersion = 8999;
+        libvirtComputingResourceSpy.updateCpuQuotaAndPeriod(domainMock, null, false);
+        Mockito.verify(domainMock, Mockito.never()).setSchedulerParameters(Mockito.any());
+    }
+
+    @Test
+    public void updateCpuQuotaAndPeriodTestAssertPeriodAndQuotaAreNotUpdatedWhenThereIsNoCapCapChangeAndNoCpuLimitationIsApplied() throws LibvirtException {
+        Mockito.when(vmTO.isLimitCpuUse()).thenReturn(false);
+        libvirtComputingResourceSpy.hypervisorLibvirtVersion = 9000;
+        libvirtComputingResourceSpy.updateCpuQuotaAndPeriod(domainMock, vmTO, false);
+        Mockito.verify(domainMock, Mockito.never()).setSchedulerParameters(Mockito.any());
+    }
+
+    @Test
+    public void updateCpuQuotaAndPeriodTestAssertQuotaIsRemovedWhenThereIsCpuCapChangeAndNoCpuLimitationIsApplied() throws LibvirtException {
+        Mockito.when(vmTO.isLimitCpuUse()).thenReturn(false);
+        Mockito.when(domainMock.getName()).thenReturn("i-2-10-VM");
+        libvirtComputingResourceSpy.hypervisorLibvirtVersion = 9000;
+        libvirtComputingResourceSpy.updateCpuQuotaAndPeriod(domainMock, vmTO, true);
+        Mockito.verify(domainMock, Mockito.times(1)).setSchedulerParameters(Mockito.any());
+    }
+
+    @Test
+    public void updateCpuQuotaAndPeriodTestAssertPeriodAndQuotaAreUpdatedWhenThereIsNotCpuCapChangeAndCpuLimitationIsApplied() throws LibvirtException {
+        Mockito.when(vmTO.isLimitCpuUse()).thenReturn(true);
+        double cpuQuotaPercentage = 0.03;
+        Mockito.when(vmTO.getCpuQuotaPercentage()).thenReturn(cpuQuotaPercentage);
+        Mockito.doReturn(new Pair<>(1000, 300L)).when(libvirtComputingResourceSpy).getPeriodAndQuota(cpuQuotaPercentage);
+        Mockito.when(domainMock.getName()).thenReturn("i-2-10-VM");
+        libvirtComputingResourceSpy.hypervisorLibvirtVersion = 9000;
+        libvirtComputingResourceSpy.updateCpuQuotaAndPeriod(domainMock, vmTO, false);
+        Mockito.verify(domainMock, Mockito.times(2)).setSchedulerParameters(Mockito.any());
+    }
+
+    @Test
+    public void updateCpuQuotaAndPeriodTestAssertPeriodAndQuotaAreUpdatedWhenThereIsCpuCapChangeAndCpuLimitationIsApplied() throws LibvirtException {
+        Mockito.when(vmTO.isLimitCpuUse()).thenReturn(true);
+        double cpuQuotaPercentage = 0.03;
+        Mockito.when(vmTO.getCpuQuotaPercentage()).thenReturn(cpuQuotaPercentage);
+        Mockito.doReturn(new Pair<>(1000, 300L)).when(libvirtComputingResourceSpy).getPeriodAndQuota(cpuQuotaPercentage);
+        Mockito.when(domainMock.getName()).thenReturn("i-2-10-VM");
+        libvirtComputingResourceSpy.hypervisorLibvirtVersion = 9000;
+        libvirtComputingResourceSpy.updateCpuQuotaAndPeriod(domainMock, vmTO, true);
+        Mockito.verify(domainMock, Mockito.times(2)).setSchedulerParameters(Mockito.any());
+    }
+
+    @Test
+    public void getPeriodAndQuotaTestAssertQuotaIsEqualToPeriodMultipliedByQuotaPercentage() {
+        double cpuQuotaPercentage = 0.3;
+        int expectedPeriod = CpuTuneDef.DEFAULT_PERIOD;
+        long expectedQuota = (long) (expectedPeriod * cpuQuotaPercentage);
+        Pair<Integer, Long> expectedResult = new Pair<>(expectedPeriod, expectedQuota);
+        Pair<Integer, Long> result = libvirtComputingResourceSpy.getPeriodAndQuota(cpuQuotaPercentage);
+        Assert.assertEquals(expectedResult, result);
+    }
+
+    @Test
+    public void getPeriodAndQuotaTestQuotaIsEqualToMinimumWhenRequired() {
+        double cpuQuotaPercentage = 0.03;
+        long expectedQuota = CpuTuneDef.MIN_QUOTA;
+        int expectedPeriod = (int) ((double) expectedQuota / cpuQuotaPercentage);
+        Pair<Integer, Long> expectedResult = new Pair<>(expectedPeriod, expectedQuota);
+        Pair<Integer, Long> result = libvirtComputingResourceSpy.getPeriodAndQuota(cpuQuotaPercentage);
+        Assert.assertEquals(expectedResult, result);
+    }
+
+    @Test
+    public void getPeriodAndQuotaTestPeriodIsEqualToMaximumWhenRequired() {
+        double cpuQuotaPercentage = 0.0003;
+        long expectedQuota = CpuTuneDef.MIN_QUOTA;
+        int expectedPeriod = CpuTuneDef.MAX_PERIOD;
+        Pair<Integer, Long> expectedResult = new Pair<>(expectedPeriod, expectedQuota);
+        Pair<Integer, Long> result = libvirtComputingResourceSpy.getPeriodAndQuota(cpuQuotaPercentage);
+        Assert.assertEquals(expectedResult, result);
+    }
 }
diff --git a/server/src/main/java/com/cloud/capacity/CapacityManagerImpl.java b/server/src/main/java/com/cloud/capacity/CapacityManagerImpl.java
index 2940f900b081..3be7384ffb71 100644
--- a/server/src/main/java/com/cloud/capacity/CapacityManagerImpl.java
+++ b/server/src/main/java/com/cloud/capacity/CapacityManagerImpl.java
@@ -1214,6 +1214,6 @@ public String getConfigComponentName() {
     public ConfigKey<?>[] getConfigKeys() {
         return new ConfigKey<?>[] {CpuOverprovisioningFactor, MemOverprovisioningFactor, StorageCapacityDisableThreshold, StorageOverprovisioningFactor,
                 StorageAllocatedCapacityDisableThreshold, StorageOperationsExcludeCluster, ImageStoreNFSVersion, SecondaryStorageCapacityThreshold,
-                StorageAllocatedCapacityDisableThresholdForVolumeSize, CapacityCalculateWorkers };
+                StorageAllocatedCapacityDisableThresholdForVolumeSize, CapacityCalculateWorkers, KvmMemoryDynamicScalingCapacity, KvmCpuDynamicScalingCapacity };
     }
 }
diff --git a/server/src/main/java/com/cloud/hypervisor/KVMGuru.java b/server/src/main/java/com/cloud/hypervisor/KVMGuru.java
index 3303bc029333..6c1c3424b1b9 100644
--- a/server/src/main/java/com/cloud/hypervisor/KVMGuru.java
+++ b/server/src/main/java/com/cloud/hypervisor/KVMGuru.java
@@ -20,7 +20,7 @@
 import com.cloud.agent.api.to.DataObjectType;
 import com.cloud.agent.api.to.NicTO;
 import com.cloud.agent.api.to.VirtualMachineTO;
-import com.cloud.configuration.ConfigurationManagerImpl;
+import com.cloud.capacity.CapacityManager;
 import com.cloud.event.EventTypes;
 import com.cloud.event.UsageEventUtils;
 import com.cloud.host.HostVO;
@@ -44,6 +44,7 @@
 import com.cloud.vm.VirtualMachineProfile;
 import com.cloud.vm.dao.VMInstanceDao;
 import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.storage.command.CopyCommand;
 import org.apache.cloudstack.storage.command.StorageSubSystemCommand;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
@@ -54,9 +55,7 @@
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Map;
-import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.utils.bytescale.ByteScaleUtils;
-import org.apache.commons.lang3.math.NumberUtils;
 
 public class KVMGuru extends HypervisorGuruBase implements HypervisorGuru {
     @Inject
@@ -130,30 +129,47 @@ protected double getVmSpeed(VirtualMachineTO to) {
      * @param vmProfile vm profile
      */
     protected void setVmQuotaPercentage(VirtualMachineTO to, VirtualMachineProfile vmProfile) {
-        if (to.isLimitCpuUse()) {
-            VirtualMachine vm = vmProfile.getVirtualMachine();
-            HostVO host = hostDao.findById(vm.getHostId());
-            if (host == null) {
-                logger.warn("Host is not available. Skipping setting CPU quota percentage for VM: {}", vm);
-                return;
-            }
-            logger.debug("Limiting CPU usage for VM: {} on host: {}", vm, host);
-            double hostMaxSpeed = getHostCPUSpeed(host);
-            double maxSpeed = getVmSpeed(to);
-            try {
-                BigDecimal percent = new BigDecimal(maxSpeed / hostMaxSpeed);
-                percent = percent.setScale(2, RoundingMode.HALF_DOWN);
-                if (percent.compareTo(new BigDecimal(1)) == 1) {
-                    logger.debug("VM {} CPU MHz exceeded host {} CPU MHz, limiting VM CPU to the host maximum", vm, host);
-                    percent = new BigDecimal(1);
-                }
-                to.setCpuQuotaPercentage(percent.doubleValue());
-                logger.debug("Host: {} max CPU speed = {} MHz, VM: {} max CPU speed = {} MHz. " +
-                        "Setting CPU quota percentage as: {}",
-                        host, hostMaxSpeed, vm, maxSpeed, percent.doubleValue());
-            } catch (NumberFormatException e) {
-                logger.error("Error calculating VM: {} quota percentage, it will not be set. Error: {}", vm, e.getMessage(), e);
+        if (!to.isLimitCpuUse()) {
+            return;
+        }
+
+        VirtualMachine vm = vmProfile.getVirtualMachine();
+        HostVO host = hostDao.findById(vm.getHostId());
+        if (host == null) {
+            logger.warn("Host is not available. Skipping setting CPU quota percentage for VM: [{}].", vm);
+            return;
+        }
+
+        logger.debug("Limiting CPU usage for VM: [{}] on host: [{}].", vm, host);
+        double maxSpeed = getVmSpeed(to);
+        double hostMaxSpeed = getHostCPUSpeed(host);
+        Double cpuQuotaPercentage = getCpuQuotaPercentage(maxSpeed, hostMaxSpeed);
+        if (cpuQuotaPercentage != null) {
+            to.setCpuQuotaPercentage(cpuQuotaPercentage);
+        }
+    }
+
+    /**
+     * Calculates the VM quota percentage based on the VM and host CPU speeds.
+     * @param vmSpeeed Speed of the VM.
+     * @param hostSpeed Speed of the host.
+     * @return The VM quota percentage.
+     */
+    public Double getCpuQuotaPercentage(double vmSpeeed, double hostSpeed) {
+        logger.debug("Calculating CPU quota percentage for VM with speed [{}] on host with speed [{}].", vmSpeeed, hostSpeed);
+        try {
+            BigDecimal percent = new BigDecimal(vmSpeeed / hostSpeed);
+            percent = percent.setScale(2, RoundingMode.HALF_DOWN);
+            if (percent.compareTo(new BigDecimal(1)) > 0) {
+                logger.debug("VM CPU speed exceeded host CPU speed and, therefore, limiting VM CPU quota to the host maximum.");
+                percent = new BigDecimal(1);
             }
+            double quotaPercentage = percent.doubleValue();
+            logger.info("Calculated CPU quota percentage for VM with speed [{}] on host with speed [{}] is [{}].", vmSpeeed, hostSpeed, quotaPercentage);
+            return quotaPercentage;
+        } catch (NumberFormatException e) {
+            logger.info("Could not calculate CPU quota percentage for VM with speed [{}] on host with speed [{}]. Therefore, CPU limitation will not be set for the domain.", vmSpeeed, hostSpeed);
+            return null;
         }
     }
 
@@ -214,28 +230,31 @@ protected void configureVmMemoryAndCpuCores(VirtualMachineTO virtualMachineTo, H
         Pair<Long, Integer> max = getHostMaxMemoryAndCpuCores(hostVo, virtualMachine, vmDescription);
 
         Long maxHostMemory = max.first();
-        Integer maxHostCpuCore = max.second();
+        Integer maxHostCpuCores = max.second();
 
         long minMemory = virtualMachineTo.getMinRam();
         Long maxMemory = virtualMachineTo.getMaxRam();
+        long requestedMemory = maxMemory;
+
         int minCpuCores = virtualMachineTo.getCpus();
-        Integer maxCpuCores = minCpuCores;
+        int maxCpuCores = minCpuCores;
 
-        ServiceOfferingVO serviceOfferingVO = serviceOfferingDao.findById(virtualMachineProfile.getId(), virtualMachineProfile.getServiceOfferingId());
-        if (isVmDynamicScalable(serviceOfferingVO, virtualMachineTo, virtualMachine)) {
+        if (isVmDynamicScalable(virtualMachineTo, virtualMachine)) {
+            ServiceOfferingVO serviceOfferingVO = serviceOfferingDao.findById(virtualMachineProfile.getId(), virtualMachineProfile.getServiceOfferingId());
             serviceOfferingDao.loadDetails(serviceOfferingVO);
 
-            maxMemory = getVmMaxMemory(serviceOfferingVO, vmDescription, maxHostMemory);
-            maxCpuCores = getVmMaxCpuCores(serviceOfferingVO, vmDescription, maxHostCpuCore);
+            Long clusterId = hostVo != null ? hostVo.getClusterId() : null;
+            maxMemory = getVmMaxMemory(serviceOfferingVO, vmDescription, maxHostMemory, clusterId);
+            maxCpuCores = getVmMaxCpuCores(serviceOfferingVO, vmDescription, maxHostCpuCores, clusterId);
         }
 
-        virtualMachineTo.setRam(minMemory, maxMemory);
+        virtualMachineTo.setRam(minMemory, maxMemory, requestedMemory);
         virtualMachineTo.setCpus(minCpuCores);
         virtualMachineTo.setVcpuMaxLimit(maxCpuCores);
     }
 
-    protected boolean isVmDynamicScalable(ServiceOfferingVO serviceOfferingVO, VirtualMachineTO virtualMachineTo, VirtualMachine virtualMachine) {
-        return serviceOfferingVO.isDynamic() && virtualMachineTo.isEnableDynamicallyScaleVm() && UserVmManager.EnableDynamicallyScaleVm.valueIn(virtualMachine.getDataCenterId());
+    protected boolean isVmDynamicScalable(VirtualMachineTO virtualMachineTo, VirtualMachine virtualMachine) {
+        return virtualMachineTo.isEnableDynamicallyScaleVm() && UserVmManager.EnableDynamicallyScaleVm.valueIn(virtualMachine.getDataCenterId());
     }
 
     protected Pair<Long, Integer> getHostMaxMemoryAndCpuCores(HostVO host, VirtualMachine virtualMachine, String vmDescription){
@@ -263,53 +282,34 @@ protected Pair<Long, Integer> getHostMaxMemoryAndCpuCores(HostVO host, VirtualMa
         return new Pair<>(maxHostMemory, maxHostCpuCore);
     }
 
-    protected Long getVmMaxMemory(ServiceOfferingVO serviceOfferingVO, String vmDescription, Long maxHostMemory) {
-        String serviceOfferingDescription = serviceOfferingVO.toString();
-
+    protected Long getVmMaxMemory(ServiceOfferingVO serviceOfferingVO, String vmDescription, Long maxHostMemory, Long clusterId) {
         Long maxMemory;
-        Integer customOfferingMaxMemory = NumberUtils.createInteger(serviceOfferingVO.getDetail(ApiConstants.MAX_MEMORY));
-        Integer maxMemoryConfig = ConfigurationManagerImpl.VM_SERVICE_OFFERING_MAX_RAM_SIZE.value();
-        if (customOfferingMaxMemory != null) {
-            logger.debug(String.format("Using 'Custom unconstrained' %s max memory value [%sMb] as %s memory.", serviceOfferingDescription, customOfferingMaxMemory, vmDescription));
-            maxMemory = ByteScaleUtils.mebibytesToBytes(customOfferingMaxMemory);
+        ConfigKey<Integer> maxMemoryConfig = CapacityManager.KvmMemoryDynamicScalingCapacity;
+        Integer maxMemoryConfigValue = maxMemoryConfig.valueIn(clusterId);
+        logger.info("[{}] is a dynamically scalable service offering. Using config [{}] value [{}] in cluster [ID: {}] as max [{}] memory.",
+                serviceOfferingVO.toString(), maxMemoryConfig.key(), maxMemoryConfigValue, clusterId, vmDescription);
+        if (maxMemoryConfigValue > 0) {
+            maxMemory = ByteScaleUtils.mebibytesToBytes(maxMemoryConfigValue);
         } else {
-            String maxMemoryConfigKey = ConfigurationManagerImpl.VM_SERVICE_OFFERING_MAX_RAM_SIZE.key();
-
-            logger.info(String.format("%s is a 'Custom unconstrained' service offering. Using config [%s] value [%s] as max %s memory.",
-                    serviceOfferingDescription, maxMemoryConfigKey, maxMemoryConfig, vmDescription));
-
-            if (maxMemoryConfig > 0) {
-                maxMemory = ByteScaleUtils.mebibytesToBytes(maxMemoryConfig);
-            } else {
-                logger.info(String.format("Config [%s] has value less or equal '0'. Using %s host or last host max memory [%s] as VM max memory in the hypervisor.", maxMemoryConfigKey, vmDescription, maxHostMemory));
-                maxMemory = maxHostMemory;
-            }
+            logger.info("Config [{}] in cluster [ID: {}] has value less or equal '0'. Using [{}] host or last host max memory [{}] as VM max memory in the hypervisor.",
+                    maxMemoryConfig.key(), clusterId, vmDescription, maxHostMemory);
+            maxMemory = maxHostMemory;
         }
         return maxMemory;
     }
 
-    protected Integer getVmMaxCpuCores(ServiceOfferingVO serviceOfferingVO, String vmDescription, Integer maxHostCpuCore) {
-        String serviceOfferingDescription = serviceOfferingVO.toString();
-
+    protected Integer getVmMaxCpuCores(ServiceOfferingVO serviceOfferingVO, String vmDescription, Integer maxHostCpuCores, Long clusterId) {
         Integer maxCpuCores;
-        Integer customOfferingMaxCpuCores = NumberUtils.createInteger(serviceOfferingVO.getDetail(ApiConstants.MAX_CPU_NUMBER));
-        Integer maxCpuCoresConfig = ConfigurationManagerImpl.VM_SERVICE_OFFERING_MAX_CPU_CORES.value();
-
-        if (customOfferingMaxCpuCores != null) {
-            logger.debug(String.format("Using 'Custom unconstrained' %s max cpu cores [%s] as %s cpu cores.", serviceOfferingDescription, customOfferingMaxCpuCores, vmDescription));
-            maxCpuCores = customOfferingMaxCpuCores;
+        ConfigKey<Integer> maxCpuCoresConfig = CapacityManager.KvmCpuDynamicScalingCapacity;
+        Integer maxCpuCoresConfigValue = maxCpuCoresConfig.valueIn(clusterId);
+        logger.info("[{}] is a dynamically scalable service offering. Using config [{}] value [{}] in cluster [ID: {}] as max [{}] CPU cores.",
+                serviceOfferingVO.toString(), maxCpuCoresConfig.key(), maxCpuCoresConfigValue, clusterId, vmDescription);
+        if (maxCpuCoresConfigValue > 0) {
+            maxCpuCores = maxCpuCoresConfigValue;
         } else {
-            String maxCpuCoreConfigKey = ConfigurationManagerImpl.VM_SERVICE_OFFERING_MAX_CPU_CORES.key();
-
-            logger.info(String.format("%s is a 'Custom unconstrained' service offering. Using config [%s] value [%s] as max %s cpu cores.",
-                    serviceOfferingDescription, maxCpuCoreConfigKey, maxCpuCoresConfig, vmDescription));
-
-            if (maxCpuCoresConfig > 0) {
-                maxCpuCores = maxCpuCoresConfig;
-            } else {
-                logger.info(String.format("Config [%s] has value less or equal '0'. Using %s host or last host max cpu cores [%s] as VM cpu cores in the hypervisor.", maxCpuCoreConfigKey, vmDescription, maxHostCpuCore));
-                maxCpuCores = maxHostCpuCore;
-            }
+            logger.info("Config [{}] in cluster [ID: {}] has value less or equal '0'. Using [{}] host or last host max CPU cores [{}] as VM CPU cores in the hypervisor.",
+                    maxCpuCoresConfig.key(), clusterId, vmDescription, maxHostCpuCores);
+            maxCpuCores = maxHostCpuCores;
         }
         return maxCpuCores;
     }
diff --git a/server/src/main/java/com/cloud/vm/UserVmManager.java b/server/src/main/java/com/cloud/vm/UserVmManager.java
index 38cb6d2db46b..300803bfa986 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManager.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManager.java
@@ -111,6 +111,10 @@ public interface UserVmManager extends UserVmService {
     ConfigKey<Boolean> AllowDifferentHostTagsOfferingsForVmScale = new ConfigKey<>("Advanced", Boolean.class, "allow.different.host.tags.offerings.for.vm.scale", "false",
             "Enables/Disable allowing to change a VM offering to offerings with different host tags", true);
 
+    ConfigKey<Boolean> AutoMigrateVmOnLiveScaleInsufficientCapacity = new ConfigKey<>("Advanced", Boolean.class, "auto.migrate.vm.on.live.scale.insufficient.capacity",
+            "true", "Defines whether a VM should be automatically migrated to a suitable host when the current host " +
+                    "lacks sufficient compute capacity to live scale the instance. Defaults to true.", true, ConfigKey.Scope.Cluster);
+
     static final int MAX_USER_DATA_LENGTH_BYTES = 2048;
 
     public  static  final String CKS_NODE = "cksnode";
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index 60482c431ebb..0a2f3b902e5e 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -2116,25 +2116,26 @@ private boolean upgradeRunningVirtualMachine(Long vmId, Long newServiceOfferingI
         int newCpu = newServiceOffering.getCpu();
         int newMemory = newServiceOffering.getRamSize();
         int newSpeed = newServiceOffering.getSpeed();
+        boolean cpuCapEnabledForTheNewOffering = newServiceOffering.getLimitCpuUse();
         int currentCpu = currentServiceOffering.getCpu();
         int currentMemory = currentServiceOffering.getRamSize();
         int currentSpeed = currentServiceOffering.getSpeed();
+        boolean cpuCapEnabledForTheCurrentOffering = currentServiceOffering.getLimitCpuUse();
         int memoryDiff = newMemory - currentMemory;
         int cpuDiff = newCpu * newSpeed - currentCpu * currentSpeed;
 
-        // Don't allow to scale when (Any of the new values less than current values) OR (All current and new values are same)
-        if ((newSpeed < currentSpeed || newMemory < currentMemory || newCpu < currentCpu) || (newSpeed == currentSpeed && newMemory == currentMemory && newCpu == currentCpu)) {
-            String message = String.format("While the VM is running, only scalling up it is supported. New service offering {\"memory\": %s, \"speed\": %s, \"cpu\": %s} should"
-              + " have at least one value (ram, speed or cpu) greater than the current values {\"memory\": %s, \"speed\": %s, \"cpu\": %s}.", newMemory, newSpeed, newCpu,
-              currentMemory, currentSpeed, currentCpu);
-
-            throw new InvalidParameterValueException(message);
+        boolean scalingDown = newSpeed < currentSpeed || newMemory < currentMemory || newCpu < currentCpu;
+        if (scalingDown) {
+            throw new InvalidParameterValueException(String.format("Scaling down is not supported while the VM is running. The new service offering attributes " +
+                    "{\"memory\": %s, \"CPU speed\": %s, \"vCPUs\": %s} must not be lower than the current values {\"memory\": %s, \"CPU speed\": %s, \"vCPUs\": %s}.",
+                    newMemory, newSpeed, newCpu, currentMemory, currentSpeed, currentCpu));
         }
 
-        if (vmHypervisorType.equals(HypervisorType.KVM) && !currentServiceOffering.isDynamic()) {
-            String message = String.format("Unable to live scale VM on KVM when current service offering is a \"Fixed Offering\". KVM needs the tag \"maxMemory\" to live scale and it is only configured when VM is deployed with a custom service offering and \"Dynamic Scalable\" is enabled.");
-            logger.info(message);
-            throw new InvalidParameterValueException(message);
+        boolean sameAmountOfResourcesAsThePreviousOffering = newSpeed == currentSpeed && newMemory == currentMemory && newCpu == currentCpu;
+        boolean cpuCapChange = cpuCapEnabledForTheCurrentOffering != cpuCapEnabledForTheNewOffering;
+        if (sameAmountOfResourcesAsThePreviousOffering && (vmHypervisorType != HypervisorType.KVM || !cpuCapChange)) {
+            throw new InvalidParameterValueException("While the VM is running, scaling to a service offering with the same attributes (memory, CPU speed and vCPUs) " +
+                    "is only allowed when the CPU cap is changed.");
         }
 
         serviceOfferingDao.loadDetails(currentServiceOffering);
@@ -2200,8 +2201,19 @@ private boolean upgradeRunningVirtualMachine(Long vmId, Long newServiceOfferingI
                         excludes.addHost(vmInstance.getHostId());
                     }
 
+                    boolean autoMigrateVmToASuitableHost = AutoMigrateVmOnLiveScaleInsufficientCapacity.valueIn(host.getClusterId());
+                    if (!existingHostHasCapacity && !autoMigrateVmToASuitableHost) {
+                        logger.error("Unable to scale the VM [{}] because the host [{}] in which it is currently allocated does not " +
+                                "have enough compute capacity to scale the instance and the VM should not be automatically migrated to another host " +
+                                "([{}] setting is [false]).", vmInstance.getInstanceName(), host.getName(), AutoMigrateVmOnLiveScaleInsufficientCapacity.key());
+                        return false;
+                    }
+
                     // #2 migrate the vm if host doesn't have capacity or is in avoid set
                     if (!existingHostHasCapacity) {
+                        logger.info("Host [{}] does not have enough compute capacity to scale the instance [{}]. Since the [{}] setting is " +
+                                        "[true], the VM will be migrated to a suitable host and, if succeeded, the VM will be live scaled to the requested " +
+                                        "compute offering.", host.getName(), vmInstance.getInstanceName(), AutoMigrateVmOnLiveScaleInsufficientCapacity.key());
                         _itMgr.findHostAndMigrate(vmInstance.getUuid(), newServiceOfferingId, customParameters, excludes);
                     }
 
@@ -9458,7 +9470,7 @@ public ConfigKey<?>[] getConfigKeys() {
                 VmIpFetchThreadPoolMax, VmIpFetchTaskWorkers, AllowDeployVmIfGivenHostFails, EnableAdditionalVmConfig, DisplayVMOVFProperties,
                 KvmAdditionalConfigAllowList, XenServerAdditionalConfigAllowList, VmwareAdditionalConfigAllowList, DestroyRootVolumeOnVmDestruction,
                 EnforceStrictResourceLimitHostTagCheck, StrictHostTags, AllowUserForceStopVm, VmDistinctHostNameScope,
-                VmwareAdditionalDetailsFromOvaEnabled, VmwareAllowedAdditionalDetailsFromOva, AllowDifferentHostTagsOfferingsForVmScale};
+                VmwareAdditionalDetailsFromOvaEnabled, VmwareAllowedAdditionalDetailsFromOva, AllowDifferentHostTagsOfferingsForVmScale, AutoMigrateVmOnLiveScaleInsufficientCapacity};
     }
 
     @Override
diff --git a/server/src/test/java/com/cloud/hypervisor/KVMGuruTest.java b/server/src/test/java/com/cloud/hypervisor/KVMGuruTest.java
index d94f9db0c99c..e5239a651230 100644
--- a/server/src/test/java/com/cloud/hypervisor/KVMGuruTest.java
+++ b/server/src/test/java/com/cloud/hypervisor/KVMGuruTest.java
@@ -53,6 +53,10 @@
 import com.cloud.utils.Pair;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachineProfile;
+import org.apache.cloudstack.framework.config.impl.ConfigDepotImpl;
+
+import java.math.BigDecimal;
+import java.math.RoundingMode;
 
 @RunWith(MockitoJUnitRunner.class)
 public class KVMGuruTest {
@@ -186,79 +190,45 @@ public void testSetVmQuotaPercentageOverProvision() {
     }
 
     @Test
-    public void validateGetVmMaxMemoryReturnCustomOfferingMaxMemory(){
-        int maxCustomOfferingMemory = 64;
-        Mockito.when(serviceOfferingVoMock.getDetail(ApiConstants.MAX_MEMORY)).thenReturn(String.valueOf(maxCustomOfferingMemory));
-
-        long result = guru.getVmMaxMemory(serviceOfferingVoMock, "Vm description", 1l);
-
-        Assert.assertEquals(ByteScaleUtils.mebibytesToBytes(maxCustomOfferingMemory), result);
-    }
-
-    @Test
-    public void validateGetVmMaxMemoryReturnVmServiceOfferingMaxRAMSize(){
-        int maxMemoryConfig = 64;
-        Mockito.when(serviceOfferingVoMock.getDetail(ApiConstants.MAX_MEMORY)).thenReturn(null);
+    public void getVmMaxMemoryTestConsiderKvmMemoryDynamicScalingCapacitySettingWhenItIsGreaterThanZero() {
+        int maxMemoryConfigValue = 64;
 
-        ConfigKey<Integer> vmServiceOfferingMaxRAMSize = Mockito.mock(ConfigKey.class);
-        ConfigurationManagerImpl.VM_SERVICE_OFFERING_MAX_RAM_SIZE = vmServiceOfferingMaxRAMSize;
+        ConfigDepotImpl configDepotMock = Mockito.mock(ConfigDepotImpl.class);
+        ConfigKey.init(configDepotMock);
+        Mockito.when(configDepotMock.getConfigStringValue(Mockito.any(), Mockito.any(), Mockito.any()))
+                .thenReturn(String.valueOf(maxMemoryConfigValue));
 
-        Mockito.when(vmServiceOfferingMaxRAMSize.value()).thenReturn(maxMemoryConfig);
-        long result = guru.getVmMaxMemory(serviceOfferingVoMock, "Vm description", 1l);
-
-        Assert.assertEquals(ByteScaleUtils.mebibytesToBytes(maxMemoryConfig), result);
+        long result = guru.getVmMaxMemory(serviceOfferingVoMock, "Vm description", 1L, 1L);
+        ConfigKey.init(null);
+        Assert.assertEquals(ByteScaleUtils.mebibytesToBytes(maxMemoryConfigValue), result);
     }
 
     @Test
-    public void validateGetVmMaxMemoryReturnMaxHostMemory(){
+    public void getVmMaxMemoryTestConsiderHostMaxMemoryWhenKvmMemoryDynamicScalingCapacitySettingIsEqualToZero() {
         long maxHostMemory = ByteScaleUtils.mebibytesToBytes(2000);
-        Mockito.when(serviceOfferingVoMock.getDetail(ApiConstants.MAX_MEMORY)).thenReturn(null);
-
-        ConfigKey<Integer> vmServiceOfferingMaxRAMSize = Mockito.mock(ConfigKey.class);
-        ConfigurationManagerImpl.VM_SERVICE_OFFERING_MAX_RAM_SIZE = vmServiceOfferingMaxRAMSize;
-
-        Mockito.when(vmServiceOfferingMaxRAMSize.value()).thenReturn(0);
-
-        long result = guru.getVmMaxMemory(serviceOfferingVoMock, "Vm description", maxHostMemory);
+        long result = guru.getVmMaxMemory(serviceOfferingVoMock, "Vm description", maxHostMemory, 1L);
 
         Assert.assertEquals(maxHostMemory, result);
     }
 
     @Test
-    public void validateGetVmMaxCpuCoresReturnCustomOfferingMaxCpuCores(){
-        int maxCustomOfferingCpuCores = 16;
-        Mockito.when(serviceOfferingVoMock.getDetail(ApiConstants.MAX_CPU_NUMBER)).thenReturn(String.valueOf(maxCustomOfferingCpuCores));
-
-        long result = guru.getVmMaxCpuCores(serviceOfferingVoMock, "Vm description", 1);
-
-        Assert.assertEquals(maxCustomOfferingCpuCores, result);
-    }
-
-    @Test
-    public void validateGetVmMaxCpuCoresVmServiceOfferingMaxCPUCores(){
+    public void getVmMaxCpuCoresTestConsiderKvmCpuDynamicScalingCapacitySettingWhenItIsGreaterThanZero() {
         int maxCpuCoresConfig = 16;
-        Mockito.when(serviceOfferingVoMock.getDetail(ApiConstants.MAX_CPU_NUMBER)).thenReturn(null);
+        ConfigDepotImpl configDepotMock = Mockito.mock(ConfigDepotImpl.class);
+        ConfigKey.init(configDepotMock);
+        Mockito.when(configDepotMock.getConfigStringValue(Mockito.any(), Mockito.any(), Mockito.any()))
+                .thenReturn(String.valueOf(maxCpuCoresConfig));
 
-        ConfigKey<Integer> vmServiceOfferingMaxCPUCores = Mockito.mock(ConfigKey.class);
-        ConfigurationManagerImpl.VM_SERVICE_OFFERING_MAX_CPU_CORES = vmServiceOfferingMaxCPUCores;
-
-        Mockito.when(vmServiceOfferingMaxCPUCores.value()).thenReturn(maxCpuCoresConfig);
-        long result = guru.getVmMaxCpuCores(serviceOfferingVoMock, "Vm description", 1);
+        long result = guru.getVmMaxCpuCores(serviceOfferingVoMock, "Vm description", 1, 1L);
+        ConfigKey.init(null);
 
         Assert.assertEquals(maxCpuCoresConfig, result);
     }
 
     @Test
-    public void validateGetVmMaxCpuCoresReturnMaxHostMemory(){
+    public void getVmMaxCpuCoresTestConsiderHostMaxCpuWhenKvmCpuDynamicScalingCapacitySettingIsEqualToZero() {
         int maxHostCpuCores = 64;
-        Mockito.when(serviceOfferingVoMock.getDetail(ApiConstants.MAX_CPU_NUMBER)).thenReturn(null);
-
-        ConfigKey<Integer> vmServiceOfferingMaxCPUCores = Mockito.mock(ConfigKey.class);
-        ConfigurationManagerImpl.VM_SERVICE_OFFERING_MAX_CPU_CORES = vmServiceOfferingMaxCPUCores;
-
-        Mockito.when(vmServiceOfferingMaxCPUCores.value()).thenReturn(0);
-
-        long result = guru.getVmMaxCpuCores(serviceOfferingVoMock, "Vm description", maxHostCpuCores);
+        long result = guru.getVmMaxCpuCores(serviceOfferingVoMock, "Vm description", maxHostCpuCores, 1L);
 
         Assert.assertEquals(maxHostCpuCores, result);
     }
@@ -321,39 +291,36 @@ public void validateConfigureVmMemoryAndCpuCoresServiceOfferingIsDynamicAndVmIsD
         guru.serviceOfferingDao = serviceOfferingDaoMock;
 
         Mockito.doReturn(serviceOfferingVoMock).when(serviceOfferingDaoMock).findById(Mockito.anyLong(), Mockito.anyLong());
-        Mockito.doReturn(true).when(guru).isVmDynamicScalable(Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.doReturn(true).when(guru).isVmDynamicScalable(Mockito.any(), Mockito.any());
 
         guru.configureVmMemoryAndCpuCores(vmTO, host, virtualMachineMock, vmProfile);
 
-        Mockito.verify(guru).getVmMaxMemory(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyLong());
-        Mockito.verify(guru).getVmMaxCpuCores(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyInt());
+        Mockito.verify(guru).getVmMaxMemory(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.verify(guru).getVmMaxCpuCores(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyInt(), Mockito.anyLong());
     }
 
     @Test
     public void validateConfigureVmMemoryAndCpuCoresServiceOfferingIsNotDynamicAndVmIsDynamicDoNotCallGetMethods(){
         guru.serviceOfferingDao = serviceOfferingDaoMock;
 
-        Mockito.doReturn(serviceOfferingVoMock).when(serviceOfferingDaoMock).findById(Mockito.anyLong(), Mockito.anyLong());
-        Mockito.doReturn(false).when(guru).isVmDynamicScalable(Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.doReturn(false).when(guru).isVmDynamicScalable(Mockito.any(), Mockito.any());
 
         guru.configureVmMemoryAndCpuCores(vmTO, host, virtualMachineMock, vmProfile);
 
-        Mockito.verify(guru, Mockito.never()).getVmMaxMemory(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyLong());
-        Mockito.verify(guru, Mockito.never()).getVmMaxCpuCores(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyInt());
+        Mockito.verify(guru, Mockito.never()).getVmMaxMemory(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.verify(guru, Mockito.never()).getVmMaxCpuCores(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyInt(), Mockito.anyLong());
     }
 
     @Test
     public void validateConfigureVmMemoryAndCpuCoresServiceOfferingIsDynamicAndVmIsNotDynamicDoNotCallGetMethods(){
         guru.serviceOfferingDao = serviceOfferingDaoMock;
 
-        Mockito.doReturn(serviceOfferingVoMock).when(serviceOfferingDaoMock).findById(Mockito.anyLong(), Mockito.anyLong());
-        Mockito.doReturn(true).when(serviceOfferingVoMock).isDynamic();
         Mockito.doReturn(false).when(vmTO).isEnableDynamicallyScaleVm();
 
         guru.configureVmMemoryAndCpuCores(vmTO, host, virtualMachineMock, vmProfile);
 
-        Mockito.verify(guru, Mockito.never()).getVmMaxMemory(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyLong());
-        Mockito.verify(guru, Mockito.never()).getVmMaxCpuCores(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyInt());
+        Mockito.verify(guru, Mockito.never()).getVmMaxMemory(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyLong(), Mockito.anyLong());
+        Mockito.verify(guru, Mockito.never()).getVmMaxCpuCores(Mockito.any(ServiceOfferingVO.class), Mockito.anyString(), Mockito.anyInt(), Mockito.anyLong());
     }
 
     @Test
@@ -506,4 +473,30 @@ public void testGetNullWhenVMThereIsNoInformationOfUsedHosts() {
 
         Assert.assertNull(clusterId);
     }
+
+    @Test
+    public void getCpuQuotaPercentageTestAssertQuotaEqualsVmSpeedDividedByHostSpeed() {
+        double hostSpeed = 3000;
+        double vmSpeed = 500;
+        double expectedQuota = new BigDecimal(vmSpeed / hostSpeed).setScale(2, RoundingMode.HALF_DOWN).doubleValue();
+        double actualQuota = guru.getCpuQuotaPercentage(vmSpeed, hostSpeed);
+        Assert.assertEquals(expectedQuota, actualQuota, 0.0001);
+    }
+
+    @Test
+    public void getCpuQuotaPercentageTestAssertQuotaEqualsOneWhenVmSpeedIsGreaterThanHostSpeed() {
+        double hostSpeed = 3000;
+        double vmSpeed = 6000;
+        double expectedQuota = 1;
+        double actualQuota = guru.getCpuQuotaPercentage(vmSpeed, hostSpeed);
+        Assert.assertEquals(expectedQuota, actualQuota, 0.0001);
+    }
+
+    @Test
+    public void getCpuQuotaPercentageTestReturnNullWhenANumberFormatExceptionIsThrown() {
+        double hostSpeed = 0;
+        double vmSpeed = 6000;
+        Double actualQuota = guru.getCpuQuotaPercentage(vmSpeed, hostSpeed);
+        Assert.assertNull(actualQuota);
+    }
 }
diff --git a/test/integration/component/test_escalations_instances.py b/test/integration/component/test_escalations_instances.py
index 89c4f4ce2a6c..4aea35850d07 100644
--- a/test/integration/component/test_escalations_instances.py
+++ b/test/integration/component/test_escalations_instances.py
@@ -3341,9 +3341,6 @@ def test_17_running_vm_scaleup(self):
                deployed in step1
         Step6: Verifying that VM's service offerings is changed
         """
-        if self.hypervisor.lower() == 'kvm':
-            self.skipTest(
-                "ScaleVM is not supported on KVM. Hence, skipping the test")
         # Checking if Dynamic scaling of VM is supported or not
         list_config = Configurations.list(
             self.apiClient,
diff --git a/test/integration/component/test_escalations_ipaddresses.py b/test/integration/component/test_escalations_ipaddresses.py
index b91b67c16c3d..d9d760c49017 100644
--- a/test/integration/component/test_escalations_ipaddresses.py
+++ b/test/integration/component/test_escalations_ipaddresses.py
@@ -3455,8 +3455,7 @@ def test_17_create_update_autoscalepolicy(self):
         Step18: Verifying Autoscale policy is updated with condition2
         """
         if self.hypervisor.lower() == 'kvm':
-            self.skipTest(
-                "ScaleVM is not supported on KVM. Hence, skipping the test")
+            self.skipTest("Test not supported on KVM. Skipping it")
 
         list_physical_networks = PhysicalNetwork.list(
             self.apiClient,
@@ -3734,8 +3733,7 @@ def test_18_create_update_autoscaleprofiles(self):
         Step16: Verifying that Autoscale VM is updated
         """
         if self.hypervisor.lower() == 'kvm':
-            self.skipTest(
-                "ScaleVM is not supported on KVM. Hence, skipping the test")
+            self.skipTest("Test not supported on KVM. Skipping it")
 
         list_physical_networks = PhysicalNetwork.list(
             self.apiClient,
@@ -4061,8 +4059,7 @@ def test_19_create_update_autoscalevmgroup(self):
         Step14: Enabling Autoscale VM group and verifying it was enabled
         """
         if self.hypervisor.lower() == 'kvm':
-            self.skipTest(
-                "ScaleVM is not supported on KVM. Hence, skipping the test")
+            self.skipTest("Test not supported on KVM. Skipping it.")
 
         list_physical_networks = PhysicalNetwork.list(
             self.apiClient,
diff --git a/ui/public/locales/el_GR.json b/ui/public/locales/el_GR.json
index bb90661d9d37..566e182b8fad 100644
--- a/ui/public/locales/el_GR.json
+++ b/ui/public/locales/el_GR.json
@@ -2270,8 +2270,6 @@
 "message.error.enable.saml": "Δεν είναι δυνατή η εύρεση των id χρηστών για την ενεργοποίηση του Saml σύνδεση μιας φοράς, παρακαλούμε να το ενεργοποιήσετε με μη αυτόματο τρόπο.",
 "message.error.end.date.and.time": "Παρακαλώ, εισάγετε την τελική ημερομηνία και ώρα!",
 "message.error.endip": "Πληκτρολογήστε End IP",
-"message.error.fixed.offering.kvm": "Δεν είναι δυνατό να κλιμωκαθούν οι εικονές μηχανές που χρησιμοποιούν τον επόπτη KVM με ένα σταθερό υπολογισμό προσφοράς υπηρεσίας.",
-"message.error.fixed.offering.kvm": "Δεν είναι εφικτή η κλιμάκωση προς τα πάνω της εικονικής μηχανής ενώ ανήκει σε μία σταθερή προσφορά νέφους.",
 "message.error.gateway": "Πληκτρολογήστε Πύλη",
 "message.error.host.name": "Πληκτρολογήστε το όνομα του κεντρικού υπολογιστή",
 "message.error.host.password": "Πληκτρολογήστε τον κωδικό πρόσβασης κεντρικού υπολογιστή",
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 1187b3e62b40..83422cd4101c 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -3599,7 +3599,6 @@
 "message.error.zone.name": "Please enter Zone name.",
 "message.error.zone.type": "Please select Zone type.",
 "message.error.linstor.resourcegroup": "Please enter the Linstor Resource-Group.",
-"message.error.fixed.offering.kvm": "It's not possible to scale up Instances that utilize KVM hypervisor with a fixed compute offering.",
 "message.error.create.webhook.local.account": "Account must be provided for creating a Webhook with Local scope.",
 "message.error.create.webhook.name": "Name must be provided for creating a Webhook.",
 "message.error.create.webhook.payloadurl": "Payload URL must be provided for creating a Webhook.",
diff --git a/ui/public/locales/ja_JP.json b/ui/public/locales/ja_JP.json
index 850264fb3411..b7f32d7a2e12 100644
--- a/ui/public/locales/ja_JP.json
+++ b/ui/public/locales/ja_JP.json
@@ -2932,7 +2932,6 @@
   "message.error.domain": "ドメインを入力し、ROOTドメインは空のままにします",
   "message.error.enable.saml": "SAML SSOを有効にするユーザーIDが見つかりません。手動で有効にしてください。",
   "message.error.endip": "終了IPを入力してください",
-  "message.error.fixed.offering.kvm": "固定コンピューティングオファリングでKVMハイパーバイザーを利用するVMをスケールアップすることはできません。",
   "message.error.gateway": "ゲートウェイに入ってください",
   "message.error.host.name": "ホスト名を入力してください",
   "message.error.host.password": "ホストパスワードを入力してください",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index 4b446eccff32..dee353ec5895 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -3229,7 +3229,6 @@
 "message.error.zone.name": "Por favor, insira o nome da zona",
 "message.error.zone.type": "Por favor, selecione o tipo de zona",
 "message.error.linstor.resourcegroup": "Por favor, insira o Linstor Resource-Group",
-"message.error.fixed.offering.kvm": "N\u00e3o \u00e9 poss\u00edvel escalar VMs que utilizam o virtualizador KVM com uma oferta de computa\u00e7\u00e3o fixa.",
 "message.fail.to.delete": "Falha ao deletar.",
 "message.failed.to.add": "Falha ao adicionar",
 "message.failed.to.assign.vms": "Falha ao atribuir VMs",
diff --git a/ui/public/locales/te.json b/ui/public/locales/te.json
index ed72626e0a67..f3b4c70ca2ed 100644
--- a/ui/public/locales/te.json
+++ b/ui/public/locales/te.json
@@ -3169,7 +3169,6 @@
   "message.error.zone.name": "దయచేసి జోన్ పేరును నమోదు చేయండి.",
   "message.error.zone.type": "దయచేసి జోన్ రకాన్ని ఎంచుకోండి.",
   "message.error.linstor.resourcegroup": "దయచేసి Linstor Resource-Groupని నమోదు చేయండి.",
-  "message.error.fixed.offering.kvm": "ఫిక్స్‌డ్ కంప్యూట్ ఆఫర్‌తో KVM హైపర్‌వైజర్‌ను ఉపయోగించుకునే సందర్భాలను స్కేల్ చేయడం సాధ్యం కాదు.",
   "message.error.create.webhook.local.account": "స్థానిక స్కోప్‌తో వెబ్‌హుక్‌ని సృష్టించడానికి తప్పనిసరిగా ఖాతా అందించబడాలి.",
   "message.error.create.webhook.name": "వెబ్‌హుక్‌ని సృష్టించడానికి తప్పనిసరిగా పేరు అందించాలి.",
   "message.error.create.webhook.payloadurl": "Webhookని సృష్టించడానికి పేలోడ్ URL తప్పనిసరిగా అందించబడాలి.",
diff --git a/ui/public/locales/zh_CN.json b/ui/public/locales/zh_CN.json
index 4b68a2ef6d77..9536bab7ee43 100644
--- a/ui/public/locales/zh_CN.json
+++ b/ui/public/locales/zh_CN.json
@@ -3462,7 +3462,6 @@
   "message.error.zone.name": "\u8BF7\u8F93\u5165\u533A\u57DF\u540D\u79F0",
   "message.error.zone.type": "\u8BF7\u9009\u62E9\u533A\u57DF\u7C7B\u578B",
   "message.error.linstor.resourcegroup": "\u8BF7\u8F93\u5165 Linstor \u8D44\u6E90\u7EC4",
-  "message.error.fixed.offering.kvm": "\u4E0D\u53EF\u80FD\u901A\u8FC7\u56FA\u5B9A\u7684\u8BA1\u7B97\u65B9\u6848\u6765\u6269\u5C55KVM\u865A\u62DF\u673A\u3002",
   "message.fail.to.delete": "\u5220\u9664\u5931\u8D25\u3002",
   "message.failed.to.add": "\u6DFB\u52A0\u5931\u8D25",
   "message.failed.to.assign.vms": "\u672A\u80FD\u5206\u914D\u865A\u62DF\u673A",
diff --git a/ui/src/views/compute/ScaleVM.vue b/ui/src/views/compute/ScaleVM.vue
index ce8dca5b43a6..b810e1327c6b 100644
--- a/ui/src/views/compute/ScaleVM.vue
+++ b/ui/src/views/compute/ScaleVM.vue
@@ -23,10 +23,6 @@
       <loading-outlined style="color: #1890ff;" />
     </div>
 
-    <a-alert v-if="fixedOfferingKvm" type="error" show-icon>
-      <template #message><span style="margin-bottom: 5px" v-html="$t('message.error.fixed.offering.kvm')" /></template>
-    </a-alert>
-
     <compute-offering-selection
       :compute-items="offerings"
       :loading="loading"
@@ -42,9 +38,11 @@
       :memory-input-decorator="memoryKey"
       :computeOfferingId="selectedOffering.id"
       :isConstrained="'serviceofferingdetails' in selectedOffering"
+      :initialCpuValue="getInitialCpuValue()"
       :minCpu="getMinCpu()"
       :maxCpu="'serviceofferingdetails' in selectedOffering ? selectedOffering.serviceofferingdetails.maxcpunumber*1 : Number.MAX_SAFE_INTEGER"
       :cpuSpeed="getCPUSpeed()"
+      :initialMemoryValue="getInitialMemoryValue()"
       :minMemory="getMinMemory()"
       :maxMemory="'serviceofferingdetails' in selectedOffering ? selectedOffering.serviceofferingdetails.maxmemory*1 : Number.MAX_SAFE_INTEGER"
       :isCustomized="selectedOffering.iscustomized"
@@ -151,32 +149,31 @@ export default {
           return
         }
         this.offerings = response.listserviceofferingsresponse.serviceoffering || []
-        if (this.resource.state === 'Running' && this.resource.hypervisor === 'KVM') {
-          this.offerings = this.offerings.filter(offering => offering.id === this.resource.serviceofferingid)
-          this.currentOffer = this.offerings[0]
-          if (this.currentOffer === undefined) {
-            this.fixedOfferingKvm = true
-          }
-        }
-        this.offerings.map(i => { this.offeringsMap[i.id] = i })
+        this.offerings.forEach(offering => { this.offeringsMap[offering.id] = offering })
       }).finally(() => {
         this.loading = false
       })
     },
     getMinCpu () {
-      // We can only scale up while a VM is running
-      if (this.resource.state === 'Running') {
-        return this.resource.cpunumber
-      }
       return this.selectedOffering?.serviceofferingdetails?.mincpunumber * 1 || 1
     },
-    getMinMemory () {
-      // We can only scale up while a VM is running
-      if (this.resource.state === 'Running') {
-        return this.resource.memory
+    getInitialCpuValue () {
+      const offeringMinCpu = this.getMinCpu()
+      if (this.resource.cpunumber < offeringMinCpu) {
+        return offeringMinCpu
       }
+      return this.resource.cpunumber
+    },
+    getMinMemory () {
       return this.selectedOffering?.serviceofferingdetails?.minmemory * 1 || 32
     },
+    getInitialMemoryValue () {
+      const offeringMinMemory = this.getMinMemory()
+      if (this.resource.memory < offeringMinMemory) {
+        return offeringMinMemory
+      }
+      return this.resource.memory
+    },
     getCPUSpeed () {
       // We can only scale up while a VM is running
       if (this.resource.state === 'Running') {
diff --git a/ui/src/views/compute/wizard/ComputeSelection.vue b/ui/src/views/compute/wizard/ComputeSelection.vue
index 563e17984e35..9cf36153f5cd 100644
--- a/ui/src/views/compute/wizard/ComputeSelection.vue
+++ b/ui/src/views/compute/wizard/ComputeSelection.vue
@@ -111,6 +111,10 @@ export default {
       type: Number,
       default: 0
     },
+    initialCpuValue: {
+      type: Number,
+      default: 0
+    },
     minCpu: {
       type: Number,
       default: 0
@@ -119,6 +123,10 @@ export default {
       type: Number,
       default: 2
     },
+    initialMemoryValue: {
+      type: Number,
+      default: 0
+    },
     minMemory: {
       type: Number,
       default: 0
@@ -200,8 +208,8 @@ export default {
   },
   methods: {
     fillValue () {
-      this.cpuNumberInputValue = this.minCpu
-      this.memoryInputValue = this.minMemory
+      this.cpuNumberInputValue = this.initialCpuValue > 0 ? this.initialCpuValue : this.minCpu
+      this.memoryInputValue = this.initialMemoryValue > 0 ? this.initialMemoryValue : this.minMemory
       this.cpuSpeedInputValue = this.cpuSpeed
 
       if (!this.preFillContent) {

From a0aafe2fa73132f08d7ae67b302d2e1fa6d02068 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Fri, 22 May 2026 19:37:44 +0530
Subject: [PATCH 46/64] Update bouncy castle (#12794)

Co-authored-by: Harikrishna Patnala <harikrishna.patnala@gmail.com>
---
 client/pom.xml                                | 18 ++++-----
 .../integrations/kubernetes-service/pom.xml   | 10 -----
 plugins/pom.xml                               |  4 +-
 plugins/storage/object/minio/pom.xml          | 16 +++++++-
 plugins/storage/object/simulator/pom.xml      |  4 +-
 plugins/user-authenticators/ldap/pom.xml      | 40 +++++++++++++++++++
 pom.xml                                       | 21 ++++++++--
 services/console-proxy/rdpconsole/pom.xml     |  4 +-
 utils/pom.xml                                 |  6 +--
 9 files changed, 89 insertions(+), 34 deletions(-)

diff --git a/client/pom.xml b/client/pom.xml
index 55123de0f98e..ba16cc5d34a2 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -716,17 +716,17 @@
                     </dependency>
                     <dependency>
                         <groupId>org.bouncycastle</groupId>
-                        <artifactId>bcprov-jdk15on</artifactId>
+                        <artifactId>bcprov-jdk18on</artifactId>
                         <version>${cs.bcprov.version}</version>
                     </dependency>
                     <dependency>
                         <groupId>org.bouncycastle</groupId>
-                        <artifactId>bcpkix-jdk15on</artifactId>
+                        <artifactId>bcpkix-jdk18on</artifactId>
                         <version>${cs.bcprov.version}</version>
                     </dependency>
                     <dependency>
                         <groupId>org.bouncycastle</groupId>
-                        <artifactId>bctls-jdk15on</artifactId>
+                        <artifactId>bctls-jdk18on</artifactId>
                         <version>${cs.bcprov.version}</version>
                     </dependency>
                 </dependencies>
@@ -906,13 +906,13 @@
                                 </artifactItem>
                                 <artifactItem>
                                     <groupId>org.bouncycastle</groupId>
-                                    <artifactId>bcprov-jdk15on</artifactId>
+                                    <artifactId>bcprov-jdk18on</artifactId>
                                     <overWrite>false</overWrite>
                                     <outputDirectory>${project.build.directory}/lib</outputDirectory>
                                 </artifactItem>
                                 <artifactItem>
                                     <groupId>org.bouncycastle</groupId>
-                                    <artifactId>bcpkix-jdk15on</artifactId>
+                                    <artifactId>bcpkix-jdk18on</artifactId>
                                     <overWrite>false</overWrite>
                                     <outputDirectory>${project.build.directory}/lib</outputDirectory>
 			        </artifactItem>
@@ -936,7 +936,7 @@
                                 </artifactItem>
                                 <artifactItem>
                                     <groupId>org.bouncycastle</groupId>
-                                    <artifactId>bctls-jdk15on</artifactId>
+                                    <artifactId>bctls-jdk18on</artifactId>
                                     <overWrite>false</overWrite>
                                     <outputDirectory>${project.build.directory}/lib</outputDirectory>
                                 </artifactItem>
@@ -971,9 +971,9 @@
                                     <exclude>org.apache.tomcat.embed:tomcat-embed-core</exclude>
                                     <exclude>org.apache.geronimo.specs:geronimo-servlet_3.0_spec</exclude>
                                     <exclude>org.apache.geronimo.specs:geronimo-javamail_1.4_spec</exclude>
-                                    <exclude>org.bouncycastle:bcprov-jdk15on</exclude>
-                                    <exclude>org.bouncycastle:bcpkix-jdk15on</exclude>
-                                    <exclude>org.bouncycastle:bctls-jdk15on</exclude>
+                                    <exclude>org.bouncycastle:bcprov-jdk18on</exclude>
+                                    <exclude>org.bouncycastle:bcpkix-jdk18on</exclude>
+                                    <exclude>org.bouncycastle:bctls-jdk18on</exclude>
                                     <exclude>com.mysql:mysql-connector-j</exclude>
                                     <exclude>org.apache.cloudstack:cloud-plugin-storage-volume-storpool</exclude>
                                     <exclude>org.apache.cloudstack:cloud-plugin-storage-volume-linstor</exclude>
diff --git a/plugins/integrations/kubernetes-service/pom.xml b/plugins/integrations/kubernetes-service/pom.xml
index 6b5cec95aab9..f638dbde7f3b 100644
--- a/plugins/integrations/kubernetes-service/pom.xml
+++ b/plugins/integrations/kubernetes-service/pom.xml
@@ -124,16 +124,6 @@
             <version>${cs.hamcrest.version}</version>
             <scope>test</scope>
         </dependency>
-        <dependency>
-            <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk15on</artifactId>
-            <version>${cs.bcprov.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>org.bouncycastle</groupId>
-            <artifactId>bctls-jdk15on</artifactId>
-            <version>${cs.bcprov.version}</version>
-        </dependency>
         <dependency>
             <groupId>joda-time</groupId>
             <artifactId>joda-time</artifactId>
diff --git a/plugins/pom.xml b/plugins/pom.xml
index 3262404032fa..44220481a6fe 100755
--- a/plugins/pom.xml
+++ b/plugins/pom.xml
@@ -202,13 +202,13 @@
         <dependency>
             <groupId>io.minio</groupId>
             <artifactId>minio</artifactId>
-            <version>8.5.2</version>
+            <version>${cs.minio.version}</version>
             <scope>compile</scope>
         </dependency>
         <dependency>
             <groupId>io.minio</groupId>
             <artifactId>minio-admin</artifactId>
-            <version>8.5.2</version>
+            <version>${cs.minio.version}</version>
             <scope>compile</scope>
         </dependency>
         <dependency>
diff --git a/plugins/storage/object/minio/pom.xml b/plugins/storage/object/minio/pom.xml
index d69c2a7498fa..64d62cf8d347 100644
--- a/plugins/storage/object/minio/pom.xml
+++ b/plugins/storage/object/minio/pom.xml
@@ -46,12 +46,24 @@
         <dependency>
             <groupId>io.minio</groupId>
             <artifactId>minio</artifactId>
-            <version>8.5.2</version>
+            <version>${cs.minio.version}</version>
         </dependency>
         <dependency>
             <groupId>io.minio</groupId>
             <artifactId>minio-admin</artifactId>
-            <version>8.5.2</version>
+            <version>${cs.minio.version}</version>
+        </dependency>
+        <!-- Pin okhttp3 to the version required by minio 8.6.0+, overriding the older
+             version transitively pulled by influxdb-java -->
+        <dependency>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>okhttp</artifactId>
+            <version>5.1.0</version>
+        </dependency>
+        <dependency>
+            <groupId>com.squareup.okhttp3</groupId>
+            <artifactId>logging-interceptor</artifactId>
+            <version>5.1.0</version>
         </dependency>
     </dependencies>
 </project>
diff --git a/plugins/storage/object/simulator/pom.xml b/plugins/storage/object/simulator/pom.xml
index dc4ab0146067..bd6c6ef99059 100644
--- a/plugins/storage/object/simulator/pom.xml
+++ b/plugins/storage/object/simulator/pom.xml
@@ -46,12 +46,12 @@
         <dependency>
             <groupId>io.minio</groupId>
             <artifactId>minio</artifactId>
-            <version>8.5.2</version>
+            <version>${cs.minio.version}</version>
         </dependency>
         <dependency>
             <groupId>io.minio</groupId>
             <artifactId>minio-admin</artifactId>
-            <version>8.5.2</version>
+            <version>${cs.minio.version}</version>
         </dependency>
     </dependencies>
 </project>
diff --git a/plugins/user-authenticators/ldap/pom.xml b/plugins/user-authenticators/ldap/pom.xml
index c9e5a083725c..24a58653e10d 100644
--- a/plugins/user-authenticators/ldap/pom.xml
+++ b/plugins/user-authenticators/ldap/pom.xml
@@ -172,6 +172,18 @@
                     <groupId>org.apache.directory.shared</groupId>
                     <artifactId>shared-ldap-schema</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcpkix-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcutil-jdk15on</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <dependency>
@@ -191,12 +203,40 @@
             <artifactId>apacheds-core</artifactId>
             <version>${ads.version}</version>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcpkix-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcutil-jdk15on</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.apache.directory.server</groupId>
             <artifactId>apacheds-protocol-ldap</artifactId>
             <version>${ads.version}</version>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcprov-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcpkix-jdk15on</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.bouncycastle</groupId>
+                    <artifactId>bcutil-jdk15on</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.apache.directory.server</groupId>
diff --git a/pom.xml b/pom.xml
index d25e8a8369e9..a29a656ce512 100644
--- a/pom.xml
+++ b/pom.xml
@@ -132,7 +132,7 @@
         <cs.axiom.version>1.2.8</cs.axiom.version>
         <cs.axis2.version>1.6.4</cs.axis2.version>
         <cs.batik.version>1.14</cs.batik.version>
-        <cs.bcprov.version>1.70</cs.bcprov.version>
+        <cs.bcprov.version>1.83</cs.bcprov.version>
         <cs.cglib.version>3.3.0</cs.cglib.version>
         <cs.checkstyle-lib.version>8.18</cs.checkstyle-lib.version>
         <cs.cron-utils.version>9.2.0</cs.cron-utils.version>
@@ -191,6 +191,7 @@
         <cs.ini.version>0.5.4</cs.ini.version>
         <cs.caffeine.version>3.1.7</cs.caffeine.version>
         <cs.protobuf.version>3.25.5</cs.protobuf.version>
+        <cs.minio.version>8.6.0</cs.minio.version>
     </properties>
 
     <distributionManagement>
@@ -583,17 +584,17 @@
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bcpkix-jdk15on</artifactId>
+                <artifactId>bcpkix-jdk18on</artifactId>
                 <version>${cs.bcprov.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bcprov-jdk15on</artifactId>
+                <artifactId>bcprov-jdk18on</artifactId>
                 <version>${cs.bcprov.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.bouncycastle</groupId>
-                <artifactId>bctls-jdk15on</artifactId>
+                <artifactId>bctls-jdk18on</artifactId>
                 <version>${cs.bcprov.version}</version>
             </dependency>
             <dependency>
@@ -668,6 +669,18 @@
                         <groupId>org.slf4j</groupId>
                         <artifactId>log4j-over-slf4j</artifactId>
                     </exclusion>
+                    <exclusion>
+                        <groupId>org.bouncycastle</groupId>
+                        <artifactId>bcprov-jdk15on</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>org.bouncycastle</groupId>
+                        <artifactId>bcpkix-jdk15on</artifactId>
+                    </exclusion>
+                    <exclusion>
+                        <groupId>org.bouncycastle</groupId>
+                        <artifactId>bcutil-jdk15on</artifactId>
+                    </exclusion>
                 </exclusions>
             </dependency>
             <dependency>
diff --git a/services/console-proxy/rdpconsole/pom.xml b/services/console-proxy/rdpconsole/pom.xml
index 058ea891f9cd..9e722be37a09 100644
--- a/services/console-proxy/rdpconsole/pom.xml
+++ b/services/console-proxy/rdpconsole/pom.xml
@@ -46,11 +46,11 @@
         <!-- Another implementation of SSL protocol. Does not work with broken MS RDP SSL too. -->
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk15on</artifactId>
+            <artifactId>bcprov-jdk18on</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bctls-jdk15on</artifactId>
+            <artifactId>bctls-jdk18on</artifactId>
         </dependency>
         <dependency>
             <groupId>com.sun.xml.security</groupId>
diff --git a/utils/pom.xml b/utils/pom.xml
index 4b6e547e4519..775f5529d917 100755
--- a/utils/pom.xml
+++ b/utils/pom.xml
@@ -68,15 +68,15 @@
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcprov-jdk15on</artifactId>
+            <artifactId>bcprov-jdk18on</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk15on</artifactId>
+            <artifactId>bcpkix-jdk18on</artifactId>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bctls-jdk15on</artifactId>
+            <artifactId>bctls-jdk18on</artifactId>
         </dependency>
         <dependency>
             <groupId>com.jcraft</groupId>

From ea771a701317c06f0037016e94e15e0fe7106a31 Mon Sep 17 00:00:00 2001
From: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Date: Tue, 26 May 2026 13:42:03 +0530
Subject: [PATCH 47/64] Fix Instance Backup related events (#13180)

---
 ...signVirtualMachineToBackupOfferingCmd.java | 11 +++
 .../command/user/backup/CreateBackupCmd.java  |  7 +-
 .../user/backup/CreateBackupScheduleCmd.java  | 13 ++-
 ...veVirtualMachineFromBackupOfferingCmd.java | 11 +++
 ...storeVolumeFromBackupAndAttachToVMCmd.java | 11 +++
 .../cloudstack/backup/NASBackupProvider.java  |  8 +-
 .../cloudstack/backup/BackupManagerImpl.java  | 97 +++++++++----------
 .../cloudstack/backup/BackupManagerTest.java  |  6 +-
 8 files changed, 104 insertions(+), 60 deletions(-)

diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/AssignVirtualMachineToBackupOfferingCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/AssignVirtualMachineToBackupOfferingCmd.java
index 28cd642e1a41..29b1e740b67e 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/AssignVirtualMachineToBackupOfferingCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/AssignVirtualMachineToBackupOfferingCmd.java
@@ -21,6 +21,7 @@
 
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseAsyncCmd;
@@ -102,6 +103,16 @@ public long getEntityOwnerId() {
         return CallContext.current().getCallingAccount().getId();
     }
 
+    @Override
+    public Long getApiResourceId() {
+        return vmId;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.VirtualMachine;
+    }
+
     @Override
     public String getEventType() {
         return EventTypes.EVENT_VM_BACKUP_OFFERING_ASSIGN;
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupCmd.java
index ca60ea674fe3..8a4053aa15da 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupCmd.java
@@ -123,7 +123,12 @@ public void execute() throws ResourceUnavailableException, InsufficientCapacityE
 
     @Override
     public ApiCommandResourceType getApiResourceType() {
-        return ApiCommandResourceType.Backup;
+        return ApiCommandResourceType.VirtualMachine;
+    }
+
+    @Override
+    public Long getApiResourceId() {
+        return vmId;
     }
 
     @Override
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupScheduleCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupScheduleCmd.java
index 67ad7c71503f..f6e17a2b3908 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupScheduleCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/CreateBackupScheduleCmd.java
@@ -21,6 +21,7 @@
 
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseCmd;
@@ -81,7 +82,7 @@ public class CreateBackupScheduleCmd extends BaseCmd {
     @Parameter(name = ApiConstants.QUIESCE_VM,
             type = CommandType.BOOLEAN,
             required = false,
-            description = "Quiesce the instance before checkpointing the disks for backup. Applicable only to NAS backup provider. " +
+            description = "Quiesce the Instance before checkpointing the disks for backup. Applicable only to NAS backup provider. " +
                     "The filesystem is frozen before the backup starts and thawed immediately after. " +
                     "Requires the instance to have the QEMU Guest Agent installed and running.",
             since = "4.21.0")
@@ -139,4 +140,14 @@ public void execute() throws ServerApiException {
     public long getEntityOwnerId() {
         return CallContext.current().getCallingAccount().getId();
     }
+
+    @Override
+    public Long getApiResourceId() {
+        return vmId;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.VirtualMachine;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RemoveVirtualMachineFromBackupOfferingCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RemoveVirtualMachineFromBackupOfferingCmd.java
index dcf9f15b4dc5..62c2f03d8807 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RemoveVirtualMachineFromBackupOfferingCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RemoveVirtualMachineFromBackupOfferingCmd.java
@@ -21,6 +21,7 @@
 
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseAsyncCmd;
@@ -99,6 +100,16 @@ public long getEntityOwnerId() {
         return CallContext.current().getCallingAccount().getId();
     }
 
+    @Override
+    public Long getApiResourceId() {
+        return vmId;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.VirtualMachine;
+    }
+
     @Override
     public String getEventType() {
         return EventTypes.EVENT_VM_BACKUP_OFFERING_REMOVE;
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreVolumeFromBackupAndAttachToVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreVolumeFromBackupAndAttachToVMCmd.java
index 4644687817df..c15e6f8de684 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreVolumeFromBackupAndAttachToVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/backup/RestoreVolumeFromBackupAndAttachToVMCmd.java
@@ -22,6 +22,7 @@
 import org.apache.cloudstack.acl.RoleType;
 import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiCommandResourceType;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseAsyncCmd;
@@ -127,4 +128,14 @@ public String getEventType() {
     public String getEventDescription() {
         return "Restoring volume "+ volumeUuid + " from backup " + getResourceUuid(ApiConstants.BACKUP_ID) + " and attaching it to Instance " + getResourceUuid(ApiConstants.VIRTUAL_MACHINE_ID);
     }
+
+    @Override
+    public Long getApiResourceId() {
+        return vmId;
+    }
+
+    @Override
+    public ApiCommandResourceType getApiResourceType() {
+        return ApiCommandResourceType.VirtualMachine;
+    }
 }
diff --git a/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java b/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java
index df9336026f4d..a7121f149e30 100644
--- a/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java
+++ b/plugins/backup/nas/src/main/java/org/apache/cloudstack/backup/NASBackupProvider.java
@@ -226,12 +226,12 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
         } catch (AgentUnavailableException e) {
             logger.error("Unable to contact backend control plane to initiate backup for VM {}", vm.getInstanceName());
             backupVO.setStatus(Backup.Status.Failed);
-            backupDao.remove(backupVO.getId());
+            backupDao.update(backupVO.getId(), backupVO);
             throw new CloudRuntimeException("Unable to contact backend control plane to initiate backup");
         } catch (OperationTimedoutException e) {
             logger.error("Operation to initiate backup timed out for VM {}", vm.getInstanceName());
             backupVO.setStatus(Backup.Status.Failed);
-            backupDao.remove(backupVO.getId());
+            backupDao.update(backupVO.getId(), backupVO);
             throw new CloudRuntimeException("Operation to initiate backup timed out, please try again");
         }
 
@@ -249,12 +249,12 @@ public Pair<Boolean, Backup> takeBackup(final VirtualMachine vm, Boolean quiesce
         } else {
             logger.error("Failed to take backup for VM {}: {}", vm.getInstanceName(), answer != null ? answer.getDetails() : "No answer received");
             if (answer.getNeedsCleanup()) {
-                logger.error("Backup cleanup failed for VM {}. Leaving the backup in Error state.", vm.getInstanceName());
+                logger.error("Backup cleanup failed for VM {}. Leaving the backup in Error state. Backup should be manually deleted to free up the space", vm.getInstanceName());
                 backupVO.setStatus(Backup.Status.Error);
                 backupDao.update(backupVO.getId(), backupVO);
             } else {
                 backupVO.setStatus(Backup.Status.Failed);
-                backupDao.remove(backupVO.getId());
+                backupDao.update(backupVO.getId(), backupVO);
             }
             return new Pair<>(false, null);
         }
diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
index fd4fc9466066..1cbb668206d9 100644
--- a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
@@ -576,12 +576,12 @@ public String createVolumeInfoFromVolumes(List<Volume> vmVolumes) {
     }
 
     @Override
-    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_OFFERING_ASSIGN, eventDescription = "assign VM to backup offering", async = true)
+    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_OFFERING_ASSIGN, eventDescription = "assign Instance to Backup Offering", async = true)
     public boolean assignVMToBackupOffering(Long vmId, Long offeringId) {
         final VMInstanceVO vm = findVmById(vmId);
 
         if (!Arrays.asList(VirtualMachine.State.Running, VirtualMachine.State.Stopped, VirtualMachine.State.Shutdown).contains(vm.getState())) {
-            throw new CloudRuntimeException("VM is not in running or stopped state");
+            throw new CloudRuntimeException("Instance is not in running or stopped state");
         }
 
         validateBackupForZone(vm.getDataCenterId());
@@ -589,7 +589,7 @@ public boolean assignVMToBackupOffering(Long vmId, Long offeringId) {
         accountManager.checkAccess(CallContext.current().getCallingAccount(), null, true, vm);
 
         if (vm.getBackupOfferingId() != null) {
-            throw new CloudRuntimeException("VM already is assigned to a backup offering, please remove the VM from its previous offering");
+            throw new CloudRuntimeException("Instance already is assigned to a backup offering, please remove the Instance from its previous offering");
         }
 
         final BackupOfferingVO offering = backupOfferingDao.findById(offeringId);
@@ -621,12 +621,12 @@ public VMInstanceVO doInTransaction(final TransactionStatus status) {
                     vm.setBackupVolumes(createVolumeInfoFromVolumes(new ArrayList<>(volumeDao.findByInstance(vmId))));
 
                     if (!backupProvider.assignVMToBackupOffering(vm, offering)) {
-                        throw new CloudRuntimeException("Failed to assign the VM to the backup offering, please try removing the assignment and try again.");
+                        throw new CloudRuntimeException("Failed to assign the Instance to the Backup Offering, please try removing the assignment and try again.");
                     }
 
                     if (!vmInstanceDao.update(vmId, vm)) {
                         backupProvider.removeVMFromBackupOffering(vm);
-                        throw new CloudRuntimeException("Failed to update VM assignment to the backup offering in the DB, please try again.");
+                        throw new CloudRuntimeException("Failed to update Instance assignment to the Backup Offering in the DB, please try again.");
                     }
 
                     UsageEventUtils.publishUsageEvent(EventTypes.EVENT_VM_BACKUP_OFFERING_ASSIGN, vm.getAccountId(), vm.getDataCenterId(), vmId,
@@ -635,7 +635,7 @@ public VMInstanceVO doInTransaction(final TransactionStatus status) {
                             "uuid", "instanceName", "backupOfferingId", "backupVolumes"), ReflectionToStringBuilderUtils.reflectOnlySelectedFields(offering,
                                     "uuid", "name", "externalId", "provider")));
                 } catch (Exception e) {
-                    String msg = String.format("Failed to assign VM [%s] to the Backup Offering [%s], using provider [name: %s, class: %s], due to: [%s].",
+                    String msg = String.format("Failed to assign Instance [%s] to the Backup Offering [%s], using provider [name: %s, class: %s], due to: [%s].",
                             ReflectionToStringBuilderUtils.reflectOnlySelectedFields(vm, "uuid", "instanceName", "backupOfferingId", "backupVolumes"),
                             ReflectionToStringBuilderUtils.reflectOnlySelectedFields(offering, "uuid", "name", "externalId", "provider"),
                             backupProvider.getName(), backupProvider.getClass().getSimpleName(), e.getMessage());
@@ -649,11 +649,11 @@ public VMInstanceVO doInTransaction(final TransactionStatus status) {
     }
 
     @Override
-    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_OFFERING_REMOVE, eventDescription = "remove VM from backup offering", async = true)
+    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_OFFERING_REMOVE, eventDescription = "remove Instance from Backup Offering", async = true)
     public boolean removeVMFromBackupOffering(final Long vmId, final boolean forced) {
         final VMInstanceVO vm = vmInstanceDao.findByIdIncludingRemoved(vmId);
         if (vm == null) {
-            throw new CloudRuntimeException(String.format("Can't find any VM with ID: [%s].", vmId));
+            throw new CloudRuntimeException(String.format("Can't find any Instance with ID: [%s].", vmId));
         }
 
         validateBackupForZone(vm.getDataCenterId());
@@ -670,8 +670,8 @@ public boolean removeVMFromBackupOffering(final Long vmId, final boolean forced)
         }
 
         if (!forced && backupProvider.willDeleteBackupsOnOfferingRemoval()) {
-            String message = String.format("To remove VM [id: %s, name: %s] from Backup Offering [id: %s, name: %s] using the provider [%s], please specify the "
-                    + "forced:true option to allow the deletion of all jobs and backups for this VM or remove the backups that this VM has with the backup "
+            String message = String.format("To remove Instance [id: %s, name: %s] from Backup Offering [id: %s, name: %s] using the provider [%s], please specify the "
+                    + "forced:true option to allow the deletion of all jobs and backups for this Instance or remove the backups that this Instance has with the backup "
                     + "offering.", vm.getUuid(), vm.getInstanceName(), offering.getUuid(), offering.getName(), backupProvider.getClass().getSimpleName());
             throw new CloudRuntimeException(message);
         }
@@ -709,7 +709,7 @@ public boolean removeVMFromBackupOffering(final Long vmId, final boolean forced)
     }
 
     @Override
-    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_SCHEDULE_CONFIGURE, eventDescription = "configuring VM backup schedule")
+    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_SCHEDULE_CONFIGURE, eventDescription = "configuring Instance Backup Schedule")
     public BackupSchedule configureBackupSchedule(CreateBackupScheduleCmd cmd) {
         final Long vmId = cmd.getVmId();
         final DateUtil.IntervalType intervalType = cmd.getIntervalType();
@@ -725,7 +725,7 @@ public BackupSchedule configureBackupSchedule(CreateBackupScheduleCmd cmd) {
         accountManager.checkAccess(CallContext.current().getCallingAccount(), null, true, vm);
 
         if (vm.getBackupOfferingId() == null) {
-            throw new CloudRuntimeException("Cannot configure backup schedule for the VM without having any backup offering");
+            throw new CloudRuntimeException("Cannot configure Backup Schedule for the Instance as it is not assigned any Backup Offering");
         }
 
         final BackupOffering offering = backupOfferingDao.findById(vm.getBackupOfferingId());
@@ -859,7 +859,7 @@ public List<BackupSchedule> listBackupSchedules(ListBackupScheduleCmd cmd) {
     }
 
     @Override
-    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_SCHEDULE_DELETE, eventDescription = "deleting VM backup schedule")
+    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_SCHEDULE_DELETE, eventDescription = "deleting Instance Backup Schedule")
     public boolean deleteBackupSchedule(DeleteBackupScheduleCmd cmd) {
         Long vmId = cmd.getVmId();
         Long id = cmd.getId();
@@ -910,7 +910,7 @@ protected boolean deleteAllVmBackupSchedules(long vmId) {
     }
 
     @Override
-    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_CREATE, eventDescription = "creating VM backup", async = true)
+    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_CREATE, eventDescription = "creating Instance Backup", async = true)
     public boolean createBackup(CreateBackupCmd cmd, Object job) throws ResourceAllocationException {
         Long vmId = cmd.getVmId();
         Account caller = CallContext.current().getCallingAccount();
@@ -920,17 +920,17 @@ public boolean createBackup(CreateBackupCmd cmd, Object job) throws ResourceAllo
         accountManager.checkAccess(caller, null, true, vm);
 
         if (vm.getBackupOfferingId() == null) {
-            throw new CloudRuntimeException("VM has not backup offering configured, cannot create backup before assigning it to a backup offering");
+            throw new CloudRuntimeException("Cannot create backup as the Instance doesn't have a Backup Offering assigned");
         }
 
         final BackupOffering offering = backupOfferingDao.findById(vm.getBackupOfferingId());
         if (offering == null) {
-            throw new CloudRuntimeException("VM backup offering not found");
+            throw new CloudRuntimeException("Instance Backup Offering not found");
         }
 
         final BackupProvider backupProvider = getBackupProvider(offering.getProvider());
         if (backupProvider == null) {
-            throw new CloudRuntimeException("VM backup provider not found for the offering");
+            throw new CloudRuntimeException("Instance backup provider not found for the Offering");
         }
 
         if (!offering.isUserDrivenBackupAllowed()) {
@@ -970,14 +970,9 @@ private void createCheckedBackup(CreateBackupCmd cmd, Account owner, boolean isS
              CheckedReservation backupStorageReservation = new CheckedReservation(owner,
                      Resource.ResourceType.backup_storage, backupSize, reservationDao, resourceLimitMgr)) {
 
-            ActionEventUtils.onStartedActionEvent(User.UID_SYSTEM, vm.getAccountId(),
-                    EventTypes.EVENT_VM_BACKUP_CREATE, "creating backup for VM ID:" + vm.getUuid(),
-                    vmId, ApiCommandResourceType.VirtualMachine.toString(),
-                    true, 0);
-
             Pair<Boolean, Backup> result = backupProvider.takeBackup(vm, cmd.getQuiesceVM());
             if (!result.first()) {
-                throw new CloudRuntimeException("Failed to create VM backup");
+                throw new CloudRuntimeException("Failed to create Instance Backup");
             }
             Backup backup = result.second();
             if (backup != null) {
@@ -1079,7 +1074,7 @@ protected void deleteExcessBackups(List<BackupVO> backups, int amountOfBackupsTo
         for (int i = 0; i < amountOfBackupsToDelete; i++) {
             BackupVO backup = backups.get(i);
             if (deleteBackup(backup.getId(), false)) {
-                String eventDescription = String.format("Successfully deleted backup for VM [ID: %s], suiting the retention specified in the backup schedule [ID: %s]", backup.getVmId(), backupScheduleId);
+                String eventDescription = String.format("Successfully deleted Backup for Instance [ID: %s], suiting the retention specified in the Backup Schedule [ID: %s]", backup.getVmId(), backupScheduleId);
                 logger.info(eventDescription);
                 ActionEventUtils.onCompletedActionEvent(
                         User.UID_SYSTEM, backup.getAccountId(), EventVO.LEVEL_INFO,
@@ -1176,9 +1171,9 @@ public boolean importRestoredVM(long zoneId, long domainId, long accountId, long
             logger.error(String.format("Failed to import VM [vmInternalName: %s] from backup restoration [%s] with hypervisor [type: %s] due to: [%s].", vmInternalName,
                     ReflectionToStringBuilderUtils.reflectOnlySelectedFields(backup, "id", "uuid", "vmId", "externalId", "backupType"), hypervisorType, e.getMessage()), e);
             ActionEventUtils.onCompletedActionEvent(User.UID_SYSTEM, vm.getAccountId(), EventVO.LEVEL_ERROR, EventTypes.EVENT_VM_BACKUP_RESTORE,
-                    String.format("Failed to import VM %s from backup %s with hypervisor [type: %s]", vmInternalName, backup.getUuid(), hypervisorType),
+                    String.format("Failed to import Instance %s from Backup %s with hypervisor [type: %s]", vmInternalName, backup.getUuid(), hypervisorType),
                     vm.getId(), ApiCommandResourceType.VirtualMachine.toString(),0);
-            throw new CloudRuntimeException("Error during vm backup restoration and import: " + e.getMessage());
+            throw new CloudRuntimeException("Error during Instance Backup restoration and import: " + e.getMessage());
         }
         if (vm == null) {
             String message = String.format("Failed to import restored VM %s  with hypervisor type %s using backup of VM ID %s",
@@ -1188,14 +1183,14 @@ public boolean importRestoredVM(long zoneId, long domainId, long accountId, long
                     message, vm.getId(), ApiCommandResourceType.VirtualMachine.toString(),0);
         } else {
             ActionEventUtils.onCompletedActionEvent(User.UID_SYSTEM, vm.getAccountId(), EventVO.LEVEL_INFO, EventTypes.EVENT_VM_BACKUP_RESTORE,
-                    String.format("Restored VM %s from backup %s", vm.getUuid(), backup.getUuid()),
+                    String.format("Restored Instance %s from Backup %s", vm.getUuid(), backup.getUuid()),
                     vm.getId(), ApiCommandResourceType.VirtualMachine.toString(),0);
         }
         return vm != null;
     }
 
     @Override
-    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_RESTORE, eventDescription = "restoring VM from backup", async = true)
+    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_RESTORE, eventDescription = "restoring Instance from Backup", async = true)
     public boolean restoreBackup(final Long backupId) {
         final BackupVO backup = backupDao.findById(backupId);
         if (backup == null) {
@@ -1214,7 +1209,7 @@ public boolean restoreBackup(final Long backupId) {
 
         if (vm.getRemoved() == null && !vm.getState().equals(VirtualMachine.State.Stopped) &&
                 !vm.getState().equals(VirtualMachine.State.Destroyed)) {
-            throw new CloudRuntimeException("Existing VM should be stopped before being restored from backup");
+            throw new CloudRuntimeException("Existing Instance should be stopped before being restored from Backup");
         }
 
         // This is done to handle historic backups if any with Veeam / Networker plugins
@@ -1222,7 +1217,7 @@ public boolean restoreBackup(final Long backupId) {
                 vm.getBackupVolumeList() : backup.getBackedUpVolumes();
         List<VolumeVO> vmVolumes = volumeDao.findByInstance(vm.getId());
         if (vmVolumes.size() != backupVolumes.size()) {
-            throw new CloudRuntimeException("Unable to restore VM with the current backup as the backup has different number of disks as the VM");
+            throw new CloudRuntimeException("Unable to restore Instance with the current Backup as the Backup has different number of disks to the Instance");
         }
 
         BackupOffering offering = backupOfferingDao.findByIdIncludingRemoved(vm.getBackupOfferingId());
@@ -1256,16 +1251,16 @@ protected void tryRestoreVM(BackupVO backup, VMInstanceVO vm, BackupOffering off
             updateVmState(vm, VirtualMachine.Event.RestoringRequested, VirtualMachine.State.Restoring);
             updateVolumeState(vm, Volume.Event.RestoreRequested, Volume.State.Restoring);
             ActionEventUtils.onStartedActionEvent(User.UID_SYSTEM, vm.getAccountId(), EventTypes.EVENT_VM_BACKUP_RESTORE,
-                    String.format("Restoring VM %s from backup %s", vm.getUuid(), backup.getUuid()),
+                    String.format("Restoring Instance %s from Backup %s", vm.getUuid(), backup.getUuid()),
                     vm.getId(), ApiCommandResourceType.VirtualMachine.toString(),
                     true, 0);
 
             final BackupProvider backupProvider = getBackupProvider(offering.getProvider());
             if (!backupProvider.restoreVMFromBackup(vm, backup)) {
                 ActionEventUtils.onCompletedActionEvent(User.UID_SYSTEM, vm.getAccountId(), EventVO.LEVEL_ERROR, EventTypes.EVENT_VM_BACKUP_RESTORE,
-                        String.format("Failed to restore VM %s from backup %s", vm.getInstanceName(), backup.getUuid()),
+                        String.format("Failed to restore Instance %s from Backup %s", vm.getInstanceName(), backup.getUuid()),
                         vm.getId(), ApiCommandResourceType.VirtualMachine.toString(),0);
-                throw new CloudRuntimeException("Error restoring VM from backup with uuid " + backup.getUuid());
+                throw new CloudRuntimeException("Error restoring Instance from Backup with uuid " + backup.getUuid());
             }
         // The restore process is executed by a backup provider outside of ACS, I am using the catch-all (Exception) to
         // ensure that no provider-side exception is missed. Therefore, we have a proper handling of exceptions, and rollbacks if needed.
@@ -1273,7 +1268,7 @@ protected void tryRestoreVM(BackupVO backup, VMInstanceVO vm, BackupOffering off
             logger.error(String.format("Failed to restore backup [%s] due to: [%s].", backupDetailsInMessage, e.getMessage()), e);
             updateVolumeState(vm, Volume.Event.RestoreFailed, Volume.State.Ready);
             updateVmState(vm, VirtualMachine.Event.RestoringFailed, VirtualMachine.State.Stopped);
-            throw new CloudRuntimeException(String.format("Error restoring VM from backup [%s].", backupDetailsInMessage));
+            throw new CloudRuntimeException(String.format("Error restoring Instance from Backup [%s].", backupDetailsInMessage));
         }
     }
 
@@ -1288,10 +1283,10 @@ private void updateVmState(VMInstanceVO vm, VirtualMachine.Event event, VirtualM
         Transaction.execute(TransactionLegacy.CLOUD_DB, (TransactionCallback<VMInstanceVO>) status -> {
             try {
                 if (!virtualMachineManager.stateTransitTo(vm, event, vm.getHostId())) {
-                    throw new CloudRuntimeException(String.format("Unable to change state of VM [%s] to [%s].", vm, next));
+                    throw new CloudRuntimeException(String.format("Unable to change state of Instance [%s] to [%s].", vm, next));
                 }
             } catch (NoTransitionException e) {
-                String errMsg = String.format("Failed to update state of VM [%s] with event [%s] due to [%s].", vm, event, e.getMessage());
+                String errMsg = String.format("Failed to update state of Instance [%s] with event [%s] due to [%s].", vm, event, e.getMessage());
                 logger.error(errMsg, e);
                 throw new RuntimeException(errMsg);
             }
@@ -1503,7 +1498,7 @@ public boolean restoreBackupToVM(final Long backupId, final Long vmId) throws Cl
             throw new CloudRuntimeException("Instance with ID " + backup.getVmId() + " couldn't be found.");
         }
         if (!vm.getState().equals(VirtualMachine.State.Stopped)) {
-            throw new CloudRuntimeException("The VM should be in stopped state");
+            throw new CloudRuntimeException("The Instance should be in stopped state");
         }
 
         List<Backup.VolumeInfo> backupVolumes = backup.getBackedUpVolumes();
@@ -1567,7 +1562,7 @@ public boolean restoreBackupToVM(final Long backupId, final Long vmId) throws Cl
     }
 
     @Override
-    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_RESTORE, eventDescription = "restoring VM from backup", async = true)
+    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_RESTORE_VOLUME_TO_VM, eventDescription = "restoring Volume from Backup to Instance", async = true)
     public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid, final Long backupId, final Long vmId) throws Exception {
         if (StringUtils.isEmpty(backedUpVolumeUuid)) {
             throw new CloudRuntimeException("Invalid volume ID passed");
@@ -1585,7 +1580,7 @@ public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid,
         accountManager.checkAccess(CallContext.current().getCallingAccount(), null, true, vm);
 
         if (vm.getBackupOfferingId() != null && !BackupEnableAttachDetachVolumes.value()) {
-            throw new CloudRuntimeException("The selected VM has backups, cannot restore and attach volume to the VM.");
+            throw new CloudRuntimeException("The selected Instance has backups, cannot restore and attach Volume to the Instance.");
         }
 
         if (backup.getZoneId() != vm.getDataCenterId()) {
@@ -1596,7 +1591,7 @@ public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid,
         if (volumeInfoList == null) {
             final VMInstanceVO vmFromBackup = vmInstanceDao.findByIdIncludingRemoved(backup.getVmId());
             if (vmFromBackup == null) {
-                throw new CloudRuntimeException("VM reference for the provided VM backup not found");
+                throw new CloudRuntimeException("Instance reference for the provided Instance backup not found");
             } else if (vmFromBackup == null || vmFromBackup.getBackupVolumeList() == null) {
                 throw new CloudRuntimeException("Volumes metadata not found in the backup");
             }
@@ -1610,7 +1605,7 @@ public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid,
         accountManager.checkAccess(CallContext.current().getCallingAccount(), null, true, vm);
         final BackupOffering offering = backupOfferingDao.findByIdIncludingRemoved(backup.getBackupOfferingId());
         if (offering == null) {
-            throw new CloudRuntimeException("Failed to find VM backup offering");
+            throw new CloudRuntimeException("Failed to find Instance Backup Offering");
         }
 
         BackupProvider backupProvider = getBackupProvider(offering.getProvider());
@@ -1636,12 +1631,12 @@ public boolean restoreBackupVolumeAndAttachToVM(final String backedUpVolumeUuid,
         Pair<Boolean, String> result = restoreBackedUpVolume(backupVolumeInfo, backup, backupProvider, hostPossibleValues, datastoresPossibleValues, vm);
 
         if (BooleanUtils.isFalse(result.first())) {
-            throw new CloudRuntimeException(String.format("Error restoring volume [%s] of VM [%s] to host [%s] using backup provider [%s] due to: [%s].",
+            throw new CloudRuntimeException(String.format("Error restoring Volume [%s] of Instance [%s] to host [%s] using backup provider [%s] due to: [%s].",
                     backedUpVolumeUuid, vm.getUuid(), host.getUuid(), backupProvider.getName(), result.second()));
         }
         if (!attachVolumeToVM(vm.getDataCenterId(), result.second(), backupVolumeInfo,
                             backedUpVolumeUuid, vm, datastore.getUuid(), backup)) {
-            throw new CloudRuntimeException(String.format("Error attaching volume [%s] to VM [%s].", backedUpVolumeUuid, vm.getUuid()));
+            throw new CloudRuntimeException(String.format("Error attaching Volume [%s] to Instance [%s].", backedUpVolumeUuid, vm.getUuid()));
         }
         return true;
     }
@@ -1670,7 +1665,7 @@ protected Pair<Boolean, String> restoreBackedUpVolume(final Backup.VolumeInfo ba
     }
 
     @Override
-    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_DELETE, eventDescription = "deleting VM backup", async = true)
+    @ActionEvent(eventType = EventTypes.EVENT_VM_BACKUP_DELETE, eventDescription = "deleting Instance backup", async = true)
     public boolean deleteBackup(final Long backupId, final Boolean forced) throws ResourceAllocationException {
         final BackupVO backup = backupDao.findByIdIncludingRemoved(backupId);
         if (backup == null) {
@@ -1776,12 +1771,12 @@ private boolean attachVolumeToVM(Long zoneId, String restoredVolumeLocation, Bac
         HypervisorGuru guru = hypervisorGuruManager.getGuru(vm.getHypervisorType());
         backupVolumeInfo.setType(Volume.Type.DATADISK);
 
-        logger.info("Attaching the restored volume {} to VM {}.", () -> ReflectionToStringBuilder.toString(backupVolumeInfo, ToStringStyle.JSON_STYLE), () -> vm);
+        logger.info("Attaching the restored Volume {} to Instance {}.", () -> ReflectionToStringBuilder.toString(backupVolumeInfo, ToStringStyle.JSON_STYLE), () -> vm);
         StoragePoolVO pool = primaryDataStoreDao.findByUuid(datastoreUuid);
         try {
             return guru.attachRestoredVolumeToVirtualMachine(zoneId, restoredVolumeLocation, backupVolumeInfo, vm, pool.getId(), backup);
         } catch (Exception e) {
-            throw new CloudRuntimeException("Error attach restored volume to VM " + vm.getUuid() + " due to: " + e.getMessage());
+            throw new CloudRuntimeException("Error attach restored Volume to Instance " + vm.getUuid() + " due to: " + e.getMessage());
         }
     }
 
@@ -1964,7 +1959,7 @@ private void checkStatusOfCurrentlyExecutingBackups() {
                 case FAILED:
                     final Date nextDateTime = scheduleNextBackupJob(backupSchedule);
                     final String nextScheduledTime = DateUtil.displayDateInTimezone(DateUtil.GMT_TIMEZONE, nextDateTime);
-                    logger.debug("Next backup scheduled time for VM ID " + backupSchedule.getVmId() + " is " + nextScheduledTime);
+                    logger.debug("Next backup scheduled time for Instance ID " + backupSchedule.getVmId() + " is " + nextScheduledTime);
                     break;
             default:
                 logger.debug("Found async backup job [id: {}, uuid: {}, vmId: {}] with " +
@@ -2004,7 +1999,7 @@ public void scheduleBackups() {
 
             final Account backupAccount = accountService.getAccount(vm.getAccountId());
             if (backupAccount == null || backupAccount.getState() == Account.State.DISABLED) {
-                logger.debug("Skip backup for VM ({}) since its account has been removed or disabled.", vm);
+                logger.debug("Skip backup for Instance ({}) since its account has been removed or disabled.", vm);
                 continue;
             }
 
@@ -2021,7 +2016,7 @@ public void scheduleBackups() {
                 tmpBackupScheduleVO = backupScheduleDao.acquireInLockTable(backupScheduleId);
 
                 final Long eventId = ActionEventUtils.onScheduledActionEvent(User.UID_SYSTEM, vm.getAccountId(),
-                        EventTypes.EVENT_VM_BACKUP_CREATE, "creating backup for VM ID:" + vm.getUuid(),
+                        EventTypes.EVENT_VM_BACKUP_CREATE, "creating Backup for Instance ID:" + vm.getUuid(),
                         vmId, ApiCommandResourceType.VirtualMachine.toString(),
                         true, 0);
                 final Map<String, String> params = new HashMap<String, String>();
@@ -2085,7 +2080,7 @@ protected void runInContext() {
     private VMInstanceVO findVmById(final Long vmId) {
         final VMInstanceVO vm = vmInstanceDao.findById(vmId);
         if (vm == null) {
-            throw new CloudRuntimeException(String.format("Can't find any VM with ID: [%s].", vmId));
+            throw new CloudRuntimeException(String.format("Can't find any Instance with ID: [%s].", vmId));
         }
         return vm;
     }
@@ -2269,7 +2264,7 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
                                     backup.getBackupOfferingId(), backup.getAccountId(), backup.getDomainId(), backup.getZoneId()));
 
                             ActionEventUtils.onCompletedActionEvent(User.UID_SYSTEM, vm.getAccountId(), EventVO.LEVEL_INFO, EventTypes.EVENT_VM_BACKUP_CREATE,
-                                    String.format("Created backup %s for VM ID: %s", backup.getUuid(), vm.getUuid()),
+                                    String.format("Created Backup %s for Instance ID: %s", backup.getUuid(), vm.getUuid()),
                                     vm.getId(), ApiCommandResourceType.VirtualMachine.toString(),0);
                         }
                     }
diff --git a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
index 8094bddf47fb..27dd630e470f 100644
--- a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
+++ b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
@@ -578,7 +578,7 @@ public void tryRestoreVMTestRestoreFails() throws NoTransitionException {
                 backupManager.tryRestoreVM(backup, vm, offering, "Checking message error.");
                 fail("An exception is needed.");
             } catch (CloudRuntimeException e) {
-                assertEquals("Error restoring VM from backup [Checking message error.].", e.getMessage());
+                assertEquals("Error restoring Instance from Backup [Checking message error.].", e.getMessage());
             }
         }
     }
@@ -2215,7 +2215,7 @@ public void testRestoreBackupVmNotStopped() {
         CloudRuntimeException exception = Assert.assertThrows(CloudRuntimeException.class,
                 () -> backupManager.restoreBackup(backupId));
 
-        assertEquals("Existing VM should be stopped before being restored from backup", exception.getMessage());
+        assertEquals("Existing Instance should be stopped before being restored from Backup", exception.getMessage());
         verify(backupDao, times(1)).findById(backupId);
         verify(vmInstanceDao, times(1)).findByIdIncludingRemoved(vmId);
     }
@@ -2252,7 +2252,7 @@ public void testRestoreBackupVolumeMismatch() {
             CloudRuntimeException exception = Assert.assertThrows(CloudRuntimeException.class,
                     () -> backupManager.restoreBackup(backupId));
 
-            assertEquals("Unable to restore VM with the current backup as the backup has different number of disks as the VM", exception.getMessage());
+            assertEquals("Unable to restore Instance with the current Backup as the Backup has different number of disks to the Instance", exception.getMessage());
         }
         verify(backupDao, times(1)).findById(backupId);
         verify(vmInstanceDao, times(1)).findByIdIncludingRemoved(vmId);

From 2ae1015073b4351ef855ec90e431676a26977776 Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Tue, 26 May 2026 10:19:19 +0200
Subject: [PATCH 48/64] Add jmsperu to the list of contributors

---
 .asf.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.asf.yaml b/.asf.yaml
index 5105ede1813f..d72395af5704 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -55,6 +55,7 @@ github:
     - erikbocks
     - Imvedansh
     - Damans227
+    - jmsperu
 
   protected_branches: ~
 

From 583a1e0dfb04501b2d81413016cfee8d1300f6a2 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Tue, 26 May 2026 16:23:19 +0530
Subject: [PATCH 49/64] Refactor github actions (#12774)

---
 .github/actions/install-nonoss/action.yml     |  31 +++++
 .github/actions/setup-env/action.yml          |  58 ++++++++++
 .github/workflows/build.yml                   |  40 +++----
 .github/workflows/ci.yml                      | 109 ++++++++++--------
 .github/workflows/codecov.yml                 |  59 ----------
 .github/workflows/codeql-analysis.yml         |  10 +-
 .github/workflows/daily-repo-status.lock.yml  |  10 +-
 .../workflows/docker-cloudstack-simulator.yml |   8 +-
 .github/workflows/main-sonar-check.yml        |  61 +++++-----
 .github/workflows/merge-conflict-checker.yml  |  20 ++--
 .github/workflows/pre-commit.yml              |  18 ++-
 .github/workflows/rat.yml                     |  27 ++---
 .github/workflows/sonar-check.yml             |  60 +++++-----
 .github/workflows/stale.yml                   |   4 +-
 .github/workflows/ui.yml                      |  12 +-
 15 files changed, 275 insertions(+), 252 deletions(-)
 create mode 100644 .github/actions/install-nonoss/action.yml
 create mode 100644 .github/actions/setup-env/action.yml
 delete mode 100644 .github/workflows/codecov.yml

diff --git a/.github/actions/install-nonoss/action.yml b/.github/actions/install-nonoss/action.yml
new file mode 100644
index 000000000000..39a03213c29d
--- /dev/null
+++ b/.github/actions/install-nonoss/action.yml
@@ -0,0 +1,31 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: 'Install CloudStack Non-OSS'
+description: 'Clones and installs the shapeblue/cloudstack-nonoss repository.'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Install cloudstack-nonoss
+      shell: bash
+      run: |
+        git clone --depth 1 https://github.com/shapeblue/cloudstack-nonoss.git nonoss
+        cd nonoss
+        bash -x install-non-oss.sh
+        cd ..
+        rm -fr nonoss
diff --git a/.github/actions/setup-env/action.yml b/.github/actions/setup-env/action.yml
new file mode 100644
index 000000000000..0f8425229242
--- /dev/null
+++ b/.github/actions/setup-env/action.yml
@@ -0,0 +1,58 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: 'Setup CloudStack Environment'
+description: 'Sets up JDK (with Maven cache), optionally Python, and optionally APT build dependencies for CloudStack.'
+
+inputs:
+  java-version:
+    description: 'The JDK version to use'
+    required: false
+    default: '17'
+  install-python:
+    description: 'Whether to install Python 3.10'
+    required: false
+    default: 'false'
+  install-apt-deps:
+    description: 'Whether to install CloudStack APT build dependencies'
+    required: false
+    default: 'false'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Set up JDK ${{ inputs.java-version }}
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+      with:
+        java-version: ${{ inputs.java-version }}
+        distribution: 'adopt'
+        architecture: x64
+        cache: 'maven'
+
+    - name: Set up Python
+      if: ${{ inputs.install-python == 'true' }}
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+      with:
+        python-version: '3.10'
+        architecture: x64
+
+    - name: Install Build Dependencies
+      if: ${{ inputs.install-apt-deps == 'true' }}
+      shell: bash
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y git uuid-runtime genisoimage netcat-openbsd ipmitool build-essential libgcrypt20 libgpg-error-dev libgpg-error0 libopenipmi0 libpython3-dev libssl-dev libffi-dev python3-openssl python3-dev python3-setuptools
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 4c33a1313436..4eb508f5f6f8 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -16,40 +16,27 @@
 # under the License.
 
 name: Build
-
-on: [push, pull_request]
-
+on:
+  - push
+  - pull_request
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 permissions:
   contents: read
-
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          distribution: 'temurin'
-          java-version: '17'
-          cache: 'maven'
+          persist-credentials: false
 
-      - name: Set up Python
-        uses: actions/setup-python@v6
+      - name: Setup Environment
+        uses: ./.github/actions/setup-env
         with:
-          python-version: '3.10'
-          architecture: 'x64'
-
-      - name: Install Build Dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y git uuid-runtime genisoimage netcat ipmitool build-essential libgcrypt20 libgpg-error-dev libgpg-error0 libopenipmi0 ipmitool libpython3-dev libssl-dev libffi-dev python3-openssl python3-dev python3-setuptools
-
+          install-python: 'true'
+          install-apt-deps: 'true'
       - name: Env details
         run: |
           uname -a
@@ -60,9 +47,8 @@ jobs:
           free -m
           nproc
           git status
-
+      - name: Install Non-OSS
+        uses: ./.github/actions/install-nonoss
       - name: Noredist Build
         run: |
-          git clone https://github.com/shapeblue/cloudstack-nonoss.git nonoss && cd nonoss && bash -x install-non-oss.sh && cd ..
-          rm -fr nonoss
           mvn -B -P developer,systemvm -Dsimulator -Dnoredist clean install -T$(nproc)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 52c47b26de8f..e9d03bf1209b 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -16,21 +16,56 @@
 # under the License.
 
 name: Simulator CI
-
-on: [push, pull_request]
-
+on:
+  - push
+  - pull_request
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 permissions:
   contents: read
-
 jobs:
   build:
     if: github.repository == 'apache/cloudstack'
     runs-on: ubuntu-24.04
-
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Setup Environment
+        uses: ./.github/actions/setup-env
+        with:
+          install-python: 'true'
+          install-apt-deps: 'true'
+      - name: Env details
+        run: |
+          uname -a
+          whoami
+          javac -version
+          mvn -v
+          python3 --version
+          free -m
+          nproc
+          git status
+          ipmitool -V
+      - name: Build with Maven
+        run: |
+          mvn -B -P developer,systemvm -Dsimulator clean install -DskipTests=true -T$(nproc)
+      - name: Archive artifacts
+        run: |
+          mkdir -p /tmp/artifacts
+          tar -czf /tmp/artifacts/targets.tar.gz $(find . -name "target" -type d) tools/marvin/dist engine/schema/dist utils/conf
+          tar -czf /tmp/artifacts/m2-cloudstack.tar.gz -C ~/.m2/repository org/apache/cloudstack
+      - name: Upload artifacts
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: build-artifacts
+          path: /tmp/artifacts/
+  test:
+    needs: build
+    if: github.repository == 'apache/cloudstack'
+    runs-on: ubuntu-24.04
     strategy:
       fail-fast: false
       matrix:
@@ -215,30 +250,16 @@ jobs:
                   smoke/test_list_service_offerings
                   smoke/test_list_storage_pools
                   smoke/test_list_volumes"]
-
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+          persist-credentials: false
+      - name: Setup Environment
+        uses: ./.github/actions/setup-env
         with:
-          distribution: 'temurin'
-          java-version: '17'
-          cache: 'maven'
-
-      - name: Set up Python
-        uses: actions/setup-python@v6
-        with:
-          python-version: '3.10'
-          architecture: 'x64'
-
-      - name: Install Build Dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y git uuid-runtime genisoimage netcat-openbsd ipmitool build-essential libgcrypt20 libgpg-error-dev libgpg-error0 libopenipmi0 ipmitool libpython3-dev libssl-dev libffi-dev python3-openssl python3-dev python3-setuptools
-
+          install-python: 'true'
+          install-apt-deps: 'true'
       - name: Setup IPMI Tool for CloudStack
         run: |
           # Create cloudstack-common directory if it doesn't exist
@@ -256,28 +277,13 @@ jobs:
           /usr/share/cloudstack-common/ipmitool -C3 $@
           EOF
           sudo chmod 755 /usr/bin/ipmitool
-
       - name: Install Python dependencies
         run: |
           python3 -m pip install --user --upgrade urllib3 lxml paramiko nose texttable ipmisim pyopenssl pycryptodome mock flask netaddr pylint pycodestyle six astroid pynose
-
       - name: Install jacoco dependencies
         run: |
           wget https://github.com/jacoco/jacoco/releases/download/v0.8.10/jacoco-0.8.10.zip
           unzip jacoco-0.8.10.zip -d jacoco
-
-      - name: Env details
-        run: |
-          uname -a
-          whoami
-          javac -version
-          mvn -v
-          python3 --version
-          free -m
-          nproc
-          git status
-          ipmitool -V
-
       - name: Setup MySQL Server
         run: |
           # https://github.com/actions/runner-images/blob/main/images/linux/Ubuntu2004-Readme.md#mysql
@@ -286,25 +292,28 @@ jobs:
           sudo mysql -uroot -proot -e "ALTER USER 'root'@'localhost' IDENTIFIED WITH caching_sha2_password BY ''; FLUSH PRIVILEGES;"
           sudo systemctl restart mysql
           sudo mysql -uroot -e "SELECT VERSION();"
-
-      - name: Build with Maven
+      - name: Download artifacts
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: build-artifacts
+          path: /tmp/artifacts/
+      - name: Extract artifacts
         run: |
-          mvn -B -P developer,systemvm -Dsimulator clean install -DskipTests=true -T$(nproc)
-
+          tar -xzf /tmp/artifacts/targets.tar.gz
+          mkdir -p ~/.m2/repository
+          tar -xzf /tmp/artifacts/m2-cloudstack.tar.gz -C ~/.m2/repository
       - name: Setup Simulator Prerequisites
         run: |
           sudo python3 -m pip install --upgrade netaddr mysql-connector-python
           python3 -m pip install --user --upgrade tools/marvin/dist/[mM]arvin-*.tar.gz
           mvn -q -Pdeveloper -pl developer -Ddeploydb
           mvn -q -Pdeveloper -pl developer -Ddeploydb-simulator
-
       - name: Generate jacoco-coverage.sh
         run: |
           echo "java -jar jacoco/lib/jacococli.jar report jacoco-it.exec \\" > jacoco-report.sh
           find . | grep "target/classes" | sed 's/\/classes\//\/classes /g' | awk '{print "--classfiles", $1, "\\"}' | sort |uniq >> jacoco-report.sh
           find . | grep "src/main/java" | sed 's/\/java\//\/java /g' | awk '{print "--sourcefiles", $1, "\\"}' | sort | uniq >> jacoco-report.sh
           echo "--xml jacoco-coverage.xml" >> jacoco-report.sh
-
       - name: Start CloudStack Management Server with Simulator
         run: |
           export MAVEN_OPTS="-Xmx4096m -XX:MaxMetaspaceSize=800m -Djava.security.egd=file:/dev/urandom  -javaagent:jacoco/lib/jacocoagent.jar=address=*,port=36320,output=tcpserver --add-opens=java.base/java.lang=ALL-UNNAMED --add-exports=java.base/sun.security.x509=ALL-UNNAMED --add-opens=java.base/jdk.internal.reflect=ALL-UNNAMED"
@@ -315,7 +324,6 @@ jobs:
           set -e
           echo -e "\nStarting Advanced Zone DataCenter deployment"
           python3 tools/marvin/marvin/deployDataCenter.py -i setup/dev/advdualzone.cfg 2>&1 || true
-
       - name: Run Integration Tests with Simulator
         run: |
           mkdir -p integration-test-results/smoke/misc
@@ -335,13 +343,12 @@ jobs:
           bash jacoco-report.sh
           mvn -Dsimulator -pl client jetty:stop 2>&1
           find /tmp//MarvinLogs -type f -exec echo -e "Printing marvin logs {} :\n" \; -exec cat {} \;
-
       - name: Integration Tests Result
         run: |
           echo -e "Simulator CI Test Results: (only failures listed)\n"
           python3 ./tools/marvin/xunit-reader.py integration-test-results/
 
-      - uses: codecov/codecov-action@v6
+      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         with:
           files: jacoco-coverage.xml
           fail_ci_if_error: true
diff --git a/.github/workflows/codecov.yml b/.github/workflows/codecov.yml
deleted file mode 100644
index 0ee10baa385b..000000000000
--- a/.github/workflows/codecov.yml
+++ /dev/null
@@ -1,59 +0,0 @@
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements.  See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership.  The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License.  You may obtain a copy of the License at
-#
-#   http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied.  See the License for the
-# specific language governing permissions and limitations
-# under the License.
-
-name: Coverage Check
-
-on: [pull_request, push]
-
-permissions:
-  contents: read
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  build:
-    if: github.repository == 'apache/cloudstack'
-    name: codecov
-    runs-on: ubuntu-22.04
-    steps:
-      - uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          distribution: 'temurin'
-          java-version: '17'
-          cache: 'maven'
-
-      - name: Build CloudStack with Quality Checks
-        run: |
-          git clone https://github.com/shapeblue/cloudstack-nonoss.git nonoss
-          cd nonoss && bash -x install-non-oss.sh && cd ..
-          mvn -P quality -Dsimulator -Dnoredist clean install -T$(nproc)
-
-      - uses: codecov/codecov-action@v6
-        with:
-          files: ./client/target/site/jacoco-aggregate/jacoco.xml
-          fail_ci_if_error: true
-          flags: unittests
-          verbose: true
-          name: codecov
-          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index cb1fa88a1023..a2d581dcac20 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -35,14 +35,16 @@ jobs:
         language: ["actions"]
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           languages: ${{ matrix.language }}
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           category: "Security"
diff --git a/.github/workflows/daily-repo-status.lock.yml b/.github/workflows/daily-repo-status.lock.yml
index 35eb5d409a48..f8ce13c3cee8 100644
--- a/.github/workflows/daily-repo-status.lock.yml
+++ b/.github/workflows/daily-repo-status.lock.yml
@@ -102,7 +102,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.
         with:
-          persist-credentials:
+          persist-credentials: false
       - name: Create gh-aw temp
         run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir.
       - name: Configure Git
@@ -789,7 +789,7 @@ jobs:
           destination: /opt/gh-aw/
       - name: Download agent output
         continue-on-error:
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6.0.
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: agent-
           path: /tmp/gh-aw/safeoutputs/
@@ -886,13 +886,13 @@ jobs:
           destination: /opt/gh-aw/
       - name: Download agent
         continue-on-error:
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6.0.
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: agent-
           path: /tmp/gh-aw/threat-detection/
       - name: Download agent output
         continue-on-error:
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6.0.
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: agent-
           path: /tmp/gh-aw/threat-detection/
@@ -998,7 +998,7 @@ jobs:
           destination: /opt/gh-aw/
       - name: Download agent output
         continue-on-error:
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v6.0.
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: agent-
           path: /tmp/gh-aw/safeoutputs/
diff --git a/.github/workflows/docker-cloudstack-simulator.yml b/.github/workflows/docker-cloudstack-simulator.yml
index 96c9400935c2..dc00968563d0 100644
--- a/.github/workflows/docker-cloudstack-simulator.yml
+++ b/.github/workflows/docker-cloudstack-simulator.yml
@@ -35,10 +35,10 @@ concurrency:
 jobs:
   build:
     if: github.repository == 'apache/cloudstack'
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Login to Docker Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
           registry: ${{ secrets.DOCKER_REGISTRY }}
           username: ${{ secrets.DOCKERHUB_USER }}
@@ -47,7 +47,9 @@ jobs:
       - name: Set Docker repository name
         run: echo "DOCKER_REPOSITORY=apache" >> $GITHUB_ENV
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set ACS version
         run: echo "ACS_VERSION=$(grep '<version>' pom.xml | head -2 | tail -1 | cut -d'>' -f2 |cut -d'<' -f1)" >> $GITHUB_ENV
diff --git a/.github/workflows/main-sonar-check.yml b/.github/workflows/main-sonar-check.yml
index 7ccd6600ab97..ad58d07a9894 100644
--- a/.github/workflows/main-sonar-check.yml
+++ b/.github/workflows/main-sonar-check.yml
@@ -15,54 +15,51 @@
 # specific language governing permissions and limitations
 # under the License.
 
-name: Main Branch Sonar Quality Check
-
+name: Sonar Quality Check (Main)
+permissions:
+  contents: read
 on:
   push:
     branches:
       - main
-
-permissions:
-  contents: read # to fetch code (actions/checkout)
-  pull-requests: write # for sonar to comment on pull-request
-
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 jobs:
   build:
     if: github.repository == 'apache/cloudstack'
-    name: Main Sonar JaCoCo Build
-    runs-on: ubuntu-22.04
+    name: Sonar JaCoCo Coverage
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-
-      - name: Set up JDK17
-        uses: actions/setup-java@v5
+          persist-credentials: false
+      - name: Setup Environment
+        uses: ./.github/actions/setup-env
         with:
-          distribution: 'temurin'
-          java-version: '17'
-          cache: 'maven'
-
+          install-python: 'true'
+          install-apt-deps: 'true'
       - name: Cache SonarCloud packages
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
-
-      - name: Cache local Maven repository
-        uses: actions/cache@v5
-        with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-m2-${{ hashFiles('pom.xml', '*/pom.xml', '*/*/pom.xml', '*/*/*/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-m2
-
-      - name: Run Tests with Coverage
+      - name: Install Non-OSS
+        uses: ./.github/actions/install-nonoss
+      - name: Run Build and Tests with Coverage
+        run: mvn -B -T$(nproc) -P developer,systemvm,quality -Dsimulator -Dnoredist clean install
+      - name: Upload to SonarQube
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: |
-          git clone https://github.com/shapeblue/cloudstack-nonoss.git nonoss
-          cd nonoss && bash -x install-non-oss.sh && cd ..
-          mvn -T$(nproc) -P quality -Dsimulator -Dnoredist clean install org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack
+        run: mvn -B -P quality org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack -Dsonar.branch.name=${{ github.ref_name }}
+      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        with:
+          files: ./client/target/site/jacoco-aggregate/jacoco.xml
+          fail_ci_if_error: true
+          flags: unittests
+          verbose: true
+          name: codecov
+          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/merge-conflict-checker.yml b/.github/workflows/merge-conflict-checker.yml
index 2c826a47c7ec..f23719f7183a 100644
--- a/.github/workflows/merge-conflict-checker.yml
+++ b/.github/workflows/merge-conflict-checker.yml
@@ -29,14 +29,14 @@ concurrency:
 jobs:
   triage:
     permissions:
-      pull-requests: write  # for eps1lon/actions-label-merge-conflict to label PRs
-    runs-on: ubuntu-22.04
+      pull-requests: write # for eps1lon/actions-label-merge-conflict to label PRs
+    runs-on: ubuntu-24.04
     steps:
-    - name: Conflict Check
-      uses: eps1lon/actions-label-merge-conflict@v3.0.3
-      with:
-        repoToken: "${{ secrets.GITHUB_TOKEN }}"
-        dirtyLabel: "status:has-conflicts"
-        removeOnDirtyLabel: "status:ready-for-review"
-        continueOnMissingPermissions: true
-        commentOnDirty: "This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch."
+      - name: Conflict Check
+        uses: eps1lon/actions-label-merge-conflict@1df065ebe6e3310545d4f4c4e862e43bdca146f0 # v3.0.3
+        with:
+          repoToken: "${{ secrets.GITHUB_TOKEN }}"
+          dirtyLabel: "status:has-conflicts"
+          removeOnDirtyLabel: "status:ready-for-review"
+          continueOnMissingPermissions: true
+          commentOnDirty: "This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch."
diff --git a/.github/workflows/pre-commit.yml b/.github/workflows/pre-commit.yml
index 895a597659de..1ea00be9112f 100644
--- a/.github/workflows/pre-commit.yml
+++ b/.github/workflows/pre-commit.yml
@@ -29,17 +29,23 @@ concurrency:
 jobs:
   pre-commit:
     name: Run pre-commit
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
       - name: Check Out
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
+        with:
+          python-version: '3.11'
+          cache: 'pip'
       - name: Install
-        run: |
-          python -m pip install --upgrade pip
-          pip install pre-commit
+        run: pip install pre-commit
       - name: Set PY
         run: echo "PY=$(python -VV | sha256sum | cut -d' ' -f1)" >> $GITHUB_ENV
-      - uses: actions/cache@v5
+      - name: Cache pre-commit environments
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.cache/pre-commit
           key: pre-commit|${{ env.PY }}|${{ hashFiles('.pre-commit-config.yaml') }}
diff --git a/.github/workflows/rat.yml b/.github/workflows/rat.yml
index 21b8e197d825..a36a956856e7 100644
--- a/.github/workflows/rat.yml
+++ b/.github/workflows/rat.yml
@@ -16,32 +16,27 @@
 # under the License.
 
 name: License Check
-
-on: [push, pull_request]
-
+on:
+  - push
+  - pull_request
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 permissions:
   contents: read
-
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          java-version: '17'
-          distribution: 'adopt'
-          architecture: x64
-          cache: maven
+          persist-credentials: false
+      - name: Setup Environment
+        uses: ./.github/actions/setup-env
+      - name: Install Non-OSS
+        uses: ./.github/actions/install-nonoss
       - name: RAT licence checks
         run: |
-          git clone https://github.com/shapeblue/cloudstack-nonoss.git nonoss && cd nonoss && bash -x install-non-oss.sh && cd ..
-          rm -fr nonoss
           mvn -P developer,systemvm -Dsimulator -Dnoredist -pl . org.apache.rat:apache-rat-plugin:0.12:check
       - name: Rat Report
         if: always()
diff --git a/.github/workflows/sonar-check.yml b/.github/workflows/sonar-check.yml
index 9f5c3a194bc7..49a49d009580 100644
--- a/.github/workflows/sonar-check.yml
+++ b/.github/workflows/sonar-check.yml
@@ -16,58 +16,52 @@
 # under the License.
 
 name: Sonar Quality Check
-
-on: [pull_request]
-
 permissions:
-  contents: read # to fetch code (actions/checkout)
-  pull-requests: write # for sonar to comment on pull-request
-
+  contents: read
+  pull-requests: write
+on:
+  pull_request:
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
-  cancel-in-progress: true
-
+  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 jobs:
   build:
-    if: github.repository == 'apache/cloudstack' && github.event.pull_request.head.repo.full_name == github.repository
     name: Sonar JaCoCo Coverage
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          ref: "refs/pull/${{ github.event.number }}/merge"
           fetch-depth: 0
-
-      - name: Set up JDK17
-        uses: actions/setup-java@v5
+          persist-credentials: false
+      - name: Setup Environment
+        uses: ./.github/actions/setup-env
         with:
-          distribution: 'temurin'
-          java-version: '17'
-          cache: 'maven'
-
+          install-python: 'true'
+          install-apt-deps: 'true'
       - name: Cache SonarCloud packages
-        uses: actions/cache@v5
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/.sonar/cache
           key: ${{ runner.os }}-sonar
           restore-keys: ${{ runner.os }}-sonar
-
-      - name: Cache local Maven repository
-        uses: actions/cache@v5
-        with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-m2-${{ hashFiles('pom.xml', '*/pom.xml', '*/*/pom.xml', '*/*/*/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-m2
-
+      - name: Install Non-OSS
+        uses: ./.github/actions/install-nonoss
       - name: Run Build and Tests with Coverage
-        id: coverage
+        run: mvn -B -T$(nproc) -P developer,systemvm,quality -Dsimulator -Dnoredist clean install
+      - name: Upload to SonarQube
+        if: github.repository == 'apache/cloudstack' && github.event.pull_request.head.repo.full_name == github.repository
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
           PR_ID: ${{ github.event.pull_request.number }}
           HEADREF: ${{ github.event.pull_request.head.ref }}
         run: |
-          git clone https://github.com/shapeblue/cloudstack-nonoss.git nonoss
-          cd nonoss && bash -x install-non-oss.sh && cd ..
-          mvn -T$(nproc) -P quality -Dsimulator -Dnoredist clean install org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack -Dsonar.pullrequest.key="$PR_ID" -Dsonar.pullrequest.branch="$HEADREF" -Dsonar.pullrequest.github.repository=apache/cloudstack -Dsonar.pullrequest.provider=GitHub -Dsonar.pullrequest.github.summary_comment=true
+          mvn -B -P quality org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack -Dsonar.pullrequest.key="$PR_ID" -Dsonar.pullrequest.branch="$HEADREF" -Dsonar.pullrequest.github.repository=apache/cloudstack -Dsonar.pullrequest.provider=GitHub -Dsonar.pullrequest.github.summary_comment=true
+      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+        with:
+          files: ./client/target/site/jacoco-aggregate/jacoco.xml
+          fail_ci_if_error: true
+          flags: unittests
+          verbose: true
+          name: codecov
+          token: ${{ secrets.CODECOV_TOKEN }}
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 842e4497a4ad..5c92f23888e2 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -28,7 +28,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@v10
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           stale-issue-message: 'This issue is stale because it has been open for 120 days with no activity. It may be removed by administrators of this project at any time. Remove the stale label or comment to request for removal of it to prevent this.'
           stale-pr-message: 'This PR is stale because it has been open for 120 days with no activity. It may be removed by administrators of this project at any time. Remove the stale label or comment to request for removal of it to prevent this.'
@@ -41,7 +41,7 @@ jobs:
           days-before-pr-close: 240
           exempt-issue-labels: 'gsoc,good-first-issue,long-term-plan'
           exempt-pr-labels: 'status:ready-for-merge,status:needs-testing,status:on-hold'
-      - uses: actions/stale@v10
+      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
         with:
           stale-issue-label: 'archive'
           days-before-stale: 240
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index 2db8456fcba7..ff27809db8f6 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -28,15 +28,19 @@ permissions:
 
 jobs:
   build:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
 
       - name: Set up Node
-        uses: actions/setup-node@v6
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
         with:
           node-version: 16
+          cache: 'npm'
+          cache-dependency-path: 'ui/package-lock.json'
 
       - name: Env details
         run: |
@@ -55,7 +59,7 @@ jobs:
           npm run lint
           npm run test:unit
 
-      - uses: codecov/codecov-action@v6
+      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
         if: github.repository == 'apache/cloudstack'
         with:
           working-directory: ui

From b16340399baed5faec14bf01b6fb99f40ce63c58 Mon Sep 17 00:00:00 2001
From: dahn <daan.hoogland@gmail.com>
Date: Tue, 26 May 2026 14:59:07 +0200
Subject: [PATCH 50/64] fix: show re-enable 2FA button when is2faenabled is
 null/undefined

After disabling 2FA via setupUserTwoFactorAuthentication, the API may
return is2faenabled as null or undefined rather than boolean false.
The strict equality check (=== false) prevented the "Setup 2FA" button
from appearing in those cases, making it impossible to re-enable 2FA.

Change the check to a falsy check (!record.is2faenabled) so the button
is shown whenever 2FA is not enabled, regardless of whether the value
is false, null, or undefined.

Fixes: https://github.com/apache/cloudstack/issues/13233
---
 ui/src/config/section/user.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/src/config/section/user.js b/ui/src/config/section/user.js
index a298033bd963..eaaca983dc0a 100644
--- a/ui/src/config/section/user.js
+++ b/ui/src/config/section/user.js
@@ -179,7 +179,7 @@ export default {
       dataView: true,
       popup: true,
       show: (record, store) => {
-        return (record.is2faenabled === false && record.id === store.userInfo.id)
+        return (!record.is2faenabled && record.id === store.userInfo.id)
       },
       component: shallowRef(defineAsyncComponent(() => import('@/views/iam/SetupTwoFaAtUserProfile.vue')))
     },

From 7f849e9362f3f8ef521bd1e97d4786d773f8f4f5 Mon Sep 17 00:00:00 2001
From: GaOrtiga <49285692+GaOrtiga@users.noreply.github.com>
Date: Tue, 26 May 2026 10:08:24 -0300
Subject: [PATCH 51/64] add GaOrtiga to colaborators (#13246)

---
 .asf.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.asf.yaml b/.asf.yaml
index d72395af5704..3b2f7691d136 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -56,6 +56,7 @@ github:
     - Imvedansh
     - Damans227
     - jmsperu
+    - GaOrtiga
 
   protected_branches: ~
 

From 3f6866d70a6e4eb8a12dd257d33bde5aae79aacf Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Tue, 26 May 2026 10:36:04 -0300
Subject: [PATCH 52/64] Refactor Quota balance (#12961)

---
 .../apache/cloudstack/api/ApiConstants.java   |   3 +
 .../cloudstack/quota/QuotaManagerImpl.java    |   9 +-
 .../cloudstack/quota/dao/QuotaBalanceDao.java |  10 +-
 .../quota/dao/QuotaBalanceDaoImpl.java        | 187 +++++++-----------
 .../quota/dao/QuotaBalanceDaoImplTest.java    |  91 +++++++++
 .../api/command/QuotaBalanceCmd.java          |  62 +++---
 .../api/response/QuotaBalanceResponse.java    | 132 +++----------
 .../api/response/QuotaResponseBuilder.java    |   7 +-
 .../response/QuotaResponseBuilderImpl.java    | 128 ++----------
 .../apache/cloudstack/quota/QuotaService.java |   2 +-
 .../cloudstack/quota/QuotaServiceImpl.java    | 100 +++++-----
 .../api/command/QuotaBalanceCmdTest.java      |  42 ++--
 .../QuotaResponseBuilderImplTest.java         |  70 ++++---
 .../quota/QuotaServiceImplTest.java           |  95 ++++++---
 .../com/cloud/user/AccountManagerImpl.java    |   8 +-
 .../plugins/quota/test_quota_balance.py       |  49 +++--
 16 files changed, 442 insertions(+), 553 deletions(-)
 create mode 100644 framework/quota/src/test/java/org/apache/cloudstack/quota/dao/QuotaBalanceDaoImplTest.java

diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index 4d4ead277e5d..694830ea2f36 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -69,6 +69,8 @@ public class ApiConstants {
     public static final String BACKUP_VM_OFFERING_REMOVED = "vmbackupofferingremoved";
     public static final String IS_BACKUP_VM_EXPUNGED = "isbackupvmexpunged";
     public static final String BACKUP_TOTAL = "backuptotal";
+    public static final String BALANCE = "balance";
+    public static final String BALANCES = "balances";
     public static final String BASE64_IMAGE = "base64image";
     public static final String BGP_PEERS = "bgppeers";
     public static final String BGP_PEER_IDS = "bgppeerids";
@@ -171,6 +173,7 @@ public class ApiConstants {
     public static final String DATACENTER_NAME = "datacentername";
     public static final String DATADISKS_DETAILS = "datadisksdetails";
     public static final String DATADISK_OFFERING_LIST = "datadiskofferinglist";
+    public static final String DATE = "date";
     public static final String DEFAULT_VALUE = "defaultvalue";
     public static final String DELETE_PROTECTION = "deleteprotection";
     public static final String DESCRIPTION = "description";
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
index 816144aa2f16..58f51eae9fcd 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
@@ -150,8 +150,9 @@ protected void processQuotaBalanceForAccount(AccountVO accountVo, List<QuotaUsag
             return;
         }
 
-        Date startDate = accountQuotaUsages.get(0).getStartDate();
-        Date endDate = accountQuotaUsages.get(0).getEndDate();
+        QuotaUsageVO firstQuotaUsage = accountQuotaUsages.get(0);
+        Date startDate = firstQuotaUsage.getStartDate();
+        Date endDate = firstQuotaUsage.getEndDate();
         Date lastQuotaUsageEndDate = accountQuotaUsages.get(accountQuotaUsages.size() - 1).getEndDate();
 
         LinkedHashSet<Pair<Date, Date>> periods = accountQuotaUsages.stream()
@@ -215,7 +216,7 @@ protected BigDecimal retrieveBalanceForUsageCalculation(long accountId, long dom
             logger.debug(String.format("Persisting the first quota balance [%s] for account [%s].", firstBalance, accountToString));
             _quotaBalanceDao.saveQuotaBalance(firstBalance);
         } else {
-            QuotaBalanceVO lastRealBalance = _quotaBalanceDao.findLastBalanceEntry(accountId, domainId, startDate);
+            QuotaBalanceVO lastRealBalance = _quotaBalanceDao.getLastQuotaBalanceEntry(accountId, domainId, startDate);
 
             if (lastRealBalance == null) {
                 logger.warn("Account [{}] has quota usage entries, however it does not have a quota balance.", accountToString);
@@ -244,7 +245,7 @@ protected void saveQuotaAccount(long accountId, BigDecimal aggregatedUsage, Date
     }
 
     protected BigDecimal aggregateCreditBetweenDates(Long accountId, Long domainId, Date startDate, Date endDate, String accountToString) {
-        List<QuotaBalanceVO> creditsReceived = _quotaBalanceDao.findCreditBalance(accountId, domainId, startDate, endDate);
+        List<QuotaBalanceVO> creditsReceived = _quotaBalanceDao.findCreditBalances(accountId, domainId, startDate, endDate);
         logger.debug("Account [{}] has [{}] credit entries before [{}].", accountToString, creditsReceived.size(),
                 DateUtil.displayDateInTimezone(usageAggregationTimeZone, endDate));
 
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaBalanceDao.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaBalanceDao.java
index c694eaeefbe8..2964746bdf06 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaBalanceDao.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaBalanceDao.java
@@ -28,16 +28,14 @@ public interface QuotaBalanceDao extends GenericDao<QuotaBalanceVO, Long> {
 
     QuotaBalanceVO saveQuotaBalance(QuotaBalanceVO qb);
 
-    List<QuotaBalanceVO> findCreditBalance(Long accountId, Long domainId, Date startDate, Date endDate);
+    List<QuotaBalanceVO> findCreditBalances(Long accountId, Long domainId, Date startDate, Date endDate);
 
-    QuotaBalanceVO findLastBalanceEntry(Long accountId, Long domainId, Date beforeThis);
+    QuotaBalanceVO getLastQuotaBalanceEntry(Long accountId, Long domainId, Date beforeThis);
 
     QuotaBalanceVO findLaterBalanceEntry(Long accountId, Long domainId, Date afterThis);
 
-    List<QuotaBalanceVO> findQuotaBalance(Long accountId, Long domainId, Date startDate, Date endDate);
+    List<QuotaBalanceVO> listQuotaBalances(Long accountId, Long domainId, Date startDate, Date endDate);
 
-    List<QuotaBalanceVO> lastQuotaBalanceVO(Long accountId, Long domainId, Date startDate);
-
-    BigDecimal lastQuotaBalance(Long accountId, Long domainId, Date startDate);
+    BigDecimal getLastQuotaBalance(Long accountId, Long domainId);
 
 }
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaBalanceDaoImpl.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaBalanceDaoImpl.java
index 01272d1a6184..21553ebd27b0 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaBalanceDaoImpl.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaBalanceDaoImpl.java
@@ -18,11 +18,14 @@
 
 import java.math.BigDecimal;
 import java.util.ArrayList;
-import java.util.Collections;
 import java.util.Date;
 import java.util.List;
 
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.commons.lang3.time.DateUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.springframework.stereotype.Component;
 
 import com.cloud.utils.db.Filter;
@@ -32,160 +35,104 @@
 import com.cloud.utils.db.Transaction;
 import com.cloud.utils.db.TransactionCallback;
 import com.cloud.utils.db.TransactionLegacy;
-import com.cloud.utils.db.TransactionStatus;
 
 @Component
 public class QuotaBalanceDaoImpl extends GenericDaoBase<QuotaBalanceVO, Long> implements QuotaBalanceDao {
+    private static final Logger logger = LogManager.getLogger(QuotaBalanceDaoImpl.class);
 
     @Override
-    public QuotaBalanceVO findLastBalanceEntry(final Long accountId, final Long domainId, final Date beforeThis) {
-        return Transaction.execute(TransactionLegacy.USAGE_DB, new TransactionCallback<QuotaBalanceVO>() {
-            @Override
-            public QuotaBalanceVO doInTransaction(final TransactionStatus status) {
-                List<QuotaBalanceVO> quotaBalanceEntries = new ArrayList<>();
-                Filter filter = new Filter(QuotaBalanceVO.class, "updatedOn", false, 0L, 1L);
-                QueryBuilder<QuotaBalanceVO> qb = QueryBuilder.create(QuotaBalanceVO.class);
-                qb.and(qb.entity().getAccountId(), SearchCriteria.Op.EQ, accountId);
-                qb.and(qb.entity().getDomainId(), SearchCriteria.Op.EQ, domainId);
-                qb.and(qb.entity().getCreditsId(), SearchCriteria.Op.EQ, 0);
+    public QuotaBalanceVO getLastQuotaBalanceEntry(final Long accountId, final Long domainId, final Date beforeThis) {
+        return Transaction.execute(TransactionLegacy.USAGE_DB, (TransactionCallback<QuotaBalanceVO>) status -> {
+            Filter filter = new Filter(QuotaBalanceVO.class, "updatedOn", false, 0L, 1L);
+            QueryBuilder<QuotaBalanceVO> qb = getQuotaBalanceQueryBuilder(accountId, domainId);
+            qb.and(qb.entity().getCreditsId(), SearchCriteria.Op.EQ, 0);
+
+            if (beforeThis != null) {
                 qb.and(qb.entity().getUpdatedOn(), SearchCriteria.Op.LT, beforeThis);
-                quotaBalanceEntries = search(qb.create(), filter);
-                return !quotaBalanceEntries.isEmpty() ? quotaBalanceEntries.get(0) : null;
             }
+
+            List<QuotaBalanceVO> quotaBalanceEntries = search(qb.create(), filter);
+            return !quotaBalanceEntries.isEmpty() ? quotaBalanceEntries.get(0) : null;
         });
     }
 
     @Override
     public QuotaBalanceVO findLaterBalanceEntry(final Long accountId, final Long domainId, final Date afterThis) {
-        return Transaction.execute(TransactionLegacy.USAGE_DB, new TransactionCallback<QuotaBalanceVO>() {
-            @Override
-            public QuotaBalanceVO doInTransaction(final TransactionStatus status) {
-                List<QuotaBalanceVO> quotaBalanceEntries = new ArrayList<>();
-                Filter filter = new Filter(QuotaBalanceVO.class, "updatedOn", true, 0L, 1L);
-                QueryBuilder<QuotaBalanceVO> qb = QueryBuilder.create(QuotaBalanceVO.class);
-                qb.and(qb.entity().getAccountId(), SearchCriteria.Op.EQ, accountId);
-                qb.and(qb.entity().getDomainId(), SearchCriteria.Op.EQ, domainId);
-                qb.and(qb.entity().getCreditsId(), SearchCriteria.Op.EQ, 0);
-                qb.and(qb.entity().getUpdatedOn(), SearchCriteria.Op.GT, afterThis);
-                quotaBalanceEntries = search(qb.create(), filter);
-                return quotaBalanceEntries.size() > 0 ? quotaBalanceEntries.get(0) : null;
-            }
+        return Transaction.execute(TransactionLegacy.USAGE_DB, (TransactionCallback<QuotaBalanceVO>) status -> {
+            Filter filter = new Filter(QuotaBalanceVO.class, "updatedOn", true, 0L, 1L);
+            QueryBuilder<QuotaBalanceVO> qb = getQuotaBalanceQueryBuilder(accountId, domainId);
+            qb.and(qb.entity().getCreditsId(), SearchCriteria.Op.EQ, 0);
+            qb.and(qb.entity().getUpdatedOn(), SearchCriteria.Op.GT, afterThis);
+
+            List<QuotaBalanceVO> quotaBalanceEntries = search(qb.create(), filter);
+            return !quotaBalanceEntries.isEmpty() ? quotaBalanceEntries.get(0) : null;
         });
     }
 
     @Override
     public QuotaBalanceVO saveQuotaBalance(final QuotaBalanceVO qb) {
-        return Transaction.execute(TransactionLegacy.USAGE_DB, new TransactionCallback<QuotaBalanceVO>() {
-            @Override
-            public QuotaBalanceVO doInTransaction(final TransactionStatus status) {
-                return persist(qb);
-            }
-        });
+        return Transaction.execute(TransactionLegacy.USAGE_DB, (TransactionCallback<QuotaBalanceVO>) status -> persist(qb));
     }
 
     @Override
-    public List<QuotaBalanceVO> findCreditBalance(final Long accountId, final Long domainId, final Date lastbalancedate, final Date beforeThis) {
-        return Transaction.execute(TransactionLegacy.USAGE_DB, new TransactionCallback<List<QuotaBalanceVO>>() {
-            @Override
-            public List<QuotaBalanceVO> doInTransaction(final TransactionStatus status) {
-                if ((lastbalancedate != null) && (beforeThis != null) && lastbalancedate.before(beforeThis)) {
-                    Filter filter = new Filter(QuotaBalanceVO.class, "updatedOn", true, 0L, Long.MAX_VALUE);
-                    QueryBuilder<QuotaBalanceVO> qb = QueryBuilder.create(QuotaBalanceVO.class);
-                    qb.and(qb.entity().getAccountId(), SearchCriteria.Op.EQ, accountId);
-                    qb.and(qb.entity().getDomainId(), SearchCriteria.Op.EQ, domainId);
-                    qb.and(qb.entity().getCreditsId(), SearchCriteria.Op.GT, 0);
-                    qb.and(qb.entity().getUpdatedOn(), SearchCriteria.Op.BETWEEN, lastbalancedate, beforeThis);
-                    return search(qb.create(), filter);
-                } else {
-                    return new ArrayList<QuotaBalanceVO>();
-                }
+    public List<QuotaBalanceVO> findCreditBalances(final Long accountId, final Long domainId, final Date startDate, final Date endDate) {
+        return Transaction.execute(TransactionLegacy.USAGE_DB, (TransactionCallback<List<QuotaBalanceVO>>) status -> {
+            if (ObjectUtils.anyNull(startDate, endDate) || startDate.after(endDate)) {
+                return new ArrayList<>();
             }
-        });
-    }
 
-    @Override
-    public List<QuotaBalanceVO> findQuotaBalance(final Long accountId, final Long domainId, final Date startDate, final Date endDate) {
-        return Transaction.execute(TransactionLegacy.USAGE_DB, new TransactionCallback<List<QuotaBalanceVO>>() {
-            @Override
-            public List<QuotaBalanceVO> doInTransaction(final TransactionStatus status) {
-                List<QuotaBalanceVO> quotaUsageRecords = null;
-                QueryBuilder<QuotaBalanceVO> qb = QueryBuilder.create(QuotaBalanceVO.class);
-                if (accountId != null) {
-                    qb.and(qb.entity().getAccountId(), SearchCriteria.Op.EQ, accountId);
-                }
-                if (domainId != null) {
-                    qb.and(qb.entity().getDomainId(), SearchCriteria.Op.EQ, domainId);
-                }
-                if ((startDate != null) && (endDate != null) && startDate.before(endDate)) {
-                    qb.and(qb.entity().getUpdatedOn(), SearchCriteria.Op.BETWEEN, startDate, endDate);
-                } else {
-                    return Collections.<QuotaBalanceVO> emptyList();
-                }
-                quotaUsageRecords = listBy(qb.create());
-                if (quotaUsageRecords.size() == 0) {
-                    quotaUsageRecords.addAll(lastQuotaBalanceVO(accountId, domainId, startDate));
-                }
-                return quotaUsageRecords;
+            Filter filter = new Filter(QuotaBalanceVO.class, "updatedOn", true, 0L, Long.MAX_VALUE);
+            QueryBuilder<QuotaBalanceVO> qb = getQuotaBalanceQueryBuilder(accountId, domainId);
+            qb.and(qb.entity().getCreditsId(), SearchCriteria.Op.GT, 0);
+            qb.and(qb.entity().getUpdatedOn(), SearchCriteria.Op.BETWEEN, startDate, endDate);
 
-            }
+            return search(qb.create(), filter);
         });
-
     }
 
     @Override
-    public List<QuotaBalanceVO> lastQuotaBalanceVO(final Long accountId, final Long domainId, final Date pivotDate) {
-        return Transaction.execute(TransactionLegacy.USAGE_DB, new TransactionCallback<List<QuotaBalanceVO>>() {
-            @Override
-            public List<QuotaBalanceVO> doInTransaction(final TransactionStatus status) {
-                List<QuotaBalanceVO> quotaUsageRecords = null;
-                List<QuotaBalanceVO> trimmedRecords = new ArrayList<QuotaBalanceVO>();
-                Filter filter = new Filter(QuotaBalanceVO.class, "updatedOn", false, 0L, 100L);
-                // ASSUMPTION there will be less than 100 continuous credit
-                // transactions
-                QueryBuilder<QuotaBalanceVO> qb = QueryBuilder.create(QuotaBalanceVO.class);
-                if (accountId != null) {
-                    qb.and(qb.entity().getAccountId(), SearchCriteria.Op.EQ, accountId);
-                }
-                if (domainId != null) {
-                    qb.and(qb.entity().getDomainId(), SearchCriteria.Op.EQ, domainId);
-                }
-                if ((pivotDate != null)) {
-                    qb.and(qb.entity().getUpdatedOn(), SearchCriteria.Op.LTEQ, pivotDate);
-                }
-                quotaUsageRecords = search(qb.create(), filter);
-
-                // get records before startDate to find start balance
-                for (QuotaBalanceVO entry : quotaUsageRecords) {
-                    if (logger.isDebugEnabled()) {
-                        logger.debug("FindQuotaBalance Entry=" + entry);
-                    }
-                    if (entry.getCreditsId() > 0) {
-                        trimmedRecords.add(entry);
-                    } else {
-                        trimmedRecords.add(entry);
-                        break; // add only consecutive credit entries and last balance entry
-                    }
-                }
-                return trimmedRecords;
+    public List<QuotaBalanceVO> listQuotaBalances(final Long accountId, final Long domainId, final Date startDate, final Date endDate) {
+        return Transaction.execute(TransactionLegacy.USAGE_DB, (TransactionCallback<List<QuotaBalanceVO>>) status -> {
+            QueryBuilder<QuotaBalanceVO> qb = getQuotaBalanceQueryBuilder(accountId, domainId);
+            qb.and(qb.entity().getCreditsId(), SearchCriteria.Op.EQ, 0);
+            if (startDate != null) {
+                qb.and(qb.entity().getUpdatedOn(), SearchCriteria.Op.GTEQ, startDate);
+            }
+            if (endDate != null) {
+                qb.and(qb.entity().getUpdatedOn(), SearchCriteria.Op.LTEQ, endDate);
             }
+
+            Filter filter = new Filter(QuotaBalanceVO.class, "updatedOn", true);
+            return listBy(qb.create(), filter);
         });
     }
 
     @Override
-    public BigDecimal lastQuotaBalance(final Long accountId, final Long domainId, Date startDate) {
-        List<QuotaBalanceVO> quotaBalance = lastQuotaBalanceVO(accountId, domainId, startDate);
-        BigDecimal finalBalance = new BigDecimal(0);
-        if (quotaBalance.isEmpty()) {
-            logger.info("There are no balance entries on or before the requested date.");
-            return finalBalance;
+    public BigDecimal getLastQuotaBalance(final Long accountId, final Long domainId) {
+        QuotaBalanceVO quotaBalance = getLastQuotaBalanceEntry(accountId, domainId, null);
+        BigDecimal finalBalance = BigDecimal.ZERO;
+        Date startDate = DateUtils.addDays(new Date(), -1);
+        if (quotaBalance == null) {
+            logger.info("There are no balance entries for account [{}] and domain [{}]. Considering only new added credits.", accountId, domainId);
+        } else {
+            finalBalance = quotaBalance.getCreditBalance();
+            startDate = quotaBalance.getUpdatedOn();
         }
-        for (QuotaBalanceVO entry : quotaBalance) {
-            if (logger.isDebugEnabled()) {
-                logger.debug("lastQuotaBalance Entry=" + entry);
-            }
-            finalBalance = finalBalance.add(entry.getCreditBalance());
+
+        List<QuotaBalanceVO> credits = findCreditBalances(accountId, domainId, startDate, new Date());
+
+        for (QuotaBalanceVO credit : credits) {
+            finalBalance = finalBalance.add(credit.getCreditBalance());
         }
+
         return finalBalance;
     }
 
+    private QueryBuilder<QuotaBalanceVO> getQuotaBalanceQueryBuilder(Long accountId, Long domainId) {
+        QueryBuilder<QuotaBalanceVO> qb = QueryBuilder.create(QuotaBalanceVO.class);
+        qb.and(qb.entity().getAccountId(), SearchCriteria.Op.EQ, accountId);
+        qb.and(qb.entity().getDomainId(), SearchCriteria.Op.EQ, domainId);
+        return qb;
+    }
+
 }
diff --git a/framework/quota/src/test/java/org/apache/cloudstack/quota/dao/QuotaBalanceDaoImplTest.java b/framework/quota/src/test/java/org/apache/cloudstack/quota/dao/QuotaBalanceDaoImplTest.java
new file mode 100644
index 000000000000..afdd88f8d1da
--- /dev/null
+++ b/framework/quota/src/test/java/org/apache/cloudstack/quota/dao/QuotaBalanceDaoImplTest.java
@@ -0,0 +1,91 @@
+
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.quota.dao;
+
+import java.math.BigDecimal;
+import java.util.ArrayList;
+import java.util.Arrays;
+
+import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
+import org.junit.Assert;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+@RunWith(MockitoJUnitRunner.class)
+public class QuotaBalanceDaoImplTest {
+    QuotaBalanceDaoImpl quotaBalanceDaoImplSpy = Mockito.spy(QuotaBalanceDaoImpl.class);
+
+    @Mock
+    QuotaBalanceVO quotaBalanceVoMock;
+
+    @Test
+    public void getLastQuotaBalanceTestLastEntryIsNullAndNoCreditsReturnsZero() {
+        Mockito.doReturn(null).when(quotaBalanceDaoImplSpy).getLastQuotaBalanceEntry(Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
+        Mockito.doReturn(new ArrayList<>()).when(quotaBalanceDaoImplSpy).findCreditBalances(Mockito.anyLong(), Mockito.anyLong(), Mockito.any(), Mockito.any());
+
+        BigDecimal result = quotaBalanceDaoImplSpy.getLastQuotaBalance(1L, 2L);
+
+        Assert.assertEquals(BigDecimal.ZERO, result);
+    }
+
+    @Test
+    public void getLastQuotaBalanceTestReturnsLastEntryAndNoCredits() {
+        BigDecimal expected = BigDecimal.valueOf(-1542.46);
+        Mockito.doReturn(quotaBalanceVoMock).when(quotaBalanceDaoImplSpy).getLastQuotaBalanceEntry(Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
+        Mockito.doReturn(expected).when(quotaBalanceVoMock).getCreditBalance();
+        Mockito.doReturn(new ArrayList<>()).when(quotaBalanceDaoImplSpy).findCreditBalances(Mockito.anyLong(), Mockito.anyLong(), Mockito.any(), Mockito.any());
+
+        BigDecimal result = quotaBalanceDaoImplSpy.getLastQuotaBalance(5L, 8L);
+
+        Assert.assertEquals(expected, result);
+    }
+
+    @Test
+    public void getLastQuotaBalanceTestReturnsLastEntryPlusCredits() {
+        BigDecimal balance = BigDecimal.valueOf(-1542.46);
+        BigDecimal credit1 = new BigDecimal("150.14");
+        BigDecimal credit2 = new BigDecimal("78.96");
+        BigDecimal expected = balance.add(credit1).add(credit2);
+
+        Mockito.doReturn(quotaBalanceVoMock).when(quotaBalanceDaoImplSpy).getLastQuotaBalanceEntry(Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
+        Mockito.doReturn(balance, credit1, credit2).when(quotaBalanceVoMock).getCreditBalance();
+        Mockito.doReturn(Arrays.asList(quotaBalanceVoMock, quotaBalanceVoMock)).when(quotaBalanceDaoImplSpy).findCreditBalances(Mockito.anyLong(), Mockito.anyLong(), Mockito.any(), Mockito.any());
+
+        BigDecimal result = quotaBalanceDaoImplSpy.getLastQuotaBalance(5L, 8L);
+
+        Assert.assertEquals(expected, result);
+    }
+
+    @Test
+    public void getLastQuotaBalanceTestReturnsLastEntryIsNullPlusCredits() {
+        BigDecimal credit1 = new BigDecimal("150.14");
+        BigDecimal credit2 = new BigDecimal("78.96");
+        BigDecimal expected = credit1.add(credit2);
+
+        Mockito.doReturn(null).when(quotaBalanceDaoImplSpy).getLastQuotaBalanceEntry(Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
+        Mockito.doReturn(credit1, credit2).when(quotaBalanceVoMock).getCreditBalance();
+        Mockito.doReturn(Arrays.asList(quotaBalanceVoMock, quotaBalanceVoMock)).when(quotaBalanceDaoImplSpy).findCreditBalances(Mockito.anyLong(), Mockito.anyLong(), Mockito.any(), Mockito.any());
+
+        BigDecimal result = quotaBalanceDaoImplSpy.getLastQuotaBalance(5L, 8L);
+
+        Assert.assertEquals(expected, result);
+    }
+}
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaBalanceCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaBalanceCmd.java
index 0cec0df66182..e5c89c5de1c5 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaBalanceCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaBalanceCmd.java
@@ -17,12 +17,9 @@
 package org.apache.cloudstack.api.command;
 
 import java.util.Date;
-import java.util.List;
 
 import javax.inject.Inject;
 
-import com.cloud.user.Account;
-
 import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
@@ -30,36 +27,41 @@
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.DomainResponse;
+import org.apache.cloudstack.api.response.ProjectResponse;
 import org.apache.cloudstack.api.response.QuotaBalanceResponse;
 import org.apache.cloudstack.api.response.QuotaResponseBuilder;
-import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
-import org.apache.cloudstack.api.response.QuotaStatementItemResponse;
+import org.apache.commons.lang3.ObjectUtils;
 
-@APICommand(name = "quotaBalance", responseObject = QuotaStatementItemResponse.class, description = "Create a quota balance statement", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
+@APICommand(name = "quotaBalance", responseObject = QuotaBalanceResponse.class, description = "Create Quota balance statements for the provided Accounts or Projects.", since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false,
         httpMethod = "GET")
 public class QuotaBalanceCmd extends BaseCmd {
 
-
-
-    @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING, required = true, description = "Account Id for which statement needs to be generated")
+    @ACL
+    @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING, description = "Name of the Account for which balance statements will be generated. " +
+            "Deprecated, please use 'accountid' instead.")
     private String accountName;
 
     @ACL
-    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, required = true, entityType = DomainResponse.class, description = "If domain Id is given and the caller is domain admin then the statement is generated for domain.")
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class, description = "ID of the domain which the Account identified by 'account' belongs to." +
+            "Deprecated, please use 'accountid' instead.")
     private Long domainId;
 
-    @Parameter(name = ApiConstants.END_DATE, type = CommandType.DATE, description = "End of the period of the Quota balance." +
-            ApiConstants.PARAMETER_DESCRIPTION_END_DATE_POSSIBLE_FORMATS)
+    @Parameter(name = ApiConstants.END_DATE, type = CommandType.DATE, description = "Date of the last Quota balance to be returned. Must be informed together with the " +
+            "startdate parameter, and can not be before startdate. " + ApiConstants.PARAMETER_DESCRIPTION_END_DATE_POSSIBLE_FORMATS)
     private Date endDate;
 
-    @Parameter(name = ApiConstants.START_DATE, type = CommandType.DATE, description = "Start of the period of the Quota balance. " +
+    @Parameter(name = ApiConstants.START_DATE, type = CommandType.DATE, description = "Date of the first Quota balance to be returned. Must be before today. " +
             ApiConstants.PARAMETER_DESCRIPTION_START_DATE_POSSIBLE_FORMATS)
     private Date startDate;
 
     @ACL
-    @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class, description = "List usage records for the specified Account")
+    @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class, description = "ID of the Account for which balance statements will be generated.")
     private Long accountId;
 
+    @ACL
+    @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class, description = "ID of the Project for which balance statements will be generated. Can not be specified with accountid.")
+    private Long projectId;
+
     @Inject
     QuotaResponseBuilder _responseBuilder;
 
@@ -88,48 +90,32 @@ public void setDomainId(Long domainId) {
     }
 
     public Date getEndDate() {
-        if (endDate == null){
-            return null;
-        }
-        else{
-            return _responseBuilder.startOfNextDay(new Date(endDate.getTime()));
-        }
+        return endDate;
     }
 
     public void setEndDate(Date endDate) {
-        this.endDate = endDate == null ? null : new Date(endDate.getTime());
+        this.endDate = endDate;
     }
 
     public Date getStartDate() {
-        return startDate == null ? null : new Date(startDate.getTime());
+        return startDate;
     }
 
     public void setStartDate(Date startDate) {
-        this.startDate = startDate == null ? null : new Date(startDate.getTime());
+        this.startDate = startDate;
     }
 
     @Override
     public long getEntityOwnerId() {
-        if (accountId != null) {
-            return accountId;
-        }
-        Account account = _accountService.getActiveAccountByName(accountName, domainId);
-        if (account != null) {
-            return account.getAccountId();
+        if (ObjectUtils.allNull(accountId, accountName, domainId, projectId)) {
+            return -1;
         }
-        return Account.ACCOUNT_ID_SYSTEM;
+        return _accountService.finalizeAccountId(accountId, accountName, domainId, projectId);
     }
 
     @Override
     public void execute() {
-        List<QuotaBalanceVO> quotaUsage = _responseBuilder.getQuotaBalance(this);
-
-        QuotaBalanceResponse response;
-        if (endDate == null) {
-            response = _responseBuilder.createQuotaLastBalanceResponse(quotaUsage, getStartDate());
-        } else {
-            response = _responseBuilder.createQuotaBalanceResponse(quotaUsage, getStartDate(), new Date(endDate.getTime()));
-        }
+        QuotaBalanceResponse response = _responseBuilder.createQuotaBalanceResponse(this);
         response.setResponseName(getCommandName());
         setResponseObject(response);
     }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaBalanceResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaBalanceResponse.java
index 625f4829c673..714066b048ad 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaBalanceResponse.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaBalanceResponse.java
@@ -17,137 +17,65 @@
 package org.apache.cloudstack.api.response;
 
 import java.math.BigDecimal;
-import java.math.RoundingMode;
-import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
 
 import com.google.gson.annotations.SerializedName;
 
+import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseResponse;
-import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
 
 import com.cloud.serializer.Param;
 
 public class QuotaBalanceResponse extends BaseResponse {
 
-    @SerializedName("accountid")
-    @Param(description = "Account ID")
-    private Long accountId;
-
-    @SerializedName("account")
-    @Param(description = "Account name")
-    private String accountName;
-
-    @SerializedName("domain")
-    @Param(description = "Domain ID")
-    private Long domainId;
-
-    @SerializedName("startquota")
-    @Param(description = "Quota started with")
-    private BigDecimal startQuota;
-
-    @SerializedName("endquota")
-    @Param(description = "Quota by end of this period")
-    private BigDecimal endQuota;
-
-    @SerializedName("credits")
-    @Param(description = "List of credits made during this period")
-    private List<QuotaCreditsResponse> credits = null;
-
-    @SerializedName("startdate")
-    @Param(description = "Start date")
-    private Date startDate = null;
-
-    @SerializedName("enddate")
-    @Param(description = "End date")
-    private Date endDate = null;
-
-    @SerializedName("currency")
-    @Param(description = "Currency")
+    @SerializedName(ApiConstants.CURRENCY)
+    @Param(description = "Balance's currency.")
     private String currency;
 
-    public QuotaBalanceResponse() {
-        super();
-        credits = new ArrayList<QuotaCreditsResponse>();
-    }
-
-    public Long getAccountId() {
-        return accountId;
-    }
-
-    public void setAccountId(Long accountId) {
-        this.accountId = accountId;
-    }
-
-    public String getAccountName() {
-        return accountName;
-    }
+    @SerializedName(ApiConstants.DATE)
+    @Param(description = "Balance's date.")
+    private Date date;
 
-    public void setAccountName(String accountName) {
-        this.accountName = accountName;
-    }
+    @SerializedName(ApiConstants.BALANCE)
+    @Param(description = "Balance's value.")
+    private BigDecimal balance;
 
-    public Long getDomainId() {
-        return domainId;
-    }
-
-    public void setDomainId(Long domainId) {
-        this.domainId = domainId;
-    }
+    @SerializedName(ApiConstants.BALANCES)
+    @Param(description = "List of balances in the period.")
+    private List<QuotaBalanceResponse> balances;
 
-    public BigDecimal getStartQuota() {
-        return startQuota;
-    }
-
-    public void setStartQuota(BigDecimal startQuota) {
-        this.startQuota = startQuota.setScale(2, RoundingMode.HALF_EVEN);
-    }
-
-    public BigDecimal getEndQuota() {
-        return endQuota;
-    }
-
-    public void setEndQuota(BigDecimal endQuota) {
-        this.endQuota = endQuota.setScale(2, RoundingMode.HALF_EVEN);
-    }
-
-    public List<QuotaCreditsResponse> getCredits() {
-        return credits;
-    }
-
-    public void setCredits(List<QuotaCreditsResponse> credits) {
-        this.credits = credits;
+    public QuotaBalanceResponse() {
+        super("balance");
     }
 
-    public void addCredits(QuotaBalanceVO credit) {
-        QuotaCreditsResponse cr = new QuotaCreditsResponse();
-        cr.setCredit(credit.getCreditBalance());
-        cr.setCreditedOn(credit.getUpdatedOn());
-        credits.add(0, cr);
+    public QuotaBalanceResponse(Date date, BigDecimal balance) {
+        super("balance");
+        this.date = date;
+        this.balance = balance;
     }
 
-    public Date getStartDate() {
-        return startDate == null ? null : new Date(startDate.getTime());
+    public void setCurrency(String currency) {
+        this.currency = currency;
     }
 
-    public void setStartDate(Date startDate) {
-        this.startDate = startDate == null ? null : new Date(startDate.getTime());
+    public void setBalances(List<QuotaBalanceResponse> balances) {
+        this.balances = balances;
     }
 
-    public Date getEndDate() {
-        return endDate == null ? null : new Date(endDate.getTime());
+    public String getCurrency() {
+        return currency;
     }
 
-    public void setEndDate(Date endDate) {
-        this.endDate = endDate == null ? null : new Date(endDate.getTime());
+    public List<QuotaBalanceResponse> getBalances() {
+        return balances;
     }
 
-    public String getCurrency() {
-        return currency;
+    public Date getDate() {
+        return date;
     }
 
-    public void setCurrency(String currency) {
-        this.currency = currency;
+    public BigDecimal getBalance() {
+        return balance;
     }
 }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
index bde905c487b7..f0390bf626d0 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
@@ -29,7 +29,6 @@
 import org.apache.cloudstack.api.command.QuotaTariffListCmd;
 import org.apache.cloudstack.api.command.QuotaTariffUpdateCmd;
 import org.apache.cloudstack.api.command.QuotaValidateActivationRuleCmd;
-import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
 import org.apache.cloudstack.quota.vo.QuotaEmailConfigurationVO;
 import org.apache.cloudstack.quota.vo.QuotaTariffVO;
 
@@ -50,14 +49,10 @@ public interface QuotaResponseBuilder {
 
     QuotaStatementResponse createQuotaStatementResponse(QuotaStatementCmd cmd);
 
-    QuotaBalanceResponse createQuotaBalanceResponse(List<QuotaBalanceVO> quotaUsage, Date startDate, Date endDate);
+    QuotaBalanceResponse createQuotaBalanceResponse(QuotaBalanceCmd cmd);
 
     Pair<List<QuotaSummaryResponse>, Integer> createQuotaSummaryResponse(QuotaSummaryCmd cmd);
 
-    QuotaBalanceResponse createQuotaLastBalanceResponse(List<QuotaBalanceVO> quotaBalance, Date startDate);
-
-    List<QuotaBalanceVO> getQuotaBalance(QuotaBalanceCmd cmd);
-
     QuotaCreditsResponse addQuotaCredits(Long accountId, Long domainId, Double amount, Long updatedBy, Boolean enforce);
 
     List<QuotaEmailTemplateResponse> listQuotaEmailTemplates(QuotaEmailTemplateListCmd cmd);
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
index c919bb5887c1..231ba777e600 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
@@ -26,13 +26,10 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Calendar;
-import java.util.Collections;
 import java.util.Comparator;
 import java.util.Date;
 import java.util.HashMap;
-import java.util.Iterator;
 import java.util.List;
-import java.util.ListIterator;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
@@ -329,93 +326,18 @@ public boolean isUserAllowedToSeeActivationRules(User user) {
     }
 
     @Override
-    public QuotaBalanceResponse createQuotaBalanceResponse(List<QuotaBalanceVO> quotaBalance, Date startDate, Date endDate) {
-        if (quotaBalance == null || quotaBalance.isEmpty()) {
-            throw new InvalidParameterValueException("The request period does not contain balance entries.");
-        }
-        Collections.sort(quotaBalance, new Comparator<QuotaBalanceVO>() {
-            @Override
-            public int compare(QuotaBalanceVO o1, QuotaBalanceVO o2) {
-                o1 = o1 == null ? new QuotaBalanceVO() : o1;
-                o2 = o2 == null ? new QuotaBalanceVO() : o2;
-                return o2.getUpdatedOn().compareTo(o1.getUpdatedOn()); // desc
-            }
-        });
-
-        boolean have_balance_entries = false;
-        //check that there is at least one balance entry
-        for (Iterator<QuotaBalanceVO> it = quotaBalance.iterator(); it.hasNext();) {
-            QuotaBalanceVO entry = it.next();
-            if (entry.isBalanceEntry()) {
-                have_balance_entries = true;
-                break;
-            }
-        }
-        //if last entry is a credit deposit then remove that as that is already
-        //accounted for in the starting balance after that entry, note the sort is desc
-        if (have_balance_entries) {
-            ListIterator<QuotaBalanceVO> li = quotaBalance.listIterator(quotaBalance.size());
-            // Iterate in reverse.
-            while (li.hasPrevious()) {
-                QuotaBalanceVO entry = li.previous();
-                if (logger.isDebugEnabled()) {
-                    logger.debug("createQuotaBalanceResponse: Entry=" + entry);
-                }
-                if (entry.getCreditsId() > 0) {
-                    li.remove();
-                } else {
-                    break;
-                }
-            }
-        }
+    public QuotaBalanceResponse createQuotaBalanceResponse(QuotaBalanceCmd cmd) {
+        List<QuotaBalanceVO> quotaBalances = _quotaService.listQuotaBalancesForAccount(cmd.getEntityOwnerId(), cmd.getStartDate(), cmd.getEndDate());
 
-        int quota_activity = quotaBalance.size();
-        QuotaBalanceResponse resp = new QuotaBalanceResponse();
-        BigDecimal lastCredits = new BigDecimal(0);
-        boolean consecutive = true;
-        for (Iterator<QuotaBalanceVO> it = quotaBalance.iterator(); it.hasNext();) {
-            QuotaBalanceVO entry = it.next();
-            if (logger.isDebugEnabled()) {
-                logger.debug("createQuotaBalanceResponse: All Credit Entry=" + entry);
-            }
-            if (entry.getCreditsId() > 0) {
-                if (consecutive) {
-                    lastCredits = lastCredits.add(entry.getCreditBalance());
-                }
-                resp.addCredits(entry);
-                it.remove();
-            } else {
-                consecutive = false;
-            }
-        }
+        List<QuotaBalanceResponse> balances = quotaBalances.stream()
+                .map(balance -> new QuotaBalanceResponse(balance.getUpdatedOn(), balance.getCreditBalance()))
+                .collect(Collectors.toList());
 
-        if (quota_activity > 0 && quotaBalance.size() > 0) {
-            // order is desc last item is the start item
-            QuotaBalanceVO startItem = quotaBalance.get(quotaBalance.size() - 1);
-            QuotaBalanceVO endItem = quotaBalance.get(0);
-            resp.setStartDate(startDate);
-            resp.setStartQuota(startItem.getCreditBalance());
-            resp.setEndDate(endDate);
-            if (logger.isDebugEnabled()) {
-                logger.debug("createQuotaBalanceResponse: Start Entry=" + startItem);
-                logger.debug("createQuotaBalanceResponse: End Entry=" + endItem);
-            }
-            resp.setEndQuota(endItem.getCreditBalance().add(lastCredits));
-        } else if (quota_activity > 0) {
-            // order is desc last item is the start item
-            resp.setStartDate(startDate);
-            resp.setStartQuota(new BigDecimal(0));
-            resp.setEndDate(endDate);
-            resp.setEndQuota(new BigDecimal(0).add(lastCredits));
-        } else {
-            resp.setStartDate(startDate);
-            resp.setEndDate(endDate);
-            resp.setStartQuota(new BigDecimal(0));
-            resp.setEndQuota(new BigDecimal(0));
-        }
-        resp.setCurrency(QuotaConfig.QuotaCurrencySymbol.value());
-        resp.setObjectName("balance");
-        return resp;
+        QuotaBalanceResponse response = new QuotaBalanceResponse();
+        response.setCurrency(QuotaConfig.QuotaCurrencySymbol.value());
+        response.setBalances(balances);
+
+        return response;
     }
 
     @Override
@@ -784,7 +706,7 @@ public QuotaCreditsResponse addQuotaCredits(Long accountId, Long domainId, Doubl
             throw new InvalidParameterValueException("Account does not exist with account id " + accountId);
         }
         final boolean lockAccountEnforcement = "true".equalsIgnoreCase(QuotaConfig.QuotaEnableEnforcement.value());
-        final BigDecimal currentAccountBalance = _quotaBalanceDao.lastQuotaBalance(accountId, domainId, startOfNextDay(new Date(depositedOn.getTime())));
+        final BigDecimal currentAccountBalance = _quotaBalanceDao.getLastQuotaBalance(accountId, domainId);
         logger.debug("Depositing [{}] credits on adjusted date [{}]; current balance is [{}].", amount,
                 DateUtil.displayDateInTimezone(QuotaManagerImpl.getUsageAggregationTimeZone(), depositedOn), currentAccountBalance);
         // update quota account with the balance
@@ -848,34 +770,6 @@ public boolean updateQuotaEmailTemplate(QuotaEmailTemplateUpdateCmd cmd) {
         return false;
     }
 
-    @Override
-    public QuotaBalanceResponse createQuotaLastBalanceResponse(List<QuotaBalanceVO> quotaBalance, Date startDate) {
-        if (quotaBalance == null) {
-            throw new InvalidParameterValueException("There are no balance entries on or before the requested date.");
-        }
-        if (startDate == null) {
-            startDate = new Date();
-        }
-        QuotaBalanceResponse resp = new QuotaBalanceResponse();
-        BigDecimal lastCredits = new BigDecimal(0);
-        for (QuotaBalanceVO entry : quotaBalance) {
-            logger.debug("createQuotaLastBalanceResponse Date={} balance={} credit={}",
-                    DateUtil.displayDateInTimezone(QuotaManagerImpl.getUsageAggregationTimeZone(), entry.getUpdatedOn()),
-                    entry.getCreditBalance(), entry.getCreditsId());
-
-            lastCredits = lastCredits.add(entry.getCreditBalance());
-        }
-        resp.setStartQuota(lastCredits);
-        resp.setStartDate(startDate);
-        resp.setCurrency(QuotaConfig.QuotaCurrencySymbol.value());
-        resp.setObjectName("balance");
-        return resp;
-    }
-
-    @Override
-    public List<QuotaBalanceVO> getQuotaBalance(QuotaBalanceCmd cmd) {
-        return _quotaService.findQuotaBalanceVO(cmd.getAccountId(), cmd.getAccountName(), cmd.getDomainId(), cmd.getStartDate(), cmd.getEndDate());
-    }
     @Override
     public Date startOfNextDay(Date date) {
         LocalDate localDate = date.toInstant().atZone(ZoneId.systemDefault()).toLocalDate();
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java
index 78acfc11682e..478e43d2e203 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java
@@ -30,7 +30,7 @@ public interface QuotaService extends PluggableService {
 
     List<QuotaUsageJoinVO> getQuotaUsage(Long accountId, String accountName, Long domainId, Integer usageType, Date startDate, Date endDate);
 
-    List<QuotaBalanceVO> findQuotaBalanceVO(Long accountId, String accountName, Long domainId, Date startDate, Date endDate);
+    List<QuotaBalanceVO> listQuotaBalancesForAccount(Long accountId, Date startDate, Date endDate);
 
     void setLockAccount(Long accountId, Boolean state);
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java
index a0ba2fbc751d..e1ec2ebb2a60 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java
@@ -28,6 +28,7 @@
 
 import com.cloud.projects.ProjectManager;
 import com.cloud.user.AccountService;
+import com.cloud.utils.DateUtil;
 import org.apache.cloudstack.api.command.QuotaBalanceCmd;
 import org.apache.cloudstack.api.command.QuotaConfigureEmailCmd;
 import org.apache.cloudstack.api.command.QuotaCreditsCmd;
@@ -58,17 +59,16 @@
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
 import org.apache.cloudstack.quota.vo.QuotaUsageJoinVO;
 import org.apache.commons.lang3.ObjectUtils;
+import org.apache.commons.lang3.time.DateUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.configuration.Config;
 import com.cloud.domain.dao.DomainDao;
 import com.cloud.exception.InvalidParameterValueException;
-import com.cloud.exception.PermissionDeniedException;
 import com.cloud.user.Account;
 import com.cloud.user.AccountVO;
 import com.cloud.user.dao.AccountDao;
 import com.cloud.utils.component.ManagerBase;
-import com.cloud.utils.db.Filter;
 
 @Component
 public class QuotaServiceImpl extends ManagerBase implements QuotaService, Configurable, QuotaConfig {
@@ -152,63 +152,53 @@ public Boolean isQuotaServiceEnabled() {
     }
 
     @Override
-    public List<QuotaBalanceVO> findQuotaBalanceVO(Long accountId, String accountName, Long domainId, Date startDate, Date endDate) {
-        if ((accountId == null) && (accountName != null) && (domainId != null)) {
-            Account userAccount = null;
-            Account caller = CallContext.current().getCallingAccount();
-            if (_domainDao.isChildDomain(caller.getDomainId(), domainId)) {
-                Filter filter = new Filter(AccountVO.class, "id", Boolean.FALSE, null, null);
-                List<AccountVO> accounts = _accountDao.listAccounts(accountName, domainId, filter);
-                if (!accounts.isEmpty()) {
-                    userAccount = accounts.get(0);
-                }
-                if (userAccount != null) {
-                    accountId = userAccount.getId();
-                } else {
-                    throw new InvalidParameterValueException("Unable to find account " + accountName + " in domain " + domainId);
-                }
-            } else {
-                throw new PermissionDeniedException("Invalid Domain Id or Account");
-            }
+    public List<QuotaBalanceVO> listQuotaBalancesForAccount(Long accountId, Date startDate, Date endDate) {
+        validateStartDateAndEndDateForListQuotaBalancesForAccount(startDate, endDate);
+
+        if (accountId == -1) {
+            accountId = CallContext.current().getCallingAccountId();
         }
+        Account account = _accountDao.findByIdIncludingRemoved(accountId);
+        Long domainId = account.getDomainId();
 
-        startDate = startDate == null ? new Date() : startDate;
+        if (startDate == null && endDate == null) {
+            logger.debug("Retrieving last quota balance for {}.", account);
+            QuotaBalanceVO lastQuotaBalance = _quotaBalanceDao.getLastQuotaBalanceEntry(accountId, domainId, null);
 
-        if (endDate == null) {
-            // adjust start date to end of day as there is no end date
-            startDate = _respBldr.startOfNextDay(startDate);
-            if (logger.isDebugEnabled()) {
-                logger.debug("getQuotaBalance1: Getting quota balance records for account: " + accountId + ", domainId: " + domainId + ", on or before " + startDate);
-            }
-            List<QuotaBalanceVO> qbrecords = _quotaBalanceDao.lastQuotaBalanceVO(accountId, domainId, startDate);
-            if (logger.isDebugEnabled()) {
-                logger.debug("Found records size=" + qbrecords.size());
-            }
-            if (qbrecords.isEmpty()) {
-                logger.info("Incorrect Date there are no quota records before this date " + startDate);
-                return qbrecords;
-            } else {
-                return qbrecords;
-            }
-        } else {
-            if (startDate.before(endDate)) {
-                if (logger.isDebugEnabled()) {
-                    logger.debug("getQuotaBalance2: Getting quota balance records for account: " + accountId + ", domainId: " + domainId + ", between " + startDate
-                            + " and " + endDate);
-                }
-                List<QuotaBalanceVO> qbrecords = _quotaBalanceDao.findQuotaBalance(accountId, domainId, startDate, endDate);
-                if (logger.isDebugEnabled()) {
-                    logger.debug("getQuotaBalance3: Found records size=" + qbrecords.size());
-                }
-                if (qbrecords.isEmpty()) {
-                    logger.info("There are no quota records between these dates start date " + startDate + " and end date:" + endDate);
-                    return qbrecords;
-                } else {
-                    return qbrecords;
-                }
-            } else {
-                throw new InvalidParameterValueException("Incorrect Date Range. Start date: " + startDate + " is after end date:" + endDate);
+            if (lastQuotaBalance == null) {
+                logger.debug("Did not found a quota balance entry for {}.", account);
+                return new ArrayList<>();
             }
+
+            return List.of(lastQuotaBalance);
+        }
+
+        if (endDate == null) {
+            endDate = DateUtils.addDays(new Date(), -1);
+        }
+
+        List<QuotaBalanceVO> quotaBalances = _quotaBalanceDao.listQuotaBalances(accountId, domainId, startDate, endDate);
+
+        if (quotaBalances.isEmpty()) {
+            logger.info("There are no quota balances for {} between [{}] and [{}].", account,
+                    DateUtil.getOutputString(startDate), DateUtil.getOutputString(endDate));
+        }
+
+        return quotaBalances;
+    }
+
+    protected void validateStartDateAndEndDateForListQuotaBalancesForAccount(Date startDate, Date endDate) {
+        if (startDate == null && endDate != null) {
+            throw new InvalidParameterValueException("Parameter \"enddate\" must be informed together with parameter \"startdate\".");
+        }
+
+        Date now = new Date();
+        if (startDate != null && startDate.after(now)) {
+            throw new InvalidParameterValueException("The last balance can be at most from yesterday; therefore, the start date must be before today.");
+        }
+
+        if (ObjectUtils.allNotNull(startDate, endDate) && startDate.after(endDate)) {
+            throw new InvalidParameterValueException("The start date cannot be after the end date.");
         }
     }
 
diff --git a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/command/QuotaBalanceCmdTest.java b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/command/QuotaBalanceCmdTest.java
index adabc694f25a..cd0eeb2c3b48 100644
--- a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/command/QuotaBalanceCmdTest.java
+++ b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/command/QuotaBalanceCmdTest.java
@@ -16,18 +16,15 @@
 // under the License.
 package org.apache.cloudstack.api.command;
 
-import java.lang.reflect.Field;
-import java.util.ArrayList;
-import java.util.Date;
-import java.util.List;
-
 import org.apache.cloudstack.api.response.QuotaBalanceResponse;
 import org.apache.cloudstack.api.response.QuotaResponseBuilder;
-import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
+import org.junit.Assert;
 import org.junit.Test;
 import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
 import org.mockito.Mock;
 import org.mockito.Mockito;
+import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
 
 import junit.framework.TestCase;
@@ -36,31 +33,20 @@
 public class QuotaBalanceCmdTest extends TestCase {
 
     @Mock
-    QuotaResponseBuilder responseBuilder;
+    QuotaResponseBuilder quotaResponseBuilderMock;
 
-    @Test
-    public void testQuotaBalanceCmd() throws NoSuchFieldException, IllegalAccessException {
-        QuotaBalanceCmd cmd = new QuotaBalanceCmd();
-        Field rbField = QuotaBalanceCmd.class.getDeclaredField("_responseBuilder");
-        rbField.setAccessible(true);
-        rbField.set(cmd, responseBuilder);
+    @InjectMocks
+    @Spy
+    QuotaBalanceCmd quotaBalanceCmdSpy;
 
-        List<QuotaBalanceVO> quotaBalanceVOList = new ArrayList<QuotaBalanceVO>();
-        Mockito.when(responseBuilder.getQuotaBalance(Mockito.any(cmd.getClass()))).thenReturn(quotaBalanceVOList);
-        Mockito.when(responseBuilder.createQuotaLastBalanceResponse(Mockito.eq(quotaBalanceVOList), Mockito.any(Date.class))).thenReturn(new QuotaBalanceResponse());
-        Mockito.when(responseBuilder.createQuotaBalanceResponse(Mockito.eq(quotaBalanceVOList), Mockito.any(Date.class), Mockito.any(Date.class))).thenReturn(new QuotaBalanceResponse());
-        Mockito.lenient().when(responseBuilder.startOfNextDay(Mockito.any(Date.class))).thenReturn(new Date());
+    @Test
+    public void executeTestSetResponseObject() {
+        QuotaBalanceResponse expected = new QuotaBalanceResponse();
+        Mockito.doReturn(expected).when(quotaResponseBuilderMock).createQuotaBalanceResponse(Mockito.eq(quotaBalanceCmdSpy));
 
-        // end date not specified
-        cmd.setStartDate(new Date());
-        cmd.setEndDate(null);
-        cmd.execute();
-        Mockito.verify(responseBuilder, Mockito.times(1)).createQuotaLastBalanceResponse(Mockito.eq(quotaBalanceVOList), Mockito.any(Date.class));
-        Mockito.verify(responseBuilder, Mockito.times(0)).createQuotaBalanceResponse(Mockito.eq(quotaBalanceVOList), Mockito.any(Date.class), Mockito.any(Date.class));
+        quotaBalanceCmdSpy.execute();
 
-        // end date specified
-        cmd.setEndDate(new Date());
-        cmd.execute();
-        Mockito.verify(responseBuilder, Mockito.times(1)).createQuotaBalanceResponse(Mockito.eq(quotaBalanceVOList), Mockito.any(Date.class), Mockito.any(Date.class));
+        Assert.assertEquals(expected, quotaBalanceCmdSpy.getResponseObject());
     }
+
 }
diff --git a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
index 81b4992082d9..0c7610461c15 100644
--- a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
+++ b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
@@ -40,6 +40,7 @@
 import com.cloud.utils.Pair;
 import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.QuotaBalanceCmd;
 import org.apache.cloudstack.api.command.QuotaConfigureEmailCmd;
 import org.apache.cloudstack.api.command.QuotaCreditsListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
@@ -249,7 +250,7 @@ public void testAddQuotaCredits() {
         credit.setCredit(new BigDecimal(amount));
 
         Mockito.when(quotaCreditsDaoMock.saveCredits(Mockito.any(QuotaCreditsVO.class))).thenReturn(credit);
-        Mockito.when(quotaBalanceDaoMock.lastQuotaBalance(Mockito.anyLong(), Mockito.anyLong(), Mockito.any(Date.class))).thenReturn(new BigDecimal(111));
+        Mockito.when(quotaBalanceDaoMock.getLastQuotaBalance(Mockito.anyLong(), Mockito.anyLong())).thenReturn(new BigDecimal(111));
         Mockito.doReturn(userVoMock).when(quotaResponseBuilderSpy).getCreditorForQuotaCredits(credit);
 
         AccountVO account = new AccountVO();
@@ -295,33 +296,6 @@ public void testUpdateQuotaEmailTemplate() {
         assertTrue(quotaResponseBuilderSpy.updateQuotaEmailTemplate(cmd));
     }
 
-    @Test
-    public void testCreateQuotaLastBalanceResponse() {
-        List<QuotaBalanceVO> quotaBalance = new ArrayList<>();
-        // null balance test
-        try {
-            quotaResponseBuilderSpy.createQuotaLastBalanceResponse(null, new Date());
-        } catch (InvalidParameterValueException e) {
-            assertTrue(e.getMessage().equals("There are no balance entries on or before the requested date."));
-        }
-
-        // empty balance test
-        try {
-            quotaResponseBuilderSpy.createQuotaLastBalanceResponse(quotaBalance, new Date());
-        } catch (InvalidParameterValueException e) {
-            assertTrue(e.getMessage().equals("There are no balance entries on or before the requested date."));
-        }
-
-        // valid balance test
-        QuotaBalanceVO entry = new QuotaBalanceVO();
-        entry.setAccountId(2L);
-        entry.setCreditBalance(new BigDecimal(100));
-        quotaBalance.add(entry);
-        quotaBalance.add(entry);
-        QuotaBalanceResponse resp = quotaResponseBuilderSpy.createQuotaLastBalanceResponse(quotaBalance, null);
-        assertTrue(resp.getStartQuota().compareTo(new BigDecimal(200)) == 0);
-    }
-
     @Test
     public void testStartOfNextDayWithoutParameters() {
         Date nextDate = quotaResponseBuilderSpy.startOfNextDay();
@@ -919,6 +893,46 @@ public void injectUsageTypeVariablesTestReturnInjectedVariables() {
         Assert.assertTrue(formattedVariables.containsValue("zonename"));
     }
 
+    private List<QuotaBalanceVO> getQuotaBalancesForTest() {
+        List<QuotaBalanceVO> balances = new ArrayList<>();
+
+        QuotaBalanceVO balance = new QuotaBalanceVO();
+        balance.setUpdatedOn(new Date());
+        balance.setCreditBalance(BigDecimal.valueOf(-10.42));
+        balances.add(balance);
+
+        balance = new QuotaBalanceVO();
+        balance.setUpdatedOn(new Date());
+        balance.setCreditBalance(BigDecimal.valueOf(-18.94));
+        balances.add(balance);
+
+        balance = new QuotaBalanceVO();
+        balance.setUpdatedOn(new Date());
+        balance.setCreditBalance(BigDecimal.valueOf(-29.37));
+        balances.add(balance);
+
+        return balances;
+    }
+
+    @Test
+    public void createQuotaBalancesResponseTestCreateResponse() {
+        List<QuotaBalanceVO> balances = getQuotaBalancesForTest();
+
+        QuotaBalanceResponse expected = new QuotaBalanceResponse();
+        expected.setObjectName("balance");
+        expected.setCurrency("$");
+
+        Mockito.doReturn(balances).when(quotaServiceMock).listQuotaBalancesForAccount(Mockito.any(), Mockito.any(), Mockito.any());
+        QuotaBalanceResponse result = quotaResponseBuilderSpy.createQuotaBalanceResponse(new QuotaBalanceCmd());
+
+        Assert.assertEquals(expected.getCurrency(), result.getCurrency());
+
+        for (int i = 0; i < balances.size(); i++) {
+            Assert.assertEquals(balances.get(i).getUpdatedOn(), result.getBalances().get(i).getDate());
+            Assert.assertEquals(balances.get(i).getCreditBalance(), result.getBalances().get(i).getBalance());
+        }
+    }
+
     @Test
     public void createDummyRecordForEachQuotaTypeIfUsageTypeIsNotInformedTestUsageTypeDifferentFromNullDoNothing() {
         List<QuotaUsageJoinVO> listUsage = new ArrayList<>();
diff --git a/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java b/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java
index a0fe63de8518..89c48b1cc660 100644
--- a/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java
+++ b/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java
@@ -18,6 +18,7 @@
 
 import com.cloud.configuration.Config;
 import com.cloud.domain.dao.DomainDao;
+import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.user.AccountVO;
 import com.cloud.user.dao.AccountDao;
 import com.cloud.utils.db.TransactionLegacy;
@@ -31,7 +32,9 @@
 import org.apache.cloudstack.quota.dao.QuotaUsageJoinDao;
 import org.apache.cloudstack.quota.vo.QuotaAccountVO;
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
+import org.apache.commons.lang3.time.DateUtils;
 import org.joda.time.DateTime;
+import org.junit.Assert;
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -43,7 +46,6 @@
 
 import javax.naming.ConfigurationException;
 import java.lang.reflect.Field;
-import java.math.BigDecimal;
 import java.util.ArrayList;
 import java.util.Date;
 import java.util.List;
@@ -51,6 +53,8 @@
 @RunWith(MockitoJUnitRunner.class)
 public class QuotaServiceImplTest extends TestCase {
 
+    @Mock
+    AccountVO accountVoMock;
     @Mock
     AccountDao accountDaoMock;
     @Mock
@@ -67,9 +71,6 @@ public class QuotaServiceImplTest extends TestCase {
     QuotaUsageJoinDao quotaUsageJoinDaoMock;
     @Mock
     QuotaResponseBuilder respBldr;
-    @Mock
-    private AccountVO accountVoMock;
-
     @Spy
     @InjectMocks
     QuotaServiceImpl quotaServiceImplSpy;
@@ -112,30 +113,6 @@ public void setup() throws IllegalAccessException, NoSuchFieldException, Configu
         quotaServiceImplSpy.configure("randomName", null);
     }
 
-    @Test
-    public void testFindQuotaBalanceVO() {
-        final long accountId = 2L;
-        final String accountName = "admin123";
-        final long domainId = 1L;
-        final Date startDate = new DateTime().minusDays(2).toDate();
-        final Date endDate = new Date();
-
-        List<QuotaBalanceVO> records = new ArrayList<>();
-        QuotaBalanceVO qb = new QuotaBalanceVO();
-        qb.setCreditBalance(new BigDecimal(100));
-        qb.setAccountId(accountId);
-        records.add(qb);
-
-        Mockito.when(respBldr.startOfNextDay(Mockito.any(Date.class))).thenReturn(startDate);
-        Mockito.when(quotaBalanceDao.findQuotaBalance(Mockito.eq(accountId), Mockito.eq(domainId), Mockito.any(Date.class), Mockito.any(Date.class))).thenReturn(records);
-        Mockito.when(quotaBalanceDao.lastQuotaBalanceVO(Mockito.eq(accountId), Mockito.eq(domainId), Mockito.any(Date.class))).thenReturn(records);
-
-        // with enddate
-        assertTrue(quotaServiceImplSpy.findQuotaBalanceVO(accountId, accountName, domainId, startDate, endDate).get(0).equals(qb));
-        // without enddate
-        assertTrue(quotaServiceImplSpy.findQuotaBalanceVO(accountId, accountName, domainId, startDate, null).get(0).equals(qb));
-    }
-
     @Test
     public void testGetQuotaUsage() {
         final long accountId = 2L;
@@ -182,4 +159,66 @@ public void testSetMinBalance() {
         Mockito.verify(quotaAcc, Mockito.times(1)).persistQuotaAccount(Mockito.any(QuotaAccountVO.class));
     }
 
+    @Test(expected = InvalidParameterValueException.class)
+    public void validateStartDateAndEndDateForListQuotaBalancesForAccountTestStartDateIsNullAndEndDateIsNotNullThrowsInvalidParameterException() {
+        quotaServiceImplSpy.validateStartDateAndEndDateForListQuotaBalancesForAccount(null, new Date());
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void validateStartDateAndEndDateForListQuotaBalancesForAccountTestStartDateIsAfterNowThrowsInvalidParameterValueException() {
+        Date startDate = DateUtils.addMinutes(new Date(), 1);
+        quotaServiceImplSpy.validateStartDateAndEndDateForListQuotaBalancesForAccount(startDate, null);
+    }
+
+    @Test
+    public void validateStartDateAndEndDateForListQuotaBalancesForAccountTestEndDateIsAfterNowDoesNothing() {
+        Date startDate = DateUtils.addMinutes(new Date(), -1);
+        Date endDate = DateUtils.addMinutes(new Date(), 1);
+        quotaServiceImplSpy.validateStartDateAndEndDateForListQuotaBalancesForAccount(startDate, endDate);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void validateStartDateAndEndDateForListQuotaBalancesForAccountTestStartDateIsAfterEndDateThrowsInvalidParameterValueException() {
+        Date startDate = DateUtils.addMinutes(new Date(), -10);
+        Date endDate = DateUtils.addMinutes(new Date(), -15);
+        quotaServiceImplSpy.validateStartDateAndEndDateForListQuotaBalancesForAccount(startDate, endDate);
+    }
+
+    @Test
+    public void listQuotaBalancesForAccountTestLastQuotaBalanceIsNullReturnsEmptyList() {
+        Mockito.doNothing().when(quotaServiceImplSpy).validateStartDateAndEndDateForListQuotaBalancesForAccount(Mockito.any(), Mockito.any());
+        Mockito.doReturn(null).when(quotaBalanceDao).getLastQuotaBalanceEntry(Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
+        Mockito.doReturn(Mockito.mock(AccountVO.class)).when(accountDaoMock).findByIdIncludingRemoved(Mockito.anyLong());
+
+        List<QuotaBalanceVO> result = quotaServiceImplSpy.listQuotaBalancesForAccount(1L, null, null);
+
+        Assert.assertTrue(result.isEmpty());
+    }
+
+    @Test
+    public void listQuotaBalancesForAccountTestLastQuotaBalanceIsNotNullReturnsIt() {
+        QuotaBalanceVO expected = new QuotaBalanceVO();
+
+        Mockito.doNothing().when(quotaServiceImplSpy).validateStartDateAndEndDateForListQuotaBalancesForAccount(Mockito.any(), Mockito.any());
+        Mockito.doReturn(expected).when(quotaBalanceDao).getLastQuotaBalanceEntry(Mockito.anyLong(), Mockito.anyLong(), Mockito.any());
+        Mockito.doReturn(Mockito.mock(AccountVO.class)).when(accountDaoMock).findByIdIncludingRemoved(Mockito.anyLong());
+
+        List<QuotaBalanceVO> result = quotaServiceImplSpy.listQuotaBalancesForAccount(1L, null, null);
+
+        Assert.assertEquals(expected, result.get(0));
+    }
+
+    @Test
+    public void listQuotaBalancesForAccountTestReturnsQuotaBalances() {
+        List<QuotaBalanceVO> expected = new ArrayList<>();
+
+        Mockito.doNothing().when(quotaServiceImplSpy).validateStartDateAndEndDateForListQuotaBalancesForAccount(Mockito.any(), Mockito.any());
+        Mockito.doReturn(expected).when(quotaBalanceDao).listQuotaBalances(Mockito.anyLong(), Mockito.anyLong(), Mockito.any(), Mockito.any());
+        Mockito.doReturn(Mockito.mock(AccountVO.class)).when(accountDaoMock).findByIdIncludingRemoved(Mockito.anyLong());
+
+        List<QuotaBalanceVO> result = quotaServiceImplSpy.listQuotaBalancesForAccount(1L, new Date(), null);
+
+        Assert.assertEquals(expected, result);
+    }
+
 }
diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
index d4d48bdf77be..52ec26661c9d 100644
--- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
@@ -3922,7 +3922,7 @@ public Long finalizeAccountId(Long accountId, String accountName, Long domainId,
             if (getActiveAccountById(accountId) != null) {
                 return accountId;
             }
-            throw new InvalidParameterValueException(String.format("Unable to find account with ID [%s].", accountId));
+            throw new InvalidParameterValueException(String.format("Unable to find account with the specified ID."));
         }
 
         if (accountName == null && domainId == null) {
@@ -3938,16 +3938,16 @@ public Long finalizeAccountId(Long accountId, String accountName, Long domainId,
             throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format("Both %s and %s are needed if using either. Consider using %s instead.",
                     ApiConstants.ACCOUNT, ApiConstants.DOMAIN_ID, ApiConstants.ACCOUNT_ID));
         }
-        throw new InvalidParameterValueException(String.format("Unable to find account by name [%s] on domain [%s].", accountName, domainId));
+        throw new InvalidParameterValueException(String.format("Unable to find account with name [%s] on the specified domain.", accountName));
     }
 
     protected long getActiveProjectAccountByProjectId(long projectId) {
         Project project = _projectMgr.getProject(projectId);
         if (project == null) {
-            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format("Unable to find project with ID [%s].", projectId));
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Unable to find project with the specified ID.");
         }
         if (project.getState() != Project.State.Active) {
-            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, String.format("Project with ID [%s] is not active.", projectId));
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR, "Project is not active.");
         }
         return project.getProjectAccountId();
     }
diff --git a/test/integration/plugins/quota/test_quota_balance.py b/test/integration/plugins/quota/test_quota_balance.py
index f5c1c75d7b23..ca702bbda013 100644
--- a/test/integration/plugins/quota/test_quota_balance.py
+++ b/test/integration/plugins/quota/test_quota_balance.py
@@ -117,9 +117,28 @@ def tearDown(self):
     def delete_tariffs(self):
         for tariff in self.tariffs:
             cmd = quotaTariffDelete.quotaTariffDeleteCmd()
-            cmd.id = tariff.uuid
+            cmd.id = tariff.id
             self.apiclient.quotaTariffDelete(cmd)
 
+    def insert_usage_and_update_quota(self, zone_id, account_id, domain_id, relative_start_date, relative_end_date):
+        start_date = f"DATE_ADD(UTC_TIMESTAMP(), INTERVAL {relative_start_date} HOUR)"
+        end_date = f"DATE_ADD(UTC_TIMESTAMP(), INTERVAL {relative_end_date} HOUR)"
+
+        # Manually insert a usage regarding the usage type 21 (VM_DISK_IO_READ)
+        sql_query = (f"INSERT INTO cloud_usage.cloud_usage (zone_id,account_id,domain_id,description,usage_display,usage_type,raw_usage,vm_instance_id,vm_name,offering_id,template_id,"
+                        f"usage_id,`type`,`size`,network_id,start_date,end_date,virtual_size,cpu_speed,cpu_cores,memory,quota_calculated,is_hidden,state)"
+                        f" VALUES ('{zone_id}','{account_id}','{domain_id}','Test','1 Hrs',21,1,NULL,NULL,NULL,NULL,NULL,'VirtualMachine',NULL,NULL,{start_date},{end_date},NULL,NULL,NULL,NULL,0,0,NULL);")
+        self.debug(sql_query)
+        self.dbclient.execute(sql_query)
+
+        # Update quota to calculate the balance of the account
+        cmd = quotaUpdate.quotaUpdateCmd()
+        self.apiclient.quotaUpdate(cmd)
+        time.sleep(1)
+
+    def format_date(self, date):
+        return date.strftime("%Y-%m-%d %H:%M:%S")
+
     @attr(tags=["advanced", "smoke", "quota"], required_hardware="false")
     def test_quota_balance(self):
         """
@@ -146,6 +165,7 @@ def test_quota_balance(self):
         cmd.domainid = self.domain.id
         cmd.value = 100
         self.apiclient.quotaCredits(cmd)
+        time.sleep(1)
 
         # Fetch account ID from account_uuid
         account_id_select = f"SELECT id FROM account WHERE uuid = '{self.account.id}';"
@@ -165,27 +185,24 @@ def test_quota_balance(self):
         qresultset = self.dbclient.execute(zone_id_select)
         zone_id = qresultset[0][0]
 
-        start_date = datetime.datetime.now() + datetime.timedelta(seconds=1)
-        end_date = datetime.datetime.now() + datetime.timedelta(hours=1)
-
-        # Manually insert a usage regarding the usage type 21 (VM_DISK_IO_READ)
-        sql_query = (f"INSERT INTO cloud_usage.cloud_usage (zone_id,account_id,domain_id,description,usage_display,usage_type,raw_usage,vm_instance_id,vm_name,offering_id,template_id,"
-                     f"usage_id,`type`,`size`,network_id,start_date,end_date,virtual_size,cpu_speed,cpu_cores,memory,quota_calculated,is_hidden,state)"
-                     f" VALUES ('{zone_id}','{account_id}','{domain_id}','Test','1 Hrs',21,1,NULL,NULL,NULL,NULL,NULL,'VirtualMachine',NULL,NULL,'{start_date}','{end_date}',NULL,NULL,NULL,NULL,0,0,NULL);")
-        self.debug(sql_query)
-        self.dbclient.execute(sql_query)
-
-        # Update quota to calculate the balance of the account
-        cmd = quotaUpdate.quotaUpdateCmd()
-        self.apiclient.quotaUpdate(cmd)
+        # Generate three quota_balance entries
+        self.insert_usage_and_update_quota(zone_id, account_id, domain_id, 0, 1)
+        self.insert_usage_and_update_quota(zone_id, account_id, domain_id, 1, 2)
+        self.insert_usage_and_update_quota(zone_id, account_id, domain_id, 2, 3)
 
         # Retrieve the quota balance of the account
         cmd = quotaBalance.quotaBalanceCmd()
         cmd.domainid = self.account.domainid
         cmd.account = self.account.name
+        cmd.startdate = datetime.datetime.now() + datetime.timedelta(hours=-1)
+        cmd.enddate = datetime.datetime.now() + datetime.timedelta(hours=3)
         response = self.apiclient.quotaBalance(cmd)
 
-        self.debug(f"The quota balance for the account {self.account.name} is {response.balance}.")
-        self.assertEqual(response.balance.startquota, 90, f"The `startQuota` response field is supposed to be 90 but was {response.balance.startquota}.")
+        self.assertTrue(len(response.balance.balances) == 4, f"Expected 4 balance entries for between {self.format_date(cmd.startdate)} " +
+            f"and {self.format_date(cmd.enddate)} but got {len(response.balance.balances)}.")
+        for i, balance in enumerate(response.balance.balances):
+            expected_balance = 100 - 10 * i
+            self.debug(f"The quota balance for the account {self.account.name} at {balance.date} was {balance.balance}.")
+            self.assertEqual(balance.balance, expected_balance, f"The `balance` field at {balance.date} is supposed to be {expected_balance} but was {balance.balance}.")
 
         return

From 6786d45951a5faf26ce3caa7fffecb880bbfd5e0 Mon Sep 17 00:00:00 2001
From: James Peru Mmbono <jmsperu@gmail.com>
Date: Wed, 27 May 2026 15:09:32 +0300
Subject: [PATCH 53/64] fix(linstor): surface ambiguous template fallbacks and
 legacy orphan cleanup (#13078)

Co-authored-by: jmsperu <jmsperu@users.noreply.github.com>
---
 .../kvm/storage/LinstorStorageAdaptor.java    | 14 +++++++++++--
 .../storage/datastore/util/LinstorUtil.java   | 21 ++++++++++++++++++-
 2 files changed, 32 insertions(+), 3 deletions(-)

diff --git a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
index 31a41cd94079..32858108d6ac 100644
--- a/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
+++ b/plugins/storage/volume/linstor/src/main/java/com/cloud/hypervisor/kvm/storage/LinstorStorageAdaptor.java
@@ -508,9 +508,19 @@ private boolean deRefOrDeleteResource(DevelopersApi api, String rscName, String
             // if there is only one template-for property left for templates, the template isn't needed anymore
             // or if it isn't a template anyway, it will not have this Aux property
             // _cs-template-for- properties work like a ref-count.
-            if (rd.getProps().keySet().stream()
+            long remainingTemplateRefs = rd.getProps().keySet().stream()
                     .filter(key -> key.startsWith("Aux/" + LinstorUtil.CS_TEMPLATE_FOR_PREFIX))
-                    .count() == expectedProps) {
+                    .count();
+            if (remainingTemplateRefs == expectedProps) {
+                // Surface the legacy case where a resource has zero `_cs-template-for-` aux
+                // properties even though we never decremented one — that's a template predating
+                // the ref-count convention, or a stale orphan. Logging before deletion lets
+                // operators audit how many such orphans existed at upgrade time.
+                if (expectedProps == 0) {
+                    logger.info("Linstor: deleting resource {} which has no _cs-template-for- aux properties " +
+                                    "(legacy template predating the ref-count convention, or a stale orphan). " +
+                                    "Resource group context: {}", rd.getName(), rscGrpName);
+                }
                 ApiCallRcList answers = api.resourceDefinitionDelete(rd.getName());
                 checkLinstorAnswersThrow(answers);
                 deleted = true;
diff --git a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
index 239331077e1b..502bf6d0ca2a 100644
--- a/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
+++ b/plugins/storage/volume/linstor/src/main/java/org/apache/cloudstack/storage/datastore/util/LinstorUtil.java
@@ -543,7 +543,26 @@ public static ResourceDefinition findResourceDefinition(DevelopersApi api, Strin
                 .filter(rscDfn -> rscDfn.getProps().containsKey(LinstorUtil.getTemplateForAuxPropKey(rscGrpName)))
                 .findFirst();
 
-        return rd.orElseGet(() -> rdsStartingWith.get(0));
+        if (rd.isPresent()) {
+            return rd.get();
+        }
+        // Fallback: no resource has the exact "_cs-template-for-<rscGrpName>" property.
+        // This happens when (a) the matched resource is a legacy template created before that
+        // convention was introduced, or (b) the template was cached by a different resource
+        // group and the operator hopes to share it. Log so the ambiguity is visible — silent
+        // first-match fallback has previously routed clones to the wrong template when
+        // multiple resource groups coexisted on the same controller.
+        ResourceDefinition fallback = rdsStartingWith.get(0);
+        LOGGER.warn("LINSTOR findResourceDefinition: no resource for '{}' has the expected " +
+                        "Aux property '{}' for resource group '{}'; falling back to first match '{}' " +
+                        "(present aux properties: {}). If this is wrong, set the property explicitly " +
+                        "or remove the unrelated resource definition.",
+                rscName, getTemplateForAuxPropKey(rscGrpName), rscGrpName,
+                fallback.getName(),
+                fallback.getProps().keySet().stream()
+                        .filter(k -> k.startsWith("Aux/" + CS_TEMPLATE_FOR_PREFIX))
+                        .collect(Collectors.toList()));
+        return fallback;
     }
 
     public static boolean isRscDiskless(ResourceWithVolumes rsc) {

From e3245515e8bb758f3c1278f15077231271a141e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robert=20Sil=C3=A9n?= <robert.silen@mariadb.org>
Date: Wed, 27 May 2026 23:13:11 +0300
Subject: [PATCH 54/64] docs: note MariaDB support in README (#13238)

---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index a5aacb49f6b5..852674ab7b1f 100644
--- a/README.md
+++ b/README.md
@@ -203,7 +203,7 @@ Unrestricted (TSU) exception (see the BIS Export Administration Regulations, Sec
 The following provides more details on the included cryptographic software:
 
 * CloudStack makes use of JaSypt cryptographic libraries.
-* CloudStack has a system requirement of MySQL, and uses native database encryption functionality.
+* CloudStack requires a MySQL-compatible database (MariaDB or MySQL), and uses native database encryption functionality.
 * CloudStack makes use of the Bouncy Castle general-purpose encryption library.
 * CloudStack can optionally interact with and control OpenSwan-based VPNs.
 * CloudStack has a dependency on and makes use of JSch - a java SSH2 implementation.

From c0ce5b461f816bd6a6c1ceee8c1ee3104b3dbde7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 27 May 2026 21:35:13 -0300
Subject: [PATCH 55/64] Bump the github-actions-dependencies group across 1
 directory with 2 updates (#13215)

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/daily-repo-status.lock.yml  | 10 +++++-----
 .github/workflows/issue-triage-agent.lock.yml | 10 +++++-----
 .github/workflows/stale.yml                   |  4 ++--
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/daily-repo-status.lock.yml b/.github/workflows/daily-repo-status.lock.yml
index f8ce13c3cee8..c9b85fafafdd 100644
--- a/.github/workflows/daily-repo-status.lock.yml
+++ b/.github/workflows/daily-repo-status.lock.yml
@@ -54,7 +54,7 @@ jobs:
       comment_repo: ""
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Check workflow file
@@ -96,7 +96,7 @@ jobs:
       secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Checkout
@@ -784,7 +784,7 @@ jobs:
       total_count: ${{ steps.missing_tool.outputs.total_count }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Download agent output
@@ -881,7 +881,7 @@ jobs:
       success: ${{ steps.parse_results.outputs.success }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Download agent
@@ -993,7 +993,7 @@ jobs:
       process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
     steps:
       - name: Setup
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.45.
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
         with:
           destination: /opt/gh-aw/
       - name: Download agent output
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index 1c3d11a800e6..258032f02c4a 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -53,7 +53,7 @@ jobs:
       comment_repo: ""
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
         with:
           destination: /opt/gh-aw/actions
       - name: Check workflow file timestamps
@@ -91,7 +91,7 @@ jobs:
       secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
         with:
           destination: /opt/gh-aw/actions
       - name: Checkout repository
@@ -780,7 +780,7 @@ jobs:
       total_count: ${{ steps.missing_tool.outputs.total_count }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
         with:
           destination: /opt/gh-aw/actions
       - name: Download agent output artifact
@@ -874,7 +874,7 @@ jobs:
       success: ${{ steps.parse_results.outputs.success }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
         with:
           destination: /opt/gh-aw/actions
       - name: Download agent artifacts
@@ -987,7 +987,7 @@ jobs:
       process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@f01a9d118afa6e306f3645ca31e43f4ea8fb4d22 # v0.71.1
+        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
         with:
           destination: /opt/gh-aw/actions
       - name: Download agent output artifact
diff --git a/.github/workflows/stale.yml b/.github/workflows/stale.yml
index 5c92f23888e2..c0da5f98cc8e 100644
--- a/.github/workflows/stale.yml
+++ b/.github/workflows/stale.yml
@@ -28,7 +28,7 @@ jobs:
       issues: write
       pull-requests: write
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           stale-issue-message: 'This issue is stale because it has been open for 120 days with no activity. It may be removed by administrators of this project at any time. Remove the stale label or comment to request for removal of it to prevent this.'
           stale-pr-message: 'This PR is stale because it has been open for 120 days with no activity. It may be removed by administrators of this project at any time. Remove the stale label or comment to request for removal of it to prevent this.'
@@ -41,7 +41,7 @@ jobs:
           days-before-pr-close: 240
           exempt-issue-labels: 'gsoc,good-first-issue,long-term-plan'
           exempt-pr-labels: 'status:ready-for-merge,status:needs-testing,status:on-hold'
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           stale-issue-label: 'archive'
           days-before-stale: 240

From 7308dad19a9a70d33a33a75bea8c51629541e438 Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Fri, 29 May 2026 14:45:49 +0530
Subject: [PATCH 56/64] Update github aw actions (#13278)

---
 .github/aw/actions-lock.json                  |   56 +
 .../.github_workflows_shared_reporting.md     |   73 +
 .github/dependabot.yml                        |    2 +
 .github/workflows/daily-repo-status.lock.yml  | 1782 ++++++++++-------
 .github/workflows/daily-repo-status.md        |    8 +-
 .github/workflows/issue-triage-agent.lock.yml | 1499 ++++++++------
 .github/workflows/issue-triage-agent.md       |   22 +-
 7 files changed, 2167 insertions(+), 1275 deletions(-)
 create mode 100644 .github/aw/actions-lock.json
 create mode 100644 .github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md

diff --git a/.github/aw/actions-lock.json b/.github/aw/actions-lock.json
new file mode 100644
index 000000000000..ea25ffab6b9e
--- /dev/null
+++ b/.github/aw/actions-lock.json
@@ -0,0 +1,56 @@
+{
+  "entries": {
+    "actions/github-script@v9.0.0": {
+      "repo": "actions/github-script",
+      "version": "v9.0.0",
+      "sha": "3a2844b7e9c422d3c10d287c895573f7108da1b3"
+    },
+    "github/gh-aw-actions/setup@v0.76.1": {
+      "repo": "github/gh-aw-actions/setup",
+      "version": "v0.76.1",
+      "sha": "46d564922b082d0db93244972e8005ea6904ee5f"
+    }
+  },
+  "containers": {
+    "ghcr.io/github/gh-aw-firewall/agent:0.18.0": {
+      "image": "ghcr.io/github/gh-aw-firewall/agent:0.18.0",
+      "digest": "sha256:ab84dfc7f5998cb8cd0c596526dd573b7e7d06c6a740266a1e6df879fa16c866",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.18.0@sha256:ab84dfc7f5998cb8cd0c596526dd573b7e7d06c6a740266a1e6df879fa16c866"
+    },
+    "ghcr.io/github/gh-aw-firewall/agent:0.25.55": {
+      "image": "ghcr.io/github/gh-aw-firewall/agent:0.25.55",
+      "digest": "sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731"
+    },
+    "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55": {
+      "image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55",
+      "digest": "sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3"
+    },
+    "ghcr.io/github/gh-aw-firewall/squid:0.18.0": {
+      "image": "ghcr.io/github/gh-aw-firewall/squid:0.18.0",
+      "digest": "sha256:82a5d062a5612a57a43a171a5b79ddbb690a86a8ddda02339cc1675131ae9f8b",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.18.0@sha256:82a5d062a5612a57a43a171a5b79ddbb690a86a8ddda02339cc1675131ae9f8b"
+    },
+    "ghcr.io/github/gh-aw-firewall/squid:0.25.55": {
+      "image": "ghcr.io/github/gh-aw-firewall/squid:0.25.55",
+      "digest": "sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca",
+      "pinned_image": "ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca"
+    },
+    "ghcr.io/github/gh-aw-mcpg:v0.1.4": {
+      "image": "ghcr.io/github/gh-aw-mcpg:v0.1.4",
+      "digest": "sha256:0acf25aa1d409f9c73be9e39ac84f4bd4b90d8bfa1db4dc6d7f47d38ccd58914",
+      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.1.4@sha256:0acf25aa1d409f9c73be9e39ac84f4bd4b90d8bfa1db4dc6d7f47d38ccd58914"
+    },
+    "ghcr.io/github/gh-aw-mcpg:v0.3.19": {
+      "image": "ghcr.io/github/gh-aw-mcpg:v0.3.19",
+      "digest": "sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f",
+      "pinned_image": "ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f"
+    },
+    "ghcr.io/github/github-mcp-server:v0.30.3": {
+      "image": "ghcr.io/github/github-mcp-server:v0.30.3",
+      "digest": "sha256:a2b5fb79b1cee851bfc3532dfe480c3dc5736974ca9d93a7a9f68e52ce4b62a0",
+      "pinned_image": "ghcr.io/github/github-mcp-server:v0.30.3@sha256:a2b5fb79b1cee851bfc3532dfe480c3dc5736974ca9d93a7a9f68e52ce4b62a0"
+    }
+  }
+}
diff --git a/.github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md b/.github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md
new file mode 100644
index 000000000000..72d61b434efa
--- /dev/null
+++ b/.github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md
@@ -0,0 +1,73 @@
+---
+# Report formatting guidelines
+---
+
+## Report Structure Guidelines
+
+### 1. Header Levels
+**Use h3 (###) or lower for all headers in your issue report to maintain proper document hierarchy.**
+
+When creating GitHub issues or discussions:
+- Use `###` (h3) for main sections (e.g., "### Test Summary")
+- Use `####` (h4) for subsections (e.g., "#### Device-Specific Results")
+- Never use `##` (h2) or `#` (h1) in reports - these are reserved for titles
+
+### 2. Progressive Disclosure
+**Wrap detailed test results in `<details><summary>Section Name</summary>` tags to improve readability and reduce scrolling.**
+
+Use collapsible sections for:
+- Verbose details (full test logs, raw data)
+- Secondary information (minor warnings, extra context)
+- Per-item breakdowns when there are many items
+
+Always keep critical information visible (summary, critical issues, key metrics).
+
+### 3. Report Structure Pattern
+
+1. **Overview**: 1-2 paragraphs summarizing key findings
+2. **Critical Information**: Show immediately (summary stats, critical issues)
+3. **Details**: Use `<details><summary>Section Name</summary>` for expanded content
+4. **Context**: Add helpful metadata (workflow run, date, trigger)
+
+### Design Principles (Airbnb-Inspired)
+
+Reports should:
+- **Build trust through clarity**: Most important info immediately visible
+- **Exceed expectations**: Add helpful context like trends, comparisons
+- **Create delight**: Use progressive disclosure to reduce overwhelm
+- **Maintain consistency**: Follow patterns across all reports
+
+### Example Report Structure
+
+```markdown
+### Summary
+- Key metric 1: value
+- Key metric 2: value
+- Status: ✅/⚠️/❌
+
+### Critical Issues
+[Always visible - these are important]
+
+<details>
+<summary>View Detailed Results</summary>
+
+[Comprehensive details, logs, traces]
+
+</details>
+
+<details>
+<summary>View All Warnings</summary>
+
+[Minor issues and potential problems]
+
+</details>
+
+### Recommendations
+[Actionable next steps - keep visible]
+```
+
+## Workflow Run References
+
+- Format run IDs as links: `[§12345](https://github.com/owner/repo/actions/runs/12345)`
+- Include up to 3 most relevant run URLs at end under `**References:**`
+- Do NOT add footer attribution (system adds automatically)
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index cef74aafb4b0..6ffb926f6fa0 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -31,6 +31,8 @@ updates:
       github-actions-dependencies:
         patterns:
           - "*"
+    ignore:
+      - dependency-name: "github/gh-aw-actions/**" # Managed by gh aw compile. Version-locked to the gh-aw compiler; do not bump.
     cooldown:
       default-days: 7
   - package-ecosystem: "maven"
diff --git a/.github/workflows/daily-repo-status.lock.yml b/.github/workflows/daily-repo-status.lock.yml
index c9b85fafafdd..7c3d20a166ea 100644
--- a/.github/workflows/daily-repo-status.lock.yml
+++ b/.github/workflows/daily-repo-status.lock.yml
@@ -1,393 +1,598 @@
-#
-#    ___                   _
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"ae44897dc32d20c421588b31a279653abf436964ad86c58885e0edbfbb2f0416","compiler_version":"v0.76.1","strict":true,"agent_id":"copilot"}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"46d564922b082d0db93244972e8005ea6904ee5f","version":"v0.76.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55","digest":"sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55","digest":"sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55","digest":"sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.19","digest":"sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f"},{"image":"ghcr.io/github/github-mcp-server:v1.0.4","digest":"sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4"},{"image":"node:lts-alpine","digest":"sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14","pinned_image":"node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14"}]}
+#    ___                   _   _
 #   / _ \                 | | (_)
-#  | |_| | __ _  ___ _ __ | |_ _
+#  | |_| | __ _  ___ _ __ | |_ _  ___
 #  |  _  |/ _` |/ _ \ '_ \| __| |/ __|
-#  | | | | (_| |  __/ | | | |_| | (
+#  | | | | (_| |  __/ | | | |_| | (__
 #  \_| |_/\__, |\___|_| |_|\__|_|\___|
 #          __/ |
 #  _    _ |___/
 # | |  | |                / _| |
-# | |  | | ___ _ __ _  __| |_| | _____
+# | |  | | ___ _ __ _  __| |_| | _____      ____
 # | |/\| |/ _ \ '__| |/ /|  _| |/ _ \ \ /\ / / ___|
 # \  /\  / (_) | | | | ( | | | | (_) \ V  V /\__ \
 #  \/  \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
 #
-# This file was automatically generated by gh-aw (v0.45.0). DO NOT EDIT.
+# This file was automatically generated by gh-aw (v0.76.1). DO NOT EDIT.
 #
-# To update this file, edit githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87 and run:
-#   gh aw
+# To update this file, edit githubnext/agentics/workflows/repo-status.md@main and run:
+#   gh aw compile
 # Not all edits will cause changes to this file.
 #
 # For more information: https://github.github.com/gh-aw/introduction/overview/
 #
-# This workflow creates daily repo status reports. It gathers recent
-# activity (issues, PRs, discussions, releases, code changes) and
+# This workflow creates daily repo status reports. It gathers recent repository
+# activity (issues, PRs, discussions, releases, code changes) and generates
 # engaging GitHub issues with productivity insights, community highlights,
 # and project recommendations.
 #
-# Source: githubnext/agentics/workflows/daily-repo-status.md@
+# Source: githubnext/agentics/workflows/repo-status.md@main
+#
+# Secrets used:
+#   - COPILOT_GITHUB_TOKEN
+#   - GH_AW_GITHUB_MCP_SERVER_TOKEN
+#   - GH_AW_GITHUB_TOKEN
+#   - GITHUB_TOKEN
+#
+# Custom actions used:
+#   - actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+#   - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+#   - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+#   - actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+#   - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+#   - github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
 #
-# frontmatter-hash:
+# Container images used:
+#   - ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731
+#   - ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3
+#   - ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca
+#   - ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f
+#   - ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4
+#   - node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14
 
-name: "Daily Repo Status"
-"on":
+name: "Repo Status"
+on:
   schedule:
-  - cron: "25 18 * * *"
+  - cron: "11 19 * * *"
     # Friendly format: daily (scattered)
   workflow_dispatch:
+    inputs:
+      aw_context:
+        default: ""
+        description: "Agent caller context (used internally by Agentic Workflows)."
+        required: false
+        type: string
 
 permissions: {}
 
 concurrency:
   group: "gh-aw-${{ github.workflow }}"
 
-run-name: "Daily Repo Status"
+run-name: "Repo Status"
 
 jobs:
   activation:
-    runs-on: ubuntu-
+    runs-on: ubuntu-slim
     permissions:
-      contents:
+      actions: read
+      contents: read
     outputs:
       comment_id: ""
       comment_repo: ""
+      engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}
+      lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
+      model: ${{ steps.generate_aw_info.outputs.model }}
+      secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
+      setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
+      setup-span-id: ${{ steps.setup.outputs.span-id }}
+      setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+      stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}
     steps:
-      - name: Setup
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
+      - name: Setup Scripts
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+        with:
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Repo Status"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-repo-status.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
+      - name: Generate agentic run info
+        id: generate_aw_info
+        env:
+          GH_AW_INFO_ENGINE_ID: "copilot"
+          GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"
+          GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || 'claude-sonnet-4.6' }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AGENT_VERSION: "1.0.52"
+          GH_AW_INFO_CLI_VERSION: "v0.76.1"
+          GH_AW_INFO_WORKFLOW_NAME: "Repo Status"
+          GH_AW_INFO_EXPERIMENTAL: "false"
+          GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
+          GH_AW_INFO_STAGED: "false"
+          GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]'
+          GH_AW_INFO_FIREWALL_ENABLED: "true"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_AWMG_VERSION: ""
+          GH_AW_INFO_FIREWALL_TYPE: "squid"
+          GH_AW_INFO_FRONTMATTER_SOURCE: "githubnext/agentics/workflows/repo-status.md@main"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_COMPILED_STRICT: "true"
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');
+            await main(core, context);
+      - name: Validate COPILOT_GITHUB_TOKEN secret
+        id: validate-secret
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh" COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-default
+        env:
+          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+      - name: Checkout .github and .agents folders
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          destination: /opt/gh-aw/
-      - name: Check workflow file
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+          persist-credentials: false
+          sparse-checkout: |
+            .github
+            .agents
+            .antigravity
+            .claude
+            .codex
+            .crush
+            .gemini
+            .opencode
+            .pi
+          sparse-checkout-cone-mode: true
+          fetch-depth: 1
+      - name: Save agent config folders for base branch restoration
+        env:
+          GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi"
+          GH_AW_AGENT_FILES: ".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+        # poutine:ignore untrusted_checkout_exec
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
+      - name: Check workflow lock file
+        id: check-lock-file
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_WORKFLOW_FILE: "daily-repo-status.lock.yml"
+          GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/check_workflow_timestamp_api.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');
+            await main();
+      - name: Check compile-agentic version
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_COMPILED_VERSION: "v0.76.1"
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');
+            await main();
+      - name: Create prompt with built-in context
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+          GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl
+          GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
+          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+        # poutine:ignore untrusted_checkout_exec
+        run: |
+          bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
+          {
+          cat << 'GH_AW_PROMPT_603e0a48f86a9470_EOF'
+          <system>
+          GH_AW_PROMPT_603e0a48f86a9470_EOF
+          cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
+          cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
+          cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
+          cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
+          cat << 'GH_AW_PROMPT_603e0a48f86a9470_EOF'
+          <safe-output-tools>
+          Tools: create_issue, missing_tool, missing_data, noop
+          </safe-output-tools>
+          GH_AW_PROMPT_603e0a48f86a9470_EOF
+          cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
+          cat << 'GH_AW_PROMPT_603e0a48f86a9470_EOF'
+          <github-context>
+          The following GitHub context information is available for this workflow:
+          {{#if github.actor}}
+          - **actor**: __GH_AW_GITHUB_ACTOR__
+          {{/if}}
+          {{#if github.repository}}
+          - **repository**: __GH_AW_GITHUB_REPOSITORY__
+          {{/if}}
+          {{#if github.workspace}}
+          - **workspace**: __GH_AW_GITHUB_WORKSPACE__
+          {{/if}}
+          {{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}
+          - **issue-number**: #__GH_AW_EXPR_802A9F6A__
+          {{/if}}
+          {{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}
+          - **discussion-number**: #__GH_AW_EXPR_1A3A194A__
+          {{/if}}
+          {{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}
+          - **pull-request-number**: #__GH_AW_EXPR_463A214A__
+          {{/if}}
+          {{#if github.event.comment.id || github.aw.context.comment_id}}
+          - **comment-id**: __GH_AW_EXPR_FF1D34CE__
+          {{/if}}
+          {{#if github.run_id}}
+          - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
+          {{/if}}
+          </github-context>
+
+          GH_AW_PROMPT_603e0a48f86a9470_EOF
+          cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
+          cat << 'GH_AW_PROMPT_603e0a48f86a9470_EOF'
+          </system>
+          {{#runtime-import .github/workflows/daily-repo-status.md}}
+          GH_AW_PROMPT_603e0a48f86a9470_EOF
+          } > "$GH_AW_PROMPT"
+      - name: Interpolate variables and render templates
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+          GH_AW_ENGINE_ID: "copilot"
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');
             await main();
+      - name: Substitute placeholders
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+          GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
+          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+          GH_AW_MCP_CLI_SERVERS_LIST: '- `safeoutputs` — run `safeoutputs --help` to see available tools'
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+
+            const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');
+
+            // Call the substitution function
+            return await substitutePlaceholders({
+              file: process.env.GH_AW_PROMPT,
+              substitutions: {
+                GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,
+                GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,
+                GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,
+                GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,
+                GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
+                GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
+                GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
+                GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,
+                GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST
+              }
+            });
+      - name: Validate prompt placeholders
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+        # poutine:ignore untrusted_checkout_exec
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh"
+      - name: Print prompt
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+        # poutine:ignore untrusted_checkout_exec
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh"
+      - name: Upload activation artifact
+        if: success()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: activation
+          include-hidden-files: true
+          path: |
+            /tmp/gh-aw/aw_info.json
+            /tmp/gh-aw/aw-prompts/prompt.txt
+            /tmp/gh-aw/aw-prompts/prompt-template.txt
+            /tmp/gh-aw/aw-prompts/prompt-import-tree.json
+            /tmp/gh-aw/github_rate_limits.jsonl
+            /tmp/gh-aw/base
+            /tmp/gh-aw/.github/agents
+            /tmp/gh-aw/.github/skills
+          if-no-files-found: ignore
+          retention-days: 1
 
   agent:
-    needs:
-    runs-on: ubuntu-
+    needs: activation
+    runs-on: ubuntu-latest
     permissions:
-      contents:
-      issues:
-      pull-requests:
+      contents: read
+      issues: read
+      pull-requests: read
     concurrency:
       group: "gh-aw-copilot-${{ github.workflow }}"
     env:
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
       GH_AW_ASSETS_ALLOWED_EXTS: ""
       GH_AW_ASSETS_BRANCH: ""
-      GH_AW_ASSETS_MAX_SIZE_KB:
-      GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/
-      GH_AW_SAFE_OUTPUTS: /opt/gh-aw/safeoutputs/outputs.
-      GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.
-      GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools.
-      GH_AW_WORKFLOW_ID_SANITIZED:
+      GH_AW_ASSETS_MAX_SIZE_KB: 0
+      GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
+      GH_AW_WORKFLOW_ID_SANITIZED: dailyrepostatus
     outputs:
+      agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}
       checkout_pr_success: ${{ steps.checkout-pr.outputs.checkout_pr_success || 'true' }}
+      effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}
+      effective_tokens_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.effective_tokens_rate_limit_error || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
-      model: ${{ steps.generate_aw_info.outputs.model }}
+      inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}
+      mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}
+      model: ${{ needs.activation.outputs.model }}
+      model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
-      secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
+      setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
+      setup-span-id: ${{ steps.setup.outputs.span-id }}
+      setup-trace-id: ${{ steps.setup.outputs.trace-id }}
     steps:
-      - name: Setup
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
+      - name: Setup Scripts
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
         with:
-          destination: /opt/gh-aw/
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Repo Status"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-repo-status.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
+      - name: Set runtime paths
+        id: set-runtime-paths
+        run: |
+          {
+            echo "GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl"
+            echo "GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json"
+            echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
+          } >> "$GITHUB_OUTPUT"
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
-      - name: Create gh-aw temp
-        run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir.
-      - name: Configure Git
+      - name: Create gh-aw temp directory
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
+      - name: Configure gh CLI for GitHub Enterprise
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"
+        env:
+          GH_TOKEN: ${{ github.token }}
+      - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
           SERVER_URL: ${{ github.server_url }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
-          # Re-authenticate git with GitHub
+          git config --global am.keepcr true
+          # Re-authenticate git with GitHub token
           SERVER_URL_STRIPPED="${SERVER_URL#https://}"
-          git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
           echo "Git configured with standard GitHub Actions identity"
-      - name: Checkout PR
-        id: checkout-
+      - name: Checkout PR branch
+        id: checkout-pr
         if: |
-          github.event.
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+          github.event.pull_request || github.event.issue.pull_request
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/checkout_pr_branch.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/checkout_pr_branch.cjs');
             await main();
-      - name: Generate agentic run
-        id:
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+      - name: Install GitHub Copilot CLI
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.52
+        env:
+          GH_HOST: github.com
+      - name: Install AWF binary
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.25.55
+      - name: Parse integrity filter lists
+        id: parse-guard-vars
+        env:
+          GH_AW_BLOCKED_USERS_VAR: ${{ vars.GH_AW_GITHUB_BLOCKED_USERS || '' }}
+          GH_AW_TRUSTED_USERS_VAR: ${{ vars.GH_AW_GITHUB_TRUSTED_USERS || '' }}
+          GH_AW_APPROVAL_LABELS_VAR: ${{ vars.GH_AW_GITHUB_APPROVAL_LABELS || '' }}
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/parse_guard_list.sh"
+      - name: Download activation artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          script: |
-            const fs = require('fs');
-
-            const awInfo = {
-              engine_id: "copilot",
-              engine_name: "GitHub Copilot CLI",
-              model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
-              version: "",
-              agent_version: "0.0.410",
-              cli_version: "v0.45.0",
-              workflow_name: "Daily Repo Status",
-              experimental: false,
-              supports_tools_allowlist: true,
-              supports_http_transport: true,
-              run_id: context.runId,
-              run_number: context.runNumber,
-              run_attempt: process.env.GITHUB_RUN_ATTEMPT,
-              repository: context.repo.owner + '/' + context.repo.repo,
-              ref: context.ref,
-              sha: context.sha,
-              actor: context.actor,
-              event_name: context.eventName,
-              staged: false,
-              allowed_domains: ["defaults"],
-              firewall_enabled: true,
-              awf_version: "v0.18.0",
-              awmg_version: "v0.1.4",
-              steps: {
-                firewall: "squid"
-              },
-              created_at: new Date().toISOString()
-            };
-
-            // Write to /tmp/gh-aw directory to avoid inclusion in
-            const tmpPath = '/tmp/gh-aw/aw_info.json';
-            fs.writeFileSync(tmpPath, JSON.stringify(awInfo, null, 2));
-            console.log('Generated aw_info.json at:', tmpPath);
-            console.log(JSON.stringify(awInfo, null, 2));
-
-            // Set model as output for reuse in other steps/
-            core.setOutput('model', awInfo.model);
-      - name: Validate COPILOT_GITHUB_TOKEN
-        id: validate-
-        run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-
+          name: activation
+          path: /tmp/gh-aw
+      - name: Restore agent config folders from base branch
+        if: steps.checkout-pr.outcome == 'success'
         env:
-          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-      - name: Install GitHub Copilot
-        run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.
-      - name: Install awf
-        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.18.
-      - name: Download container
-        run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.18.0 ghcr.io/github/gh-aw-firewall/squid:0.18.0 ghcr.io/github/gh-aw-mcpg:v0.1.4 ghcr.io/github/github-mcp-server:v0.30.3 node:lts-
-      - name: Write Safe Outputs
+          GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi"
+          GH_AW_AGENT_FILES: ".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_base_github_folders.sh"
+      - name: Restore inline sub-agents from activation artifact
+        env:
+          GH_AW_SUB_AGENT_DIR: ".github/agents"
+          GH_AW_SUB_AGENT_EXT: ".agent.md"
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh"
+      - name: Restore inline skills from activation artifact
+        env:
+          GH_AW_SKILL_DIR: ".github/skills"
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
+      - name: Download container images
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3 ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4 node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14
+      - name: Generate Safe Outputs Config
         run: |
-          mkdir -p /opt/gh-aw/
-          mkdir -p /tmp/gh-aw/
-          mkdir -p /tmp/gh-aw/mcp-logs/
-          cat > /opt/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_EOF'
-          {"create_issue":{"max":1},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
-
-          cat > /opt/gh-aw/safeoutputs/tools.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_EOF'
-          [
+          mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
+          mkdir -p /tmp/gh-aw/safeoutputs
+          mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
+          cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_9b6646f0d620a78f_EOF'
+          {"create_issue":{"close_older_issues":true,"labels":["report","daily-status"],"max":1,"title_prefix":"[repo-status] "},"create_report_incomplete_issue":{},"mentions":{"enabled":false},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
+          GH_AW_SAFE_OUTPUTS_CONFIG_9b6646f0d620a78f_EOF
+      - name: Generate Safe Outputs Tools
+        env:
+          GH_AW_TOOLS_META_JSON: |
             {
-              "description": "Create a new GitHub issue for tracking bugs, feature requests, or tasks. Use this for actionable work items that need assignment, labeling, and status tracking. For reports, announcements, or status updates that don't require task tracking, use create_discussion instead. CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"[repo-status] \". Labels [report daily-status] will be automatically added.",
-              "inputSchema": {
-                "additionalProperties": false,
-                "properties": {
+              "description_suffixes": {
+                "create_issue": " CONSTRAINTS: Maximum 1 issue(s) can be created. Title will be prefixed with \"[repo-status] \". Labels [\"report\" \"daily-status\"] will be automatically added."
+              },
+              "repo_params": {},
+              "dynamic_tools": []
+            }
+          GH_AW_VALIDATION_JSON: |
+            {
+              "create_issue": {
+                "defaultMax": 1,
+                "fields": {
                   "body": {
-                    "description": "Detailed issue description in Markdown. Do NOT repeat the title as a heading since it already appears as the issue's h1. Include context, reproduction steps, or acceptance criteria as appropriate.",
-                    "type": "string"
+                    "required": true,
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 65000
                   },
-                  "labels": {
-                    "description": "Labels to categorize the issue (e.g., 'bug', 'enhancement'). Labels must exist in the repository.",
-                    "items": {
-                      "type": "string"
-                    },
+                  "fields": {
                     "type": "array"
                   },
+                  "labels": {
+                    "type": "array",
+                    "itemType": "string",
+                    "itemSanitize": true,
+                    "itemMaxLength": 128
+                  },
                   "parent": {
-                    "description": "Parent issue number for creating sub-issues. This is the numeric ID from the GitHub URL (e.g., 42 in github.com/owner/repo/issues/42). Can also be a temporary_id (e.g., 'aw_abc123', 'aw_Test123') from a previously created issue in the same workflow run.",
-                    "type": [
-                      "number",
-                      "string"
-                    ]
+                    "issueOrPRNumber": true
+                  },
+                  "repo": {
+                    "type": "string",
+                    "maxLength": 256
                   },
                   "temporary_id": {
-                    "description": "Unique temporary identifier for referencing this issue before it's created. Format: 'aw_' followed by 3 to 8 alphanumeric characters (e.g., 'aw_abc1', 'aw_Test123'). Use '#aw_ID' in body text to reference other issues by their temporary_id; these are replaced with actual issue numbers after creation.",
-                    "pattern": "^aw_[A-Za-z0-9]{4,8}$",
                     "type": "string"
                   },
                   "title": {
-                    "description": "Concise issue title summarizing the bug, feature, or task. The title appears as the main heading, so keep it brief and descriptive.",
-                    "type": "string"
+                    "required": true,
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 128
                   }
-                },
-                "required": [
-                  "title",
-                  "body"
-                ],
-                "type": "object"
+                }
               },
-              "name": "create_issue"
-            },
-            {
-              "description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
-              "inputSchema": {
-                "additionalProperties": false,
-                "properties": {
+              "missing_data": {
+                "defaultMax": 20,
+                "fields": {
                   "alternatives": {
-                    "description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
-                    "type": "string"
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 256
+                  },
+                  "context": {
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 256
+                  },
+                  "data_type": {
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 128
                   },
                   "reason": {
-                    "description": "Explanation of why this tool is needed or what information you want to share about the limitation (max 256 characters).",
-                    "type": "string"
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 256
+                  }
+                }
+              },
+              "missing_tool": {
+                "defaultMax": 20,
+                "fields": {
+                  "alternatives": {
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 512
+                  },
+                  "reason": {
+                    "required": true,
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 256
                   },
                   "tool": {
-                    "description": "Optional: Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
-                    "type": "string"
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 128
                   }
-                },
-                "required": [
-                  "reason"
-                ],
-                "type": "object"
+                }
               },
-              "name": "missing_tool"
-            },
-            {
-              "description": "Log a transparency message when no significant actions are needed. Use this to confirm workflow completion and provide visibility when analysis is complete but no changes or outputs are required (e.g., 'No issues found', 'All checks passed'). This ensures the workflow produces human-visible output even when no other actions are taken.",
-              "inputSchema": {
-                "additionalProperties": false,
-                "properties": {
+              "noop": {
+                "defaultMax": 1,
+                "fields": {
                   "message": {
-                    "description": "Status or completion message to log. Should explain what was analyzed and the outcome (e.g., 'Code review complete - no issues found', 'Analysis complete - all tests passing').",
-                    "type": "string"
+                    "required": true,
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 65000
                   }
-                },
-                "required": [
-                  "message"
-                ],
-                "type": "object"
+                }
               },
-              "name": "noop"
-            },
-            {
-              "description": "Report that data or information needed to complete the task is not available. Use this when you cannot accomplish what was requested because required data, context, or information is missing.",
-              "inputSchema": {
-                "additionalProperties": false,
-                "properties": {
-                  "alternatives": {
-                    "description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
-                    "type": "string"
-                  },
-                  "context": {
-                    "description": "Additional context about the missing data or where it should come from (max 256 characters).",
-                    "type": "string"
-                  },
-                  "data_type": {
-                    "description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.",
-                    "type": "string"
+              "report_incomplete": {
+                "defaultMax": 5,
+                "fields": {
+                  "details": {
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 65000
                   },
                   "reason": {
-                    "description": "Explanation of why this data is needed to complete the task (max 256 characters).",
-                    "type": "string"
+                    "required": true,
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 1024
                   }
-                },
-                "required": [],
-                "type": "object"
-              },
-              "name": "missing_data"
-            }
-          ]
-
-          cat > /opt/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_EOF'
-          {
-            "create_issue": {
-              "defaultMax": 1,
-              "fields": {
-                "body": {
-                  "required": true,
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength":
-                },
-                "labels": {
-                  "type": "array",
-                  "itemType": "string",
-                  "itemSanitize": true,
-                  "itemMaxLength":
-                },
-                "parent": {
-                  "issueOrPRNumber":
-                },
-                "repo": {
-                  "type": "string",
-                  "maxLength":
-                },
-                "temporary_id": {
-                  "type": "string"
-                },
-                "title": {
-                  "required": true,
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength":
-                }
-              }
-            },
-            "missing_tool": {
-              "defaultMax": 20,
-              "fields": {
-                "alternatives": {
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength":
-                },
-                "reason": {
-                  "required": true,
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength":
-                },
-                "tool": {
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength":
-                }
-              }
-            },
-            "noop": {
-              "defaultMax": 1,
-              "fields": {
-                "message": {
-                  "required": true,
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength":
                 }
               }
             }
-          }
-
-      - name: Generate Safe Outputs MCP Server
-        id: safe-outputs-
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');
+            await main();
+      - name: Generate Safe Outputs MCP Server Config
+        id: safe-outputs-config
         run: |
           # Generate a secure random API key (360 bits of entropy, 40+ chars)
-          # Mask immediately to prevent timing
+          # Mask immediately to prevent timing vulnerabilities
           API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
           echo "::add-mask::${API_KEY}"
 
-          PORT=
+          PORT=3001
 
-          # Set outputs for next
+          # Set outputs for next steps
           {
             echo "safe_outputs_api_key=${API_KEY}"
             echo "safe_outputs_port=${PORT}"
@@ -395,61 +600,84 @@ jobs:
 
           echo "Safe Outputs MCP server will run on port ${PORT}"
 
-      - name: Start Safe Outputs MCP HTTP
-        id: safe-outputs-
+      - name: Start Safe Outputs MCP HTTP Server
+        id: safe-outputs-start
         env:
           DEBUG: '*'
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
           GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-config.outputs.safe_outputs_port }}
           GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-config.outputs.safe_outputs_api_key }}
-          GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools.
-          GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.
-          GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/
+          GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/tools.json
+          GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/config.json
+          GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
         run: |
-          # Environment variables are set above to prevent template
-          export
-          export
-          export
-          export
-          export
-          export
+          # Environment variables are set above to prevent template injection
+          export DEBUG
+          export GH_AW_SAFE_OUTPUTS
+          export GH_AW_SAFE_OUTPUTS_PORT
+          export GH_AW_SAFE_OUTPUTS_API_KEY
+          export GH_AW_SAFE_OUTPUTS_TOOLS_PATH
+          export GH_AW_SAFE_OUTPUTS_CONFIG_PATH
+          export GH_AW_MCP_LOG_DIR
 
-          bash /opt/gh-aw/actions/start_safe_outputs_server.
+          bash "${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh"
 
-      - name: Start MCP
-        id: start-mcp-
+      - name: Start MCP Gateway
+        id: start-mcp-gateway
         env:
-          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
           GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}
           GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}
           GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
-          set -eo
-          mkdir -p /tmp/gh-aw/mcp-
+          set -eo pipefail
+          mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config"
 
-          # Export gateway environment variables for MCP config and gateway
-          export MCP_GATEWAY_PORT="80"
+          # Export gateway environment variables for MCP config and gateway script
+          export MCP_GATEWAY_PORT="8080"
           export MCP_GATEWAY_DOMAIN="host.docker.internal"
+          export MCP_GATEWAY_HOST_DOMAIN="localhost"
           MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
           echo "::add-mask::${MCP_GATEWAY_API_KEY}"
-          export
+          export MCP_GATEWAY_API_KEY
           export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
           mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
+          export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288"
           export DEBUG="*"
 
           export GH_AW_ENGINE="copilot"
-          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.4'
+          MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')
+          MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')
+          case "${DOCKER_HOST:-}" in
+            unix://* ) DOCKER_SOCK_PATH="${DOCKER_HOST#unix://}" ;;
+            /* ) DOCKER_SOCK_PATH="$DOCKER_HOST" ;;
+            * ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;
+          esac
+          DOCKER_SOCK_GID=$(stat -c '%g' "$DOCKER_SOCK_PATH" 2>/dev/null || echo '0')
+          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.3.19'
 
-          mkdir -p /home/runner/.
-          cat << GH_AW_MCP_CONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.
+          mkdir -p /home/runner/.copilot
+          GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
+          cat << GH_AW_MCP_CONFIG_d075a7f45ab51044_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
           {
             "mcpServers": {
               "github": {
                 "type": "stdio",
-                "container": "ghcr.io/github/github-mcp-server:v0.30.3",
+                "container": "ghcr.io/github/github-mcp-server:v1.0.4",
                 "env": {
+                  "GITHUB_HOST": "\${GITHUB_SERVER_URL}",
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
                   "GITHUB_READ_ONLY": "1",
                   "GITHUB_TOOLSETS": "context,repos,issues,pull_requests"
+                },
+                "guard-policies": {
+                  "allow-only": {
+                    "approval-labels": ${{ steps.parse-guard-vars.outputs.approval_labels }},
+                    "blocked-users": ${{ steps.parse-guard-vars.outputs.blocked_users }},
+                    "min-integrity": "none",
+                    "repos": "all",
+                    "trusted-users": ${{ steps.parse-guard-vars.outputs.trusted_users }}
+                  }
                 }
               },
               "safeoutputs": {
@@ -457,6 +685,13 @@ jobs:
                 "url": "http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT",
                 "headers": {
                   "Authorization": "\${GH_AW_SAFE_OUTPUTS_API_KEY}"
+                },
+                "guard-policies": {
+                  "write-sink": {
+                    "accept": [
+                      "*"
+                    ]
+                  }
                 }
               }
             },
@@ -467,212 +702,113 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-
-      - name: Generate workflow
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
-        with:
-          script: |
-            const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
-            await generateWorkflowOverview(core);
-      - name: Create prompt with built-in
-        env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.
-          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
-          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
-          GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
-          GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
-          GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
-          GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
-          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
-          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
-          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
-        run: |
-          bash /opt/gh-aw/actions/create_prompt_first.
-          cat << 'GH_AW_PROMPT_EOF' > "$GH_AW_PROMPT"
-          <system>
-
-          cat "/opt/gh-aw/prompts/xpia.md" >> "$GH_AW_PROMPT"
-          cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
-          cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
-          cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
-          <safe-outputs>
-          <description>GitHub API Access Instructions</description>
-          <important>
-          The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
-          </important>
-          <instructions>
-          To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
-
-          Temporary IDs: Some safe output tools support a temporary ID field (usually named temporary_id) so you can reference newly-created items elsewhere in the SAME agent output (for example, using #aw_abc1 in a later body).
-
-          **IMPORTANT - temporary_id format rules:**
-          - If you DON'T need to reference the item later, OMIT the temporary_id field entirely (it will be auto-generated if needed)
-          - If you DO need cross-references/chaining, you MUST match this EXACT validation regex: /^aw_[A-Za-z0-9]{3,8}$/
-          - Format: aw_ prefix followed by 3 to 8 alphanumeric characters (A-Z, a-z, 0-9, case-insensitive)
-          - Valid alphanumeric characters:
-          - INVALID examples: aw_ab (too short), aw_123456789 (too long), aw_test-id (contains hyphen), aw_id_123 (contains underscore)
-          - VALID examples: aw_abc, aw_abc1, aw_Test123, aw_A1B2C3D4,
-          - To generate valid IDs: use 3-8 random alphanumeric characters or omit the field to let the system auto-
-
-          Do NOT invent other aw_* formats — downstream steps will reject them with validation errors matching against /^aw_[A-Za-z0-9]{3,8}$/i.
-
-          Discover available tools from the safeoutputs MCP server.
-
-          **Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
-
-          **Note**: If you made no other safe output tool calls during this workflow execution, call the "noop" tool to provide a status message indicating completion or that no actions were needed.
-          </instructions>
-          </safe-outputs>
-          <github-context>
-          The following GitHub context information is available for this workflow:
-          {{#if __GH_AW_GITHUB_ACTOR__ }}
-          - **actor**:
-          {{/if}}
-          {{#if __GH_AW_GITHUB_REPOSITORY__ }}
-          - **repository**:
-          {{/if}}
-          {{#if __GH_AW_GITHUB_WORKSPACE__ }}
-          - **workspace**:
-          {{/if}}
-          {{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
-          - **issue-number**: #
-          {{/if}}
-          {{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
-          - **discussion-number**: #
-          {{/if}}
-          {{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
-          - **pull-request-number**: #
-          {{/if}}
-          {{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
-          - **comment-id**:
-          {{/if}}
-          {{#if __GH_AW_GITHUB_RUN_ID__ }}
-          - **workflow-run-id**:
-          {{/if}}
-          </github-context>
-
-
-          cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
-          </system>
-
-          cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
-          {{#runtime-import .github/workflows/daily-repo-status.md}}
-
-      - name: Substitute
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
-        env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.
-          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
-          GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
-          GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
-          GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
-          GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
-          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
-          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
-          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
-        with:
-          script: |
-            const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
-
-            // Call the substitution
-            return await substitutePlaceholders({
-              file: process.env.GH_AW_PROMPT,
-              substitutions: {
-                GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
-                GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
-                GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
-                GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
-                GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
-                GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
-                GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
-                GH_AW_GITHUB_WORKSPACE: process.env.
-              }
-            });
-      - name: Interpolate variables and render
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+          GH_AW_MCP_CONFIG_d075a7f45ab51044_EOF
+      - name: Mount MCP servers as CLIs
+        id: mount-mcp-clis
+        continue-on-error: true
         env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.
+          MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
+          MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}
+          MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
             setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');
             await main();
-      - name: Validate prompt
-        env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.
-        run: bash /opt/gh-aw/actions/validate_prompt_placeholders.
-      - name: Print
-        env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.
-        run: bash /opt/gh-aw/actions/print_prompt_summary.
-      - name: Clean git
-        run: bash /opt/gh-aw/actions/clean_git_credentials.
-      - name: Execute GitHub Copilot
-        id:
+      - name: Clean credentials
+        continue-on-error: true
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"
+      - name: Audit pre-agent workspace
+        id: pre_agent_audit
+        continue-on-error: true
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
+      - name: Execute GitHub Copilot CLI
+        id: agentic_execution
         # Copilot CLI tool arguments (sorted):
-        timeout-minutes:
+        timeout-minutes: 20
         run: |
-          set -o
-          sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.18.0 --skip-pull \
-            -- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.
+          set -o pipefail
+          printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
+          touch /tmp/gh-aw/agent-step-summary.md
+          GH_AW_NODE_BIN=$(command -v node 2>/dev/null || true)
+          export GH_AW_NODE_BIN
+          export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK"
+          (umask 177 && touch /tmp/gh-aw/agent-stdio.log)
+          printf '%s\n' '{"$schema":"https://github.com/github/gh-aw-firewall/releases/download/v0.25.55/awf-config.schema.json","network":{"allowDomains":["api.business.githubcopilot.com","api.enterprise.githubcopilot.com","api.github.com","api.githubcopilot.com","api.individual.githubcopilot.com","api.snapcraft.io","archive.ubuntu.com","azure.archive.ubuntu.com","crl.geotrust.com","crl.globalsign.com","crl.identrust.com","crl.sectigo.com","crl.thawte.com","crl.usertrust.com","crl.verisign.com","crl3.digicert.com","crl4.digicert.com","crls.ssl.com","github.com","host.docker.internal","json-schema.org","json.schemastore.org","keyserver.ubuntu.com","ocsp.digicert.com","ocsp.geotrust.com","ocsp.globalsign.com","ocsp.identrust.com","ocsp.sectigo.com","ocsp.ssl.com","ocsp.thawte.com","ocsp.usertrust.com","ocsp.verisign.com","packagecloud.io","packages.cloud.google.com","packages.microsoft.com","ppa.launchpad.net","raw.githubusercontent.com","registry.npmjs.org","s.symcb.com","s.symcd.com","security.ubuntu.com","telemetry.enterprise.githubcopilot.com","ts-crl.ws.symantec.com","ts-ocsp.ws.symantec.com","www.googleapis.com"]},"apiProxy":{"enabled":true,"enableTokenSteering":true,"maxRuns":500,"maxEffectiveTokens":25000000,"models":{"agent":["sonnet-6x","gpt-5.4","gpt-5.3","gemini-pro","any"],"antigravity":["copilot/antigravity*","google/antigravity*","gemini/antigravity*"],"any":["copilot/*","anthropic/*","openai/*","google/*","gemini/*"],"claude":["agent"],"codex":["agent"],"coding":["copilot/gpt-5*codex*","openai/gpt-5*codex*","gpt-5-codex"],"computer-use":["copilot/*computer-use*","google/*computer-use*","gemini/*computer-use*","openai/*computer-use*"],"copilot":["agent"],"deep-research":["copilot/deep-research*","copilot/o3-deep-research*","copilot/o4-mini-deep-research*","google/deep-research*","gemini/deep-research*","openai/o3-deep-research*","openai/o4-mini-deep-research*"],"gemini":["agent"],"gemini-3-flash":["copilot/gemini-3*flash*","google/gemini-3*flash*","gemini/gemini-3*flash*"],"gemini-3-pro":["copilot/gemini-3*pro*","google/gemini-3*pro*","gemini/gemini-3*pro*"],"gemini-3.1-flash":["copilot/gemini-3.1*flash*","google/gemini-3.1*flash*","gemini/gemini-3.1*flash*"],"gemini-3.1-pro":["copilot/gemini-3.1*pro*","google/gemini-3.1*pro*","gemini/gemini-3.1*pro*"],"gemini-3.5-flash":["copilot/gemini-3.5*flash*","google/gemini-3.5*flash*","gemini/gemini-3.5*flash*"],"gemini-flash":["copilot/gemini-*flash*","google/gemini-*flash*","gemini/gemini-*flash*"],"gemini-flash-lite":["copilot/gemini-*flash*lite*","google/gemini-*flash*lite*","gemini/gemini-*flash*lite*"],"gemini-pro":["copilot/gemini-*pro*","google/gemini-*pro*","gemini/gemini-*pro*"],"gemma":["copilot/gemma*","google/gemma*","gemini/gemma*"],"gpt-4.1":["copilot/gpt-4.1*","openai/gpt-4.1*"],"gpt-5":["copilot/gpt-5*","openai/gpt-5*"],"gpt-5-codex":["copilot/gpt-5*codex*","openai/gpt-5*codex*"],"gpt-5-mini":["copilot/gpt-5*mini*","openai/gpt-5*mini*"],"gpt-5-nano":["copilot/gpt-5*nano*","openai/gpt-5*nano*"],"gpt-5-pro":["copilot/gpt-5*pro*","openai/gpt-5*pro*"],"gpt-5.2":["copilot/gpt-5.2*","openai/gpt-5.2*"],"gpt-5.3":["copilot/gpt-5.3*","openai/gpt-5.3*"],"gpt-5.4":["copilot/gpt-5.4*","openai/gpt-5.4*"],"gpt-5.5":["copilot/gpt-5.5*","openai/gpt-5.5*"],"haiku":["copilot/*haiku*","anthropic/*haiku*"],"large":["sonnet","gpt-5-pro","gpt-5","gemini-pro"],"mini":["haiku","gpt-5-mini","gpt-5-nano","gemini-flash-lite"],"opus":["copilot/*opus*","anthropic/*opus*"],"opusplan":["opus?effort=high"],"reasoning":["copilot/o1*","copilot/o3*","copilot/o4*","openai/o1*","openai/o3*","openai/o4*"],"robotics":["copilot/*robotics*","google/*robotics*","gemini/*robotics*"],"small":["mini"],"sonnet":["copilot/*sonnet*","anthropic/*sonnet*"],"sonnet-6x":["copilot/*sonnet-4-5-*","anthropic/*sonnet-4-5-*","copilot/*sonnet-4-6*","anthropic/*sonnet-4-6*"],"summarization":["haiku","gpt-5-mini","gemini-flash-lite","mini"],"vision":["copilot/gemini-*image*","gemini/gemini-*image*","copilot/gemini-*flash*","gemini/gemini-*flash*"]}},"container":{"imageTag":"0.25.55,squid=sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca,agent=sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731,api-proxy=sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3"}}' > "${RUNNER_TEMP}/gh-aw/awf-config.json"
+          cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
+          GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=""
+          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
+            GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS="--docker-host-path-prefix /tmp/gh-aw"
+          fi
+          # shellcheck disable=SC1003
+          sudo -E awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \
+            -- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
-          COPILOT_AGENT_RUNNER_TYPE:
+          AWF_REFLECT_ENABLED: 1
+          COPILOT_AGENT_RUNNER_TYPE: STANDALONE
+          COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-          GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.
-          GH_AW_MODEL_AGENT_COPILOT: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || '' }}
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.
-          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
+          COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || 'claude-sonnet-4.6' }}
+          GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json
+          GH_AW_PHASE: agent
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+          GH_AW_VERSION: v0.76.1
+          GITHUB_API_URL: ${{ github.api_url }}
+          GITHUB_AW: true
+          GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
           GITHUB_HEAD_REF: ${{ github.head_ref }}
+          GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           GITHUB_REF_NAME: ${{ github.ref_name }}
-          GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
           GITHUB_WORKSPACE: ${{ github.workspace }}
-          XDG_CONFIG_HOME: /home/
-      - name: Configure Git
+          GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: github-actions[bot]
+          XDG_CONFIG_HOME: /home/runner
+      - name: Detect agent errors
+        if: always()
+        id: detect-agent-errors
+        continue-on-error: true
+        run: node "${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs"
+      - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
           SERVER_URL: ${{ github.server_url }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
-          # Re-authenticate git with GitHub
+          git config --global am.keepcr true
+          # Re-authenticate git with GitHub token
           SERVER_URL_STRIPPED="${SERVER_URL#https://}"
-          git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
           echo "Git configured with standard GitHub Actions identity"
-      - name: Copy Copilot session state files to
+      - name: Copy Copilot session state files to logs
         if: always()
-        continue-on-error:
-        run: |
-          # Copy Copilot session state files to logs folder for artifact
-          # This ensures they are in /tmp/gh-aw/ where secret redaction can scan
-          SESSION_STATE_DIR="$HOME/.copilot/session-state"
-          LOGS_DIR="/tmp/gh-aw/sandbox/agent/logs"
-
-          if [ -d "$SESSION_STATE_DIR" ];
-            echo "Copying Copilot session state files from $SESSION_STATE_DIR to $LOGS_DIR"
-            mkdir -p "$LOGS_DIR"
-            cp -v "$SESSION_STATE_DIR"/*.jsonl "$LOGS_DIR/" 2>/dev/null ||
-            echo "Session state files copied successfully"
-
-            echo "No session-state directory found at $SESSION_STATE_DIR"
-
-      - name: Stop MCP
+        continue-on-error: true
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/copy_copilot_session_state.sh"
+      - name: Stop MCP Gateway
         if: always()
-        continue-on-error:
+        continue-on-error: true
         env:
           MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
           MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
           GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
         run: |
-          bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
-      - name: Redact secrets in
+          bash "${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh" "$GATEWAY_PID"
+      - name: Redact secrets in logs
         if: always()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/redact_secrets.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');
             await main();
         env:
           GH_AW_SECRET_NAMES: 'COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN'
@@ -680,343 +816,579 @@ jobs:
           SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
           SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
           SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Upload Safe
+      - name: Append agent step summary
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
-        with:
-          name: safe-
-          path: ${{ env.GH_AW_SAFE_OUTPUTS }}
-          if-no-files-found:
-      - name: Ingest agent
-        id:
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh"
+      - name: Copy Safe Outputs
         if: always()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
         env:
-          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
-          GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+        run: |
+          mkdir -p /tmp/gh-aw
+          cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true
+      - name: Ingest agent output
+        id: collect_output
+        if: always()
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+          GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+          GH_AW_ALLOWED_GITHUB_REFS: ""
           GITHUB_SERVER_URL: ${{ github.server_url }}
           GITHUB_API_URL: ${{ github.api_url }}
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/collect_ndjson_output.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');
             await main();
-      - name: Upload sanitized agent
-        if: always() && env.
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
-        with:
-          name: agent-
-          path: ${{ env.GH_AW_AGENT_OUTPUT }}
-          if-no-files-found:
-      - name: Upload engine output
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
-        with:
-          name:
-          path: |
-            /tmp/gh-aw/sandbox/agent/logs/
-            /tmp/gh-aw/redacted-urls.
-          if-no-files-found:
-      - name: Parse agent logs for step
+      - name: Parse agent logs for step summary
         if: always()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/parse_copilot_log.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_copilot_log.cjs');
             await main();
-      - name: Parse MCP Gateway logs for step
+      - name: Parse MCP Gateway logs for step summary
         if: always()
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+        id: parse-mcp-gateway
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/parse_mcp_gateway_log.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');
             await main();
-      - name: Print firewall
+      - name: Print firewall logs
         if: always()
-        continue-on-error:
+        continue-on-error: true
         env:
-          AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/
+          AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
         run: |
-          # Fix permissions on firewall logs so they can be uploaded as
-          # AWF runs with sudo, creating files owned by
-          sudo chmod -R a+r /tmp/gh-aw/sandbox/firewall/logs 2>/dev/null ||
+          # Fix permissions on firewall logs/audit dirs so they can be uploaded as artifacts
+          # AWF runs with sudo, creating files owned by root
+          sudo chmod -R a+rX /tmp/gh-aw/sandbox/firewall 2>/dev/null || true
           # Only run awf logs summary if awf command exists (it may not be installed if workflow failed before install step)
-          if command -v awf &> /dev/null;
+          if command -v awf &> /dev/null; then
             awf logs summary | tee -a "$GITHUB_STEP_SUMMARY"
-
+          else
             echo 'AWF binary not installed, skipping firewall log summary'
-
-      - name: Upload agent
+          fi
+      - name: Parse token usage for step summary
+        if: always()
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');
+            await main();
+      - name: Print AWF reflect summary
+        if: always()
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs');
+            await main();
+      - name: Write agent output placeholder if missing
         if: always()
-        continue-on-error:
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
+        run: |
+          if [ ! -f /tmp/gh-aw/agent_output.json ]; then
+            echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
+          fi
+      - name: Upload agent artifacts
+        if: always()
+        continue-on-error: true
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: agent-
+          name: agent
           path: |
-            /tmp/gh-aw/aw-prompts/prompt.
-            /tmp/gh-aw/aw_info.
+            /tmp/gh-aw/aw-prompts/prompt.txt
+            /tmp/gh-aw/sandbox/agent/logs/
+            /tmp/gh-aw/redacted-urls.log
             /tmp/gh-aw/mcp-logs/
-            /tmp/gh-aw/sandbox/firewall/logs/
-            /tmp/gh-aw/agent-stdio.
+            /tmp/gh-aw/proxy-logs/
+            !/tmp/gh-aw/proxy-logs/proxy-tls/
+            /tmp/gh-aw/agent_usage.json
+            /tmp/gh-aw/agent-stdio.log
+            /tmp/gh-aw/pre-agent-audit.txt
             /tmp/gh-aw/agent/
-          if-no-files-found:
+            /tmp/gh-aw/github_rate_limits.jsonl
+            /tmp/gh-aw/safeoutputs.jsonl
+            /tmp/gh-aw/agent_output.json
+            /tmp/gh-aw/aw-*.patch
+            /tmp/gh-aw/aw-*.bundle
+            /tmp/gh-aw/awf-config.json
+            /tmp/gh-aw/sandbox/firewall/logs/
+            /tmp/gh-aw/sandbox/firewall/audit/
+            /tmp/gh-aw/sandbox/firewall/awf-reflect.json
+          if-no-files-found: ignore
 
   conclusion:
     needs:
-      -
-      -
-      -
-      -
-    if: (always()) && (needs.agent.result != 'skipped')
-    runs-on: ubuntu-
+      - activation
+      - agent
+      - detection
+      - safe_outputs
+    if: >
+      always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||
+      needs.activation.outputs.stale_lock_file_failed == 'true')
+    runs-on: ubuntu-slim
     permissions:
-      contents:
-      issues:
+      contents: read
+      issues: write
+    concurrency:
+      group: "gh-aw-conclusion-daily-repo-status"
+      cancel-in-progress: false
+      queue: max
     outputs:
+      incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}
       noop_message: ${{ steps.noop.outputs.noop_message }}
       tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
       total_count: ${{ steps.missing_tool.outputs.total_count }}
     steps:
-      - name: Setup
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
+      - name: Setup Scripts
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
         with:
-          destination: /opt/gh-aw/
-      - name: Download agent output
-        continue-on-error:
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Repo Status"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-repo-status.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
+      - name: Download agent output artifact
+        id: download-agent-output
+        continue-on-error: true
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: agent-
-          path: /tmp/gh-aw/safeoutputs/
-      - name: Setup agent output environment
+          name: agent
+          path: /tmp/gh-aw/
+      - name: Setup agent output environment variable
+        id: setup-agent-output-env
+        if: steps.download-agent-output.outcome == 'success'
         run: |
-          mkdir -p /tmp/gh-aw/safeoutputs/
-          find "/tmp/gh-aw/safeoutputs/" -type f -
-          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
-      - name: Process No-Op
-        id:
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
-        env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX:
-          GH_AW_WORKFLOW_NAME: "Daily Repo Status"
-          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md"
+          mkdir -p /tmp/gh-aw/
+          find "/tmp/gh-aw/" -type f -print
+          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+      - name: Process no-op messages
+        id: noop
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_NOOP_MAX: "1"
+          GH_AW_WORKFLOW_NAME: "Repo Status"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/repo-status.md@main"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/main/workflows/repo-status.md"
+          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
+          GH_AW_NOOP_REPORT_AS_ISSUE: "true"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/noop.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');
             await main();
-      - name: Record Missing
-        id:
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+      - name: Log detection run
+        id: detection_runs
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_WORKFLOW_NAME: "Daily Repo Status"
-          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md"
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_WORKFLOW_NAME: "Repo Status"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/repo-status.md@main"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/main/workflows/repo-status.md"
+          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
+          GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/missing_tool.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs');
             await main();
-      - name: Handle Agent
-        id:
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
-        env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_WORKFLOW_NAME: "Daily Repo Status"
-          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md"
-          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
-          GH_AW_WORKFLOW_ID: "daily-repo-status"
-          GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }}
-          GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+      - name: Record missing tool
+        id: missing_tool
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_MISSING_TOOL_CREATE_ISSUE: "true"
+          GH_AW_WORKFLOW_NAME: "Repo Status"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/repo-status.md@main"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/main/workflows/repo-status.md"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/handle_agent_failure.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');
             await main();
-      - name: Handle No-Op
-        id:
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
-        env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_WORKFLOW_NAME: "Daily Repo Status"
-          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md"
+      - name: Record incomplete
+        id: report_incomplete
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true"
+          GH_AW_WORKFLOW_NAME: "Repo Status"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/repo-status.md@main"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/main/workflows/repo-status.md"
+        with:
+          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');
+            await main();
+      - name: Handle agent failure
+        id: handle_agent_failure
+        if: always()
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_WORKFLOW_NAME: "Repo Status"
+          GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/repo-status.md@main"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/main/workflows/repo-status.md"
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
-          GH_AW_NOOP_MESSAGE: ${{ steps.noop.outputs.noop_message }}
-          GH_AW_NOOP_REPORT_AS_ISSUE: "true"
+          GH_AW_WORKFLOW_ID: "daily-repo-status"
+          GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168"
+          GH_AW_ENGINE_ID: "copilot"
+          GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
+          GH_AW_CHECKOUT_PR_SUCCESS: ${{ needs.agent.outputs.checkout_pr_success }}
+          GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}
+          GH_AW_EFFECTIVE_TOKENS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.effective_tokens_rate_limit_error || 'false' }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}
+          GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}
+          GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}
+          GH_AW_ENGINE_API_HOSTS: "api.enterprise.githubcopilot.com,api.githubcopilot.com,api.business.githubcopilot.com,api.individual.githubcopilot.com"
+          GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}
+          GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}
+          GH_AW_GROUP_REPORTS: "false"
+          GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
+          GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true"
+          GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true"
+          GH_AW_TIMEOUT_MINUTES: "20"
+          GH_AW_MAX_EFFECTIVE_TOKENS: "25000000"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/handle_noop_message.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');
             await main();
 
   detection:
     needs:
-    if: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true'
-    runs-on: ubuntu-
-    permissions: {}
-    concurrency:
-      group: "gh-aw-copilot-${{ github.workflow }}"
-    timeout-minutes:
+      - activation
+      - agent
+    if: >
+      always() && needs.agent.result != 'skipped' && (needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true')
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
     outputs:
-      success: ${{ steps.parse_results.outputs.success }}
+      detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
+      detection_reason: ${{ steps.detection_conclusion.outputs.reason }}
+      detection_success: ${{ steps.detection_conclusion.outputs.success }}
     steps:
-      - name: Setup
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
+      - name: Setup Scripts
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
         with:
-          destination: /opt/gh-aw/
-      - name: Download agent
-        continue-on-error:
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Repo Status"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-repo-status.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
+      - name: Download agent output artifact
+        id: download-agent-output
+        continue-on-error: true
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: agent-
-          path: /tmp/gh-aw/threat-detection/
-      - name: Download agent output
-        continue-on-error:
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+          name: agent
+          path: /tmp/gh-aw/
+      - name: Setup agent output environment variable
+        id: setup-agent-output-env
+        if: steps.download-agent-output.outcome == 'success'
+        run: |
+          mkdir -p /tmp/gh-aw/
+          find "/tmp/gh-aw/" -type f -print
+          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+      - name: Checkout repository for patch context
+        if: needs.agent.outputs.has_patch == 'true'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
-          name: agent-
-          path: /tmp/gh-aw/threat-detection/
-      - name: Echo agent output
+          persist-credentials: false
+      # --- Threat Detection ---
+      - name: Clean stale firewall files from agent artifact
+        run: |
+          rm -rf /tmp/gh-aw/sandbox/firewall/logs
+          rm -rf /tmp/gh-aw/sandbox/firewall/audit
+      - name: Download container images
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3 ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca
+      - name: Check if detection needed
+        id: detection_guard
+        if: always()
         env:
-          AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
+          OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
+          HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
+        run: |
+          if [[ -n "$OUTPUT_TYPES" || "$HAS_PATCH" == "true" ]]; then
+            echo "run_detection=true" >> "$GITHUB_OUTPUT"
+            echo "Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH"
+          else
+            echo "run_detection=false" >> "$GITHUB_OUTPUT"
+            echo "Detection skipped: no agent outputs or patches to analyze"
+          fi
+      - name: Clear MCP Config for detection
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
         run: |
-          echo "Agent output-types: $AGENT_OUTPUT_TYPES"
-      - name: Setup threat
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+          rm -f "${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json"
+          rm -f /home/runner/.copilot/mcp-config.json
+          rm -f "$GITHUB_WORKSPACE/.gemini/settings.json"
+      - name: Prepare threat detection files
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        run: |
+          mkdir -p /tmp/gh-aw/threat-detection/aw-prompts
+          cp /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt 2>/dev/null || true
+          cp /tmp/gh-aw/agent_output.json /tmp/gh-aw/threat-detection/agent_output.json 2>/dev/null || true
+          for f in /tmp/gh-aw/aw-*.patch; do
+            [ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true
+          done
+          for f in /tmp/gh-aw/aw-*.bundle; do
+            [ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true
+          done
+          echo "Prepared threat detection files:"
+          ls -la /tmp/gh-aw/threat-detection/ 2>/dev/null || true
+      - name: Setup threat detection
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          WORKFLOW_NAME: "Daily Repo Status"
+          WORKFLOW_NAME: "Repo Status"
           WORKFLOW_DESCRIPTION: "This workflow creates daily repo status reports. It gathers recent repository\nactivity (issues, PRs, discussions, releases, code changes) and generates\nengaging GitHub issues with productivity insights, community highlights,\nand project recommendations."
           HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/setup_threat_detection.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs');
             await main();
-      - name: Ensure threat-detection directory and
+      - name: Ensure threat-detection directory and log
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
         run: |
-          mkdir -p /tmp/gh-aw/threat-
-          touch /tmp/gh-aw/threat-detection/detection.
-      - name: Validate COPILOT_GITHUB_TOKEN
-        id: validate-
-        run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-
+          mkdir -p /tmp/gh-aw/threat-detection
+          touch /tmp/gh-aw/threat-detection/detection.log
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
+      - name: Install GitHub Copilot CLI
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.52
         env:
-          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-      - name: Install GitHub Copilot
-        run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.
-      - name: Execute GitHub Copilot
-        id:
+          GH_HOST: github.com
+      - name: Install AWF binary
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.25.55
+      - name: Execute GitHub Copilot CLI
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        continue-on-error: true
+        id: detection_agentic_execution
         # Copilot CLI tool arguments (sorted):
-        # --allow-tool shell(cat)
-        # --allow-tool shell(grep)
-        # --allow-tool shell(head)
-        # --allow-tool shell(jq)
-        # --allow-tool shell(ls)
-        # --allow-tool shell(tail)
-        # --allow-tool shell(wc)
-        timeout-minutes:
+        timeout-minutes: 20
         run: |
-          set -o
-          COPILOT_CLI_INSTRUCTION="$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"
-          mkdir -p /tmp/
-          mkdir -p /tmp/gh-aw/
-          mkdir -p /tmp/gh-aw/agent/
-          mkdir -p /tmp/gh-aw/sandbox/agent/logs/
-          copilot --add-dir /tmp/ --add-dir /tmp/gh-aw/ --add-dir /tmp/gh-aw/agent/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --allow-tool 'shell(cat)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(jq)' --allow-tool 'shell(ls)' --allow-tool 'shell(tail)' --allow-tool 'shell(wc)' --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$COPILOT_CLI_INSTRUCTION"${GH_AW_MODEL_DETECTION_COPILOT:+ --model "$GH_AW_MODEL_DETECTION_COPILOT"} 2>&1 | tee /tmp/gh-aw/threat-detection/detection.
+          set -o pipefail
+          printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
+          touch /tmp/gh-aw/agent-step-summary.md
+          GH_AW_NODE_BIN=$(command -v node 2>/dev/null || true)
+          export GH_AW_NODE_BIN
+          export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK"
+          (umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)
+          printf '%s\n' '{"$schema":"https://github.com/github/gh-aw-firewall/releases/download/v0.25.55/awf-config.schema.json","network":{"allowDomains":["api.business.githubcopilot.com","api.enterprise.githubcopilot.com","api.github.com","api.githubcopilot.com","api.individual.githubcopilot.com","github.com","host.docker.internal","telemetry.enterprise.githubcopilot.com"]},"apiProxy":{"enabled":true,"enableTokenSteering":true,"maxRuns":500,"maxEffectiveTokens":25000000},"container":{"imageTag":"0.25.55"}}' > "${RUNNER_TEMP}/gh-aw/awf-config.json"
+          cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
+          GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=""
+          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
+            GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS="--docker-host-path-prefix /tmp/gh-aw"
+          fi
+          # shellcheck disable=SC1003
+          sudo -E awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env COPILOT_GITHUB_TOKEN --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \
+            -- /bin/bash -c 'export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log
         env:
-          COPILOT_AGENT_RUNNER_TYPE:
+          AWF_REFLECT_ENABLED: 1
+          COPILOT_AGENT_RUNNER_TYPE: STANDALONE
+          COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-          GH_AW_MODEL_DETECTION_COPILOT: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || '' }}
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.
+          COPILOT_MODEL: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || 'claude-sonnet-4.6' }}
+          GH_AW_PHASE: detection
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+          GH_AW_VERSION: v0.76.1
+          GITHUB_API_URL: ${{ github.api_url }}
+          GITHUB_AW: true
+          GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
           GITHUB_HEAD_REF: ${{ github.head_ref }}
           GITHUB_REF_NAME: ${{ github.ref_name }}
-          GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
           GITHUB_WORKSPACE: ${{ github.workspace }}
-          XDG_CONFIG_HOME: /home/
-      - name: Parse threat detection
-        id:
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+          GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: github-actions[bot]
+          XDG_CONFIG_HOME: /home/runner
+      - name: Upload threat detection log
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/parse_threat_detection_results.cjs');
-            await main();
-      - name: Upload threat detection
+          name: detection
+          path: /tmp/gh-aw/threat-detection/detection.log
+          if-no-files-found: ignore
+      - name: Parse and conclude threat detection
+        id: detection_conclusion
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v6.0.
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}
+          DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}
+          GH_AW_DETECTION_CONTINUE_ON_ERROR: "true"
         with:
-          name: threat-detection.
-          path: /tmp/gh-aw/threat-detection/detection.
-          if-no-files-found:
+          script: |
+            try {
+              const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+              setupGlobals(core, github, context, exec, io, getOctokit);
+              const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');
+              await main();
+            } catch (loadErr) {
+              const continueOnError = process.env.GH_AW_DETECTION_CONTINUE_ON_ERROR !== 'false';
+              const detectionExecutionFailed = process.env.DETECTION_AGENTIC_EXECUTION_OUTCOME === 'failure';
+              const msg = 'ERR_SYSTEM: \u274C Unexpected error loading threat detection module: ' + (loadErr && loadErr.message ? loadErr.message : String(loadErr));
+              core.error(msg);
+              core.setOutput('reason', 'parse_error');
+              if (continueOnError && !detectionExecutionFailed) {
+                core.warning('\u26A0\uFE0F ' + msg);
+                core.setOutput('conclusion', 'warning');
+                core.setOutput('success', 'false');
+              } else {
+                core.setOutput('conclusion', 'failure');
+                core.setOutput('success', 'false');
+                core.setFailed(msg);
+              }
+            }
 
   safe_outputs:
     needs:
-      -
-      -
-    if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (needs.detection.outputs.success == 'true')
-    runs-on: ubuntu-
+      - activation
+      - agent
+      - detection
+    if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
+    runs-on: ubuntu-slim
     permissions:
-      contents:
-      issues:
-    timeout-minutes:
+      contents: read
+      issues: write
+    timeout-minutes: 15
     env:
+      GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/daily-repo-status"
+      GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
+      GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
+      GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
       GH_AW_ENGINE_ID: "copilot"
+      GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
+      GH_AW_ENGINE_VERSION: "1.0.52"
       GH_AW_WORKFLOW_ID: "daily-repo-status"
-      GH_AW_WORKFLOW_NAME: "Daily Repo Status"
-      GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87"
-      GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/tree/d19056381ba48cb1f7c78510c23069701fa7ae87/workflows/daily-repo-status.md"
+      GH_AW_WORKFLOW_NAME: "Repo Status"
+      GH_AW_WORKFLOW_SOURCE: "githubnext/agentics/workflows/repo-status.md@main"
+      GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/githubnext/agentics/blob/main/workflows/repo-status.md"
     outputs:
+      code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}
+      code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
       create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
       create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
+      created_issue_number: ${{ steps.process_safe_outputs.outputs.created_issue_number }}
+      created_issue_url: ${{ steps.process_safe_outputs.outputs.created_issue_url }}
       process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
       process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
     steps:
-      - name: Setup
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.45.
+      - name: Setup Scripts
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
         with:
-          destination: /opt/gh-aw/
-      - name: Download agent output
-        continue-on-error:
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Repo Status"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/daily-repo-status.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
+      - name: Download agent output artifact
+        id: download-agent-output
+        continue-on-error: true
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: agent-
-          path: /tmp/gh-aw/safeoutputs/
-      - name: Setup agent output environment
+          name: agent
+          path: /tmp/gh-aw/
+      - name: Setup agent output environment variable
+        id: setup-agent-output-env
+        if: steps.download-agent-output.outcome == 'success'
+        run: |
+          mkdir -p /tmp/gh-aw/
+          find "/tmp/gh-aw/" -type f -print
+          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+      - name: Configure GH_HOST for enterprise compatibility
+        id: ghes-host-config
+        shell: bash
         run: |
-          mkdir -p /tmp/gh-aw/safeoutputs/
-          find "/tmp/gh-aw/safeoutputs/" -type f -
-          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
-      - name: Process Safe
-        id:
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 #
+          # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
+          # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
+          GH_HOST="${GITHUB_SERVER_URL#https://}"
+          GH_HOST="${GH_HOST#http://}"
+          echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
+      - name: Process Safe Outputs
+        id: process_safe_outputs
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"labels\":[\"report\",\"daily-status\"],\"max\":1,\"title_prefix\":\"[repo-status] \"},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
+          GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_API_URL: ${{ github.api_url }}
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"create_issue\":{\"close_older_issues\":true,\"labels\":[\"report\",\"daily-status\"],\"max\":1,\"title_prefix\":\"[repo-status] \"},\"create_report_incomplete_issue\":{},\"mentions\":{\"enabled\":false},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/safe_output_handler_manager.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/safe_output_handler_manager.cjs');
             await main();
+      - name: Upload Safe Outputs Items
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: safe-outputs-items
+          path: |
+            /tmp/gh-aw/safe-output-items.jsonl
+            /tmp/gh-aw/temporary-id-map.json
+          if-no-files-found: ignore
diff --git a/.github/workflows/daily-repo-status.md b/.github/workflows/daily-repo-status.md
index 431b4afb91a6..8debf5708437 100644
--- a/.github/workflows/daily-repo-status.md
+++ b/.github/workflows/daily-repo-status.md
@@ -22,15 +22,19 @@ tools:
     # reading issues, pull requests and comments from 3rd-parties
     # If in a private repo this has no particular effect.
     lockdown: false
+    min-integrity: none # This workflow is allowed to examine and comment on any issues
 
 safe-outputs:
+  mentions: false
+  allowed-github-references: []
   create-issue:
     title-prefix: "[repo-status] "
     labels: [report, daily-status]
-source: githubnext/agentics/workflows/daily-repo-status.md@d19056381ba48cb1f7c78510c23069701fa7ae87
+    close-older-issues: true
+source: githubnext/agentics/workflows/repo-status.md@main
 ---
 
-# Daily Repo Status
+# Repo Status
 
 Create an upbeat daily status report for the repo as a GitHub issue.
 
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index 258032f02c4a..3acf91dcc1ef 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -1,4 +1,5 @@
-#
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"3cfe810a6f1f402ae902098f1dc14b99a4281a5986d58b76e96eec1a2fde7646","compiler_version":"v0.76.1","strict":true,"agent_id":"copilot"}
+# gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"46d564922b082d0db93244972e8005ea6904ee5f","version":"v0.76.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55","digest":"sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55","digest":"sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55","digest":"sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.19","digest":"sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f"},{"image":"ghcr.io/github/github-mcp-server:v1.0.4","digest":"sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4"},{"image":"node:lts-alpine","digest":"sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14","pinned_image":"node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14"}]}
 #    ___                   _   _
 #   / _ \                 | | (_)
 #  | |_| | __ _  ___ _ __ | |_ _  ___
@@ -13,28 +14,56 @@
 # \  /\  / (_) | | | | ( | | | | (_) \ V  V /\__ \
 #  \/  \/ \___/|_| |_|\_\|_| |_|\___/ \_/\_/ |___/
 #
-# This file was automatically generated by gh-aw (v0.45.0). DO NOT EDIT.
+# This file was automatically generated by gh-aw (v0.76.1). DO NOT EDIT.
 #
-# To update this file, edit github/gh-aw/.github/workflows/issue-triage-agent.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4 and run:
+# To update this file, edit github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115 and run:
 #   gh aw compile
 # Not all edits will cause changes to this file.
 #
 # For more information: https://github.github.com/gh-aw/introduction/overview/
 #
 #
-# Source: github/gh-aw/.github/workflows/issue-triage-agent.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4
+# Source: github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115
 #
 # Resolved workflow manifest:
 #   Imports:
-#     - github/gh-aw/.github/workflows/shared/reporting.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4
+#     - github/gh-aw/.github/workflows/shared/reporting.md@359795d49ada21681ab616bd4cbcb144a7387115
+#
+# Secrets used:
+#   - COPILOT_GITHUB_TOKEN
+#   - GH_AW_GITHUB_MCP_SERVER_TOKEN
+#   - GH_AW_GITHUB_TOKEN
+#   - GITHUB_TOKEN
 #
-# frontmatter-hash: 7bc83974fa1e47c12b40c3333872e4126711d5c6624022cc78b76047289d8b63
+# Custom actions used:
+#   - actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+#   - actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+#   - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+#   - actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
+#   - actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+#   - actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+#   - github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
+#
+# Container images used:
+#   - ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731
+#   - ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3
+#   - ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca
+#   - ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f
+#   - ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4
+#   - node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14
 
 name: "Issue Triage Agent"
-"on":
+on:
   schedule:
-  - cron: "0 14 * * 1-5"
+  - cron: "49 14 * * 1-5"
+    # Friendly format: daily around 14:00 on weekdays (scattered)
   workflow_dispatch:
+    inputs:
+      aw_context:
+        default: ""
+        description: "Agent caller context (used internally by Agentic Workflows)."
+        required: false
+        type: string
 
 permissions: {}
 
@@ -47,324 +76,503 @@ jobs:
   activation:
     runs-on: ubuntu-slim
     permissions:
+      actions: read
       contents: read
     outputs:
       comment_id: ""
       comment_repo: ""
+      engine_id: ${{ steps.generate_aw_info.outputs.engine_id }}
+      lockdown_check_failed: ${{ steps.generate_aw_info.outputs.lockdown_check_failed == 'true' }}
+      model: ${{ steps.generate_aw_info.outputs.model }}
+      secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
+      setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
+      setup-span-id: ${{ steps.setup.outputs.span-id }}
+      setup-trace-id: ${{ steps.setup.outputs.trace-id }}
+      stale_lock_file_failed: ${{ steps.check-lock-file.outputs.stale_lock_file_failed == 'true' }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
         with:
-          destination: /opt/gh-aw/actions
-      - name: Check workflow file timestamps
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
+      - name: Generate agentic run info
+        id: generate_aw_info
+        env:
+          GH_AW_INFO_ENGINE_ID: "copilot"
+          GH_AW_INFO_ENGINE_NAME: "GitHub Copilot CLI"
+          GH_AW_INFO_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || 'claude-sonnet-4.6' }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AGENT_VERSION: "1.0.52"
+          GH_AW_INFO_CLI_VERSION: "v0.76.1"
+          GH_AW_INFO_WORKFLOW_NAME: "Issue Triage Agent"
+          GH_AW_INFO_EXPERIMENTAL: "false"
+          GH_AW_INFO_SUPPORTS_TOOLS_ALLOWLIST: "true"
+          GH_AW_INFO_STAGED: "false"
+          GH_AW_INFO_ALLOWED_DOMAINS: '["defaults"]'
+          GH_AW_INFO_FIREWALL_ENABLED: "true"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_AWMG_VERSION: ""
+          GH_AW_INFO_FIREWALL_TYPE: "squid"
+          GH_AW_INFO_FRONTMATTER_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_FRONTMATTER_EMOJI: "🔧"
+          GH_AW_COMPILED_STRICT: "true"
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_aw_info.cjs');
+            await main(core, context);
+      - name: Validate COPILOT_GITHUB_TOKEN secret
+        id: validate-secret
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh" COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-default
+        env:
+          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+      - name: Checkout .github and .agents folders
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+          sparse-checkout: |
+            .github
+            .agents
+            .antigravity
+            .claude
+            .codex
+            .crush
+            .gemini
+            .opencode
+            .pi
+          sparse-checkout-cone-mode: true
+          fetch-depth: 1
+      - name: Save agent config folders for base branch restoration
+        env:
+          GH_AW_AGENT_FOLDERS: ".agents .antigravity .claude .codex .crush .gemini .github .opencode .pi"
+          GH_AW_AGENT_FILES: ".crush.json AGENTS.md ANTIGRAVITY.md CLAUDE.md GEMINI.md PI.md opencode.jsonc"
+        # poutine:ignore untrusted_checkout_exec
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/save_base_github_folders.sh"
+      - name: Check workflow lock file
+        id: check-lock-file
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           GH_AW_WORKFLOW_FILE: "issue-triage-agent.lock.yml"
+          GH_AW_CONTEXT_WORKFLOW_REF: "${{ github.workflow_ref }}"
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/check_workflow_timestamp_api.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_workflow_timestamp_api.cjs');
+            await main();
+      - name: Check compile-agentic version
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_COMPILED_VERSION: "v0.76.1"
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/check_version_updates.cjs');
+            await main();
+      - name: Create prompt with built-in context
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+          GH_AW_SAFE_OUTPUTS: ${{ runner.temp }}/gh-aw/safeoutputs/outputs.jsonl
+          GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
+          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+        # poutine:ignore untrusted_checkout_exec
+        run: |
+          bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
+          {
+          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          <system>
+          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
+          cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
+          cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
+          cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
+          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          <safe-output-tools>
+          Tools: add_comment, add_labels, missing_tool, missing_data, noop
+          </safe-output-tools>
+          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
+          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          <github-context>
+          The following GitHub context information is available for this workflow:
+          {{#if github.actor}}
+          - **actor**: __GH_AW_GITHUB_ACTOR__
+          {{/if}}
+          {{#if github.repository}}
+          - **repository**: __GH_AW_GITHUB_REPOSITORY__
+          {{/if}}
+          {{#if github.workspace}}
+          - **workspace**: __GH_AW_GITHUB_WORKSPACE__
+          {{/if}}
+          {{#if github.event.issue.number || (github.aw.context.item_type == 'issue' && github.aw.context.item_number)}}
+          - **issue-number**: #__GH_AW_EXPR_802A9F6A__
+          {{/if}}
+          {{#if github.event.discussion.number || (github.aw.context.item_type == 'discussion' && github.aw.context.item_number)}}
+          - **discussion-number**: #__GH_AW_EXPR_1A3A194A__
+          {{/if}}
+          {{#if github.event.pull_request.number || (github.aw.context.item_type == 'pull_request' && github.aw.context.item_number)}}
+          - **pull-request-number**: #__GH_AW_EXPR_463A214A__
+          {{/if}}
+          {{#if github.event.comment.id || github.aw.context.comment_id}}
+          - **comment-id**: __GH_AW_EXPR_FF1D34CE__
+          {{/if}}
+          {{#if github.run_id}}
+          - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
+          {{/if}}
+          </github-context>
+
+          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
+          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          </system>
+          {{#runtime-import .github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md}}
+          {{#runtime-import .github/workflows/shared/noop-reminder.md}}
+          {{#runtime-import .github/workflows/issue-triage-agent.md}}
+          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          } > "$GH_AW_PROMPT"
+      - name: Interpolate variables and render templates
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+          GH_AW_ENGINE_ID: "copilot"
+          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/interpolate_prompt.cjs');
             await main();
+      - name: Substitute placeholders
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+          GH_AW_EXPR_1A3A194A: ${{ github.event.discussion.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'discussion' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_463A214A: ${{ github.event.pull_request.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'pull_request' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_802A9F6A: ${{ github.event.issue.number || (fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_type == 'issue' && fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').item_number) }}
+          GH_AW_EXPR_FF1D34CE: ${{ github.event.comment.id || fromJSON(github.event.inputs.aw_context || github.event.client_payload.aw_context || '{}').comment_id }}
+          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
+          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
+          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
+          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
+          GH_AW_MCP_CLI_SERVERS_LIST: '- `safeoutputs` — run `safeoutputs --help` to see available tools'
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+
+            const substitutePlaceholders = require('${{ runner.temp }}/gh-aw/actions/substitute_placeholders.cjs');
+
+            // Call the substitution function
+            return await substitutePlaceholders({
+              file: process.env.GH_AW_PROMPT,
+              substitutions: {
+                GH_AW_EXPR_1A3A194A: process.env.GH_AW_EXPR_1A3A194A,
+                GH_AW_EXPR_463A214A: process.env.GH_AW_EXPR_463A214A,
+                GH_AW_EXPR_802A9F6A: process.env.GH_AW_EXPR_802A9F6A,
+                GH_AW_EXPR_FF1D34CE: process.env.GH_AW_EXPR_FF1D34CE,
+                GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
+                GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
+                GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
+                GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE,
+                GH_AW_MCP_CLI_SERVERS_LIST: process.env.GH_AW_MCP_CLI_SERVERS_LIST
+              }
+            });
+      - name: Validate prompt placeholders
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+        # poutine:ignore untrusted_checkout_exec
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/validate_prompt_placeholders.sh"
+      - name: Print prompt
+        env:
+          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+        # poutine:ignore untrusted_checkout_exec
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/print_prompt_summary.sh"
+      - name: Upload activation artifact
+        if: success()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: activation
+          include-hidden-files: true
+          path: |
+            /tmp/gh-aw/aw_info.json
+            /tmp/gh-aw/aw-prompts/prompt.txt
+            /tmp/gh-aw/aw-prompts/prompt-template.txt
+            /tmp/gh-aw/aw-prompts/prompt-import-tree.json
+            /tmp/gh-aw/github_rate_limits.jsonl
+            /tmp/gh-aw/base
+            /tmp/gh-aw/.github/agents
+            /tmp/gh-aw/.github/skills
+          if-no-files-found: ignore
+          retention-days: 1
 
   agent:
     needs: activation
     runs-on: ubuntu-latest
     permissions:
-          contents: read
-          issues: read
+      issues: read
+    concurrency:
+      group: "gh-aw-copilot-${{ github.workflow }}"
     env:
       DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
       GH_AW_ASSETS_ALLOWED_EXTS: ""
       GH_AW_ASSETS_BRANCH: ""
       GH_AW_ASSETS_MAX_SIZE_KB: 0
       GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
-      GH_AW_SAFE_OUTPUTS: /opt/gh-aw/safeoutputs/outputs.jsonl
-      GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
-      GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools.json
       GH_AW_WORKFLOW_ID_SANITIZED: issuetriageagent
     outputs:
+      agentic_engine_timeout: ${{ steps.detect-agent-errors.outputs.agentic_engine_timeout || 'false' }}
+      effective_tokens: ${{ steps.parse-mcp-gateway.outputs.effective_tokens }}
+      effective_tokens_rate_limit_error: ${{ steps.parse-mcp-gateway.outputs.effective_tokens_rate_limit_error || 'false' }}
       has_patch: ${{ steps.collect_output.outputs.has_patch }}
-      model: ${{ steps.generate_aw_info.outputs.model }}
+      inference_access_error: ${{ steps.detect-agent-errors.outputs.inference_access_error || 'false' }}
+      mcp_policy_error: ${{ steps.detect-agent-errors.outputs.mcp_policy_error || 'false' }}
+      model: ${{ needs.activation.outputs.model }}
+      model_not_supported_error: ${{ steps.detect-agent-errors.outputs.model_not_supported_error || 'false' }}
       output: ${{ steps.collect_output.outputs.output }}
       output_types: ${{ steps.collect_output.outputs.output_types }}
-      secret_verification_result: ${{ steps.validate-secret.outputs.verification_result }}
+      setup-parent-span-id: ${{ steps.setup.outputs.parent-span-id || steps.setup.outputs.span-id }}
+      setup-span-id: ${{ steps.setup.outputs.span-id }}
+      setup-trace-id: ${{ steps.setup.outputs.trace-id }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
         with:
-          destination: /opt/gh-aw/actions
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
+      - name: Set runtime paths
+        id: set-runtime-paths
+        run: |
+          {
+            echo "GH_AW_SAFE_OUTPUTS=${RUNNER_TEMP}/gh-aw/safeoutputs/outputs.jsonl"
+            echo "GH_AW_SAFE_OUTPUTS_CONFIG_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/config.json"
+            echo "GH_AW_SAFE_OUTPUTS_TOOLS_PATH=${RUNNER_TEMP}/gh-aw/safeoutputs/tools.json"
+          } >> "$GITHUB_OUTPUT"
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
       - name: Create gh-aw temp directory
-        run: bash /opt/gh-aw/actions/create_gh_aw_tmp_dir.sh
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/create_gh_aw_tmp_dir.sh"
+      - name: Configure gh CLI for GitHub Enterprise
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/configure_gh_for_ghe.sh"
+        env:
+          GH_TOKEN: ${{ github.token }}
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
           SERVER_URL: ${{ github.server_url }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
+          git config --global am.keepcr true
           # Re-authenticate git with GitHub token
           SERVER_URL_STRIPPED="${SERVER_URL#https://}"
-          git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
           echo "Git configured with standard GitHub Actions identity"
-      - name: Generate agentic run info
-        id: generate_aw_info
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const fs = require('fs');
-
-            const awInfo = {
-              engine_id: "copilot",
-              engine_name: "GitHub Copilot CLI",
-              model: process.env.GH_AW_MODEL_AGENT_COPILOT || "",
-              version: "",
-              agent_version: "0.0.410",
-              cli_version: "v0.45.0",
-              workflow_name: "Issue Triage Agent",
-              experimental: false,
-              supports_tools_allowlist: true,
-              supports_http_transport: true,
-              run_id: context.runId,
-              run_number: context.runNumber,
-              run_attempt: process.env.GITHUB_RUN_ATTEMPT,
-              repository: context.repo.owner + '/' + context.repo.repo,
-              ref: context.ref,
-              sha: context.sha,
-              actor: context.actor,
-              event_name: context.eventName,
-              staged: false,
-              allowed_domains: ["defaults"],
-              firewall_enabled: true,
-              awf_version: "v0.18.0",
-              awmg_version: "v0.1.4",
-              steps: {
-                firewall: "squid"
-              },
-              created_at: new Date().toISOString()
-            };
-
-            // Write to /tmp/gh-aw directory to avoid inclusion in PR
-            const tmpPath = '/tmp/gh-aw/aw_info.json';
-            fs.writeFileSync(tmpPath, JSON.stringify(awInfo, null, 2));
-            console.log('Generated aw_info.json at:', tmpPath);
-            console.log(JSON.stringify(awInfo, null, 2));
-
-            // Set model as output for reuse in other steps/jobs
-            core.setOutput('model', awInfo.model);
-      - name: Validate COPILOT_GITHUB_TOKEN secret
-        id: validate-secret
-        run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-default
-        env:
-          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
       - name: Install GitHub Copilot CLI
-        run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.410
-      - name: Install awf binary
-        run: bash /opt/gh-aw/actions/install_awf_binary.sh v0.18.0
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.52
+        env:
+          GH_HOST: github.com
+      - name: Install AWF binary
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.25.55
       - name: Determine automatic lockdown mode for GitHub MCP Server
         id: determine-automatic-lockdown
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 (source v9)
         env:
           GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
           GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
         with:
           script: |
-            const determineAutomaticLockdown = require('/opt/gh-aw/actions/determine_automatic_lockdown.cjs');
+            const determineAutomaticLockdown = require('${{ runner.temp }}/gh-aw/actions/determine_automatic_lockdown.cjs');
             await determineAutomaticLockdown(github, context, core);
+      - name: Download activation artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: activation
+          path: /tmp/gh-aw
+      - name: Restore inline sub-agents from activation artifact
+        env:
+          GH_AW_SUB_AGENT_DIR: ".github/agents"
+          GH_AW_SUB_AGENT_EXT: ".agent.md"
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_sub_agents.sh"
+      - name: Restore inline skills from activation artifact
+        env:
+          GH_AW_SKILL_DIR: ".github/skills"
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/restore_inline_skills.sh"
       - name: Download container images
-        run: bash /opt/gh-aw/actions/download_docker_images.sh ghcr.io/github/gh-aw-firewall/agent:0.18.0 ghcr.io/github/gh-aw-firewall/squid:0.18.0 ghcr.io/github/gh-aw-mcpg:v0.1.4 ghcr.io/github/github-mcp-server:v0.30.3 node:lts-alpine
-      - name: Write Safe Outputs Config
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3 ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4 node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14
+      - name: Generate Safe Outputs Config
         run: |
-          mkdir -p /opt/gh-aw/safeoutputs
+          mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > /opt/gh-aw/safeoutputs/config.json << 'GH_AW_SAFE_OUTPUTS_CONFIG_EOF'
-          {"add_comment":{"max":1},"add_labels":{"allowed":["bug","feature","enhancement","documentation","question","help-wanted","good-first-issue"],"max":3},"missing_data":{},"missing_tool":{},"noop":{"max":1}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_EOF
-          cat > /opt/gh-aw/safeoutputs/tools.json << 'GH_AW_SAFE_OUTPUTS_TOOLS_EOF'
-          [
+          cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_40bb017992a44aa9_EOF'
+          {"add_comment":{"max":1},"add_labels":{"allowed":["bug","feature","enhancement","documentation","question","help-wanted","good-first-issue"]},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
+          GH_AW_SAFE_OUTPUTS_CONFIG_40bb017992a44aa9_EOF
+      - name: Generate Safe Outputs Tools
+        env:
+          GH_AW_TOOLS_META_JSON: |
             {
-              "description": "Add a comment to an existing GitHub issue, pull request, or discussion. Use this to provide feedback, answer questions, or add information to an existing conversation. For creating new items, use create_issue, create_discussion, or create_pull_request instead. IMPORTANT: Comments are subject to validation constraints enforced by the MCP server - maximum 65536 characters for the complete comment (including footer which is added automatically), 10 mentions (@username), and 50 links. Exceeding these limits will result in an immediate error with specific guidance. CONSTRAINTS: Maximum 1 comment(s) can be added.",
-              "inputSchema": {
-                "additionalProperties": false,
-                "properties": {
+              "description_suffixes": {
+                "add_comment": " CONSTRAINTS: Maximum 1 comment(s) can be added. Supports reply_to_id for discussion threading.",
+                "add_labels": " CONSTRAINTS: Only these labels are allowed: [\"bug\" \"feature\" \"enhancement\" \"documentation\" \"question\" \"help-wanted\" \"good-first-issue\"]."
+              },
+              "repo_params": {},
+              "dynamic_tools": []
+            }
+          GH_AW_VALIDATION_JSON: |
+            {
+              "add_comment": {
+                "defaultMax": 1,
+                "fields": {
                   "body": {
-                    "description": "The comment text in Markdown format. This is the 'body' field - do not use 'comment_body' or other variations. Provide helpful, relevant information that adds value to the conversation. CONSTRAINTS: The complete comment (your body text + automatically added footer) must not exceed 65536 characters total. Maximum 10 mentions (@username), maximum 50 links (http/https URLs). A footer (~200-500 characters) is automatically appended with workflow attribution, so leave adequate space. If these limits are exceeded, the tool call will fail with a detailed error message indicating which constraint was violated.",
-                    "type": "string"
+                    "required": true,
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 65000
                   },
                   "item_number": {
-                    "description": "The issue, pull request, or discussion number to comment on. This is the numeric ID from the GitHub URL (e.g., 123 in github.com/owner/repo/issues/123). If omitted, the tool will attempt to resolve the target from the current workflow context (triggering issue, PR, or discussion).",
-                    "type": "number"
+                    "issueOrPRNumber": true
+                  },
+                  "reply_to_id": {
+                    "type": "string",
+                    "maxLength": 256
+                  },
+                  "repo": {
+                    "type": "string",
+                    "maxLength": 256
                   }
-                },
-                "required": [
-                  "body"
-                ],
-                "type": "object"
+                }
               },
-              "name": "add_comment"
-            },
-            {
-              "description": "Add labels to an existing GitHub issue or pull request for categorization and filtering. Labels must already exist in the repository. For creating new issues with labels, use create_issue with the labels property instead. CONSTRAINTS: Only these labels are allowed: [bug feature enhancement documentation question help-wanted good-first-issue].",
-              "inputSchema": {
-                "additionalProperties": false,
-                "properties": {
+              "add_labels": {
+                "defaultMax": 5,
+                "fields": {
                   "item_number": {
-                    "description": "Issue or PR number to add labels to. This is the numeric ID from the GitHub URL (e.g., 456 in github.com/owner/repo/issues/456). If omitted, adds labels to the item that triggered this workflow.",
-                    "type": "number"
+                    "issueNumberOrTemporaryId": true
                   },
                   "labels": {
-                    "description": "Label names to add (e.g., ['bug', 'priority-high']). Labels must exist in the repository.",
-                    "items": {
-                      "type": "string"
-                    },
-                    "type": "array"
+                    "required": true,
+                    "type": "array",
+                    "itemType": "string",
+                    "itemSanitize": true,
+                    "itemMaxLength": 128
+                  },
+                  "repo": {
+                    "type": "string",
+                    "maxLength": 256
                   }
-                },
-                "type": "object"
+                }
               },
-              "name": "add_labels"
-            },
-            {
-              "description": "Report that a tool or capability needed to complete the task is not available, or share any information you deem important about missing functionality or limitations. Use this when you cannot accomplish what was requested because the required functionality is missing or access is restricted.",
-              "inputSchema": {
-                "additionalProperties": false,
-                "properties": {
+              "missing_data": {
+                "defaultMax": 20,
+                "fields": {
+                  "alternatives": {
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 256
+                  },
+                  "context": {
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 256
+                  },
+                  "data_type": {
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 128
+                  },
+                  "reason": {
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 256
+                  }
+                }
+              },
+              "missing_tool": {
+                "defaultMax": 20,
+                "fields": {
                   "alternatives": {
-                    "description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
-                    "type": "string"
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 512
                   },
                   "reason": {
-                    "description": "Explanation of why this tool is needed or what information you want to share about the limitation (max 256 characters).",
-                    "type": "string"
+                    "required": true,
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 256
                   },
                   "tool": {
-                    "description": "Optional: Name or description of the missing tool or capability (max 128 characters). Be specific about what functionality is needed.",
-                    "type": "string"
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 128
                   }
-                },
-                "required": [
-                  "reason"
-                ],
-                "type": "object"
+                }
               },
-              "name": "missing_tool"
-            },
-            {
-              "description": "Log a transparency message when no significant actions are needed. Use this to confirm workflow completion and provide visibility when analysis is complete but no changes or outputs are required (e.g., 'No issues found', 'All checks passed'). This ensures the workflow produces human-visible output even when no other actions are taken.",
-              "inputSchema": {
-                "additionalProperties": false,
-                "properties": {
+              "noop": {
+                "defaultMax": 1,
+                "fields": {
                   "message": {
-                    "description": "Status or completion message to log. Should explain what was analyzed and the outcome (e.g., 'Code review complete - no issues found', 'Analysis complete - all tests passing').",
-                    "type": "string"
+                    "required": true,
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 65000
                   }
-                },
-                "required": [
-                  "message"
-                ],
-                "type": "object"
+                }
               },
-              "name": "noop"
-            },
-            {
-              "description": "Report that data or information needed to complete the task is not available. Use this when you cannot accomplish what was requested because required data, context, or information is missing.",
-              "inputSchema": {
-                "additionalProperties": false,
-                "properties": {
-                  "alternatives": {
-                    "description": "Any workarounds, manual steps, or alternative approaches the user could take (max 256 characters).",
-                    "type": "string"
-                  },
-                  "context": {
-                    "description": "Additional context about the missing data or where it should come from (max 256 characters).",
-                    "type": "string"
-                  },
-                  "data_type": {
-                    "description": "Type or description of the missing data or information (max 128 characters). Be specific about what data is needed.",
-                    "type": "string"
+              "report_incomplete": {
+                "defaultMax": 5,
+                "fields": {
+                  "details": {
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 65000
                   },
                   "reason": {
-                    "description": "Explanation of why this data is needed to complete the task (max 256 characters).",
-                    "type": "string"
+                    "required": true,
+                    "type": "string",
+                    "sanitize": true,
+                    "maxLength": 1024
                   }
-                },
-                "required": [],
-                "type": "object"
-              },
-              "name": "missing_data"
-            }
-          ]
-          GH_AW_SAFE_OUTPUTS_TOOLS_EOF
-          cat > /opt/gh-aw/safeoutputs/validation.json << 'GH_AW_SAFE_OUTPUTS_VALIDATION_EOF'
-          {
-            "add_comment": {
-              "defaultMax": 1,
-              "fields": {
-                "body": {
-                  "required": true,
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength": 65000
-                },
-                "item_number": {
-                  "issueOrPRNumber": true
-                }
-              }
-            },
-            "add_labels": {
-              "defaultMax": 5,
-              "fields": {
-                "item_number": {
-                  "issueOrPRNumber": true
-                },
-                "labels": {
-                  "required": true,
-                  "type": "array",
-                  "itemType": "string",
-                  "itemSanitize": true,
-                  "itemMaxLength": 128
-                }
-              }
-            },
-            "missing_tool": {
-              "defaultMax": 20,
-              "fields": {
-                "alternatives": {
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength": 512
-                },
-                "reason": {
-                  "required": true,
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength": 256
-                },
-                "tool": {
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength": 128
-                }
-              }
-            },
-            "noop": {
-              "defaultMax": 1,
-              "fields": {
-                "message": {
-                  "required": true,
-                  "type": "string",
-                  "sanitize": true,
-                  "maxLength": 65000
                 }
               }
             }
-          }
-          GH_AW_SAFE_OUTPUTS_VALIDATION_EOF
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/generate_safe_outputs_tools.cjs');
+            await main();
       - name: Generate Safe Outputs MCP Server Config
         id: safe-outputs-config
         run: |
@@ -387,59 +595,81 @@ jobs:
         id: safe-outputs-start
         env:
           DEBUG: '*'
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
           GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-config.outputs.safe_outputs_port }}
           GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-config.outputs.safe_outputs_api_key }}
-          GH_AW_SAFE_OUTPUTS_TOOLS_PATH: /opt/gh-aw/safeoutputs/tools.json
-          GH_AW_SAFE_OUTPUTS_CONFIG_PATH: /opt/gh-aw/safeoutputs/config.json
+          GH_AW_SAFE_OUTPUTS_TOOLS_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/tools.json
+          GH_AW_SAFE_OUTPUTS_CONFIG_PATH: ${{ runner.temp }}/gh-aw/safeoutputs/config.json
           GH_AW_MCP_LOG_DIR: /tmp/gh-aw/mcp-logs/safeoutputs
         run: |
           # Environment variables are set above to prevent template injection
           export DEBUG
+          export GH_AW_SAFE_OUTPUTS
           export GH_AW_SAFE_OUTPUTS_PORT
           export GH_AW_SAFE_OUTPUTS_API_KEY
           export GH_AW_SAFE_OUTPUTS_TOOLS_PATH
           export GH_AW_SAFE_OUTPUTS_CONFIG_PATH
           export GH_AW_MCP_LOG_DIR
 
-          bash /opt/gh-aw/actions/start_safe_outputs_server.sh
+          bash "${RUNNER_TEMP}/gh-aw/actions/start_safe_outputs_server.sh"
 
       - name: Start MCP Gateway
         id: start-mcp-gateway
         env:
-          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
           GH_AW_SAFE_OUTPUTS_API_KEY: ${{ steps.safe-outputs-start.outputs.api_key }}
           GH_AW_SAFE_OUTPUTS_PORT: ${{ steps.safe-outputs-start.outputs.port }}
-          GITHUB_MCP_LOCKDOWN: ${{ steps.determine-automatic-lockdown.outputs.lockdown == 'true' && '1' || '0' }}
+          GITHUB_MCP_GUARD_MIN_INTEGRITY: ${{ steps.determine-automatic-lockdown.outputs.min_integrity }}
+          GITHUB_MCP_GUARD_REPOS: ${{ steps.determine-automatic-lockdown.outputs.repos }}
           GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
         run: |
           set -eo pipefail
-          mkdir -p /tmp/gh-aw/mcp-config
+          mkdir -p "${RUNNER_TEMP}/gh-aw/mcp-config"
 
           # Export gateway environment variables for MCP config and gateway script
-          export MCP_GATEWAY_PORT="80"
+          export MCP_GATEWAY_PORT="8080"
           export MCP_GATEWAY_DOMAIN="host.docker.internal"
+          export MCP_GATEWAY_HOST_DOMAIN="localhost"
           MCP_GATEWAY_API_KEY=$(openssl rand -base64 45 | tr -d '/+=')
           echo "::add-mask::${MCP_GATEWAY_API_KEY}"
           export MCP_GATEWAY_API_KEY
           export MCP_GATEWAY_PAYLOAD_DIR="/tmp/gh-aw/mcp-payloads"
           mkdir -p "${MCP_GATEWAY_PAYLOAD_DIR}"
+          export MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD="524288"
           export DEBUG="*"
 
           export GH_AW_ENGINE="copilot"
-          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host -v /var/run/docker.sock:/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_LOCKDOWN -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.1.4'
+          export GH_AW_MCP_CLI_SERVERS='["safeoutputs"]'
+          echo GH_AW_MCP_CLI_SERVERS='["safeoutputs"]' >> "$GITHUB_ENV"
+          MCP_GATEWAY_UID=$(id -u 2>/dev/null || echo '0')
+          MCP_GATEWAY_GID=$(id -g 2>/dev/null || echo '0')
+          case "${DOCKER_HOST:-}" in
+            unix://* ) DOCKER_SOCK_PATH="${DOCKER_HOST#unix://}" ;;
+            /* ) DOCKER_SOCK_PATH="$DOCKER_HOST" ;;
+            * ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;
+          esac
+          DOCKER_SOCK_GID=$(stat -c '%g' "$DOCKER_SOCK_PATH" 2>/dev/null || echo '0')
+          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.3.19'
 
           mkdir -p /home/runner/.copilot
-          cat << GH_AW_MCP_CONFIG_EOF | bash /opt/gh-aw/actions/start_mcp_gateway.sh
+          GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
+          cat << GH_AW_MCP_CONFIG_8874a73d1c6a94b7_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
           {
             "mcpServers": {
               "github": {
                 "type": "stdio",
-                "container": "ghcr.io/github/github-mcp-server:v0.30.3",
+                "container": "ghcr.io/github/github-mcp-server:v1.0.4",
                 "env": {
-                  "GITHUB_LOCKDOWN_MODE": "$GITHUB_MCP_LOCKDOWN",
+                  "GITHUB_HOST": "\${GITHUB_SERVER_URL}",
                   "GITHUB_PERSONAL_ACCESS_TOKEN": "\${GITHUB_MCP_SERVER_TOKEN}",
                   "GITHUB_READ_ONLY": "1",
                   "GITHUB_TOOLSETS": "issues,labels"
+                },
+                "guard-policies": {
+                  "allow-only": {
+                    "min-integrity": "$GITHUB_MCP_GUARD_MIN_INTEGRITY",
+                    "repos": "$GITHUB_MCP_GUARD_REPOS"
+                  }
                 }
               },
               "safeoutputs": {
@@ -447,6 +677,13 @@ jobs:
                 "url": "http://host.docker.internal:$GH_AW_SAFE_OUTPUTS_PORT",
                 "headers": {
                   "Authorization": "\${GH_AW_SAFE_OUTPUTS_API_KEY}"
+                },
+                "guard-policies": {
+                  "write-sink": {
+                    "accept": [
+                      "*"
+                    ]
+                  }
                 }
               }
             },
@@ -457,199 +694,96 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_EOF
-      - name: Generate workflow overview
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { generateWorkflowOverview } = require('/opt/gh-aw/actions/generate_workflow_overview.cjs');
-            await generateWorkflowOverview(core);
-      - name: Create prompt with built-in context
-        env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
-          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
-          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
-          GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
-          GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
-          GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
-          GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
-          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
-          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
-          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
-        run: |
-          bash /opt/gh-aw/actions/create_prompt_first.sh
-          cat << 'GH_AW_PROMPT_EOF' > "$GH_AW_PROMPT"
-          <system>
-          GH_AW_PROMPT_EOF
-          cat "/opt/gh-aw/prompts/xpia.md" >> "$GH_AW_PROMPT"
-          cat "/opt/gh-aw/prompts/temp_folder_prompt.md" >> "$GH_AW_PROMPT"
-          cat "/opt/gh-aw/prompts/markdown.md" >> "$GH_AW_PROMPT"
-          cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
-          <safe-outputs>
-          <description>GitHub API Access Instructions</description>
-          <important>
-          The gh CLI is NOT authenticated. Do NOT use gh commands for GitHub operations.
-          </important>
-          <instructions>
-          To create or modify GitHub resources (issues, discussions, pull requests, etc.), you MUST call the appropriate safe output tool. Simply writing content will NOT work - the workflow requires actual tool calls.
-
-          Temporary IDs: Some safe output tools support a temporary ID field (usually named temporary_id) so you can reference newly-created items elsewhere in the SAME agent output (for example, using #aw_abc1 in a later body).
-
-          **IMPORTANT - temporary_id format rules:**
-          - If you DON'T need to reference the item later, OMIT the temporary_id field entirely (it will be auto-generated if needed)
-          - If you DO need cross-references/chaining, you MUST match this EXACT validation regex: /^aw_[A-Za-z0-9]{3,8}$/i
-          - Format: aw_ prefix followed by 3 to 8 alphanumeric characters (A-Z, a-z, 0-9, case-insensitive)
-          - Valid alphanumeric characters: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
-          - INVALID examples: aw_ab (too short), aw_123456789 (too long), aw_test-id (contains hyphen), aw_id_123 (contains underscore)
-          - VALID examples: aw_abc, aw_abc1, aw_Test123, aw_A1B2C3D4, aw_12345678
-          - To generate valid IDs: use 3-8 random alphanumeric characters or omit the field to let the system auto-generate
-
-          Do NOT invent other aw_* formats — downstream steps will reject them with validation errors matching against /^aw_[A-Za-z0-9]{3,8}$/i.
-
-          Discover available tools from the safeoutputs MCP server.
-
-          **Critical**: Tool calls write structured data that downstream jobs process. Without tool calls, follow-up actions will be skipped.
-
-          **Note**: If you made no other safe output tool calls during this workflow execution, call the "noop" tool to provide a status message indicating completion or that no actions were needed.
-          </instructions>
-          </safe-outputs>
-          <github-context>
-          The following GitHub context information is available for this workflow:
-          {{#if __GH_AW_GITHUB_ACTOR__ }}
-          - **actor**: __GH_AW_GITHUB_ACTOR__
-          {{/if}}
-          {{#if __GH_AW_GITHUB_REPOSITORY__ }}
-          - **repository**: __GH_AW_GITHUB_REPOSITORY__
-          {{/if}}
-          {{#if __GH_AW_GITHUB_WORKSPACE__ }}
-          - **workspace**: __GH_AW_GITHUB_WORKSPACE__
-          {{/if}}
-          {{#if __GH_AW_GITHUB_EVENT_ISSUE_NUMBER__ }}
-          - **issue-number**: #__GH_AW_GITHUB_EVENT_ISSUE_NUMBER__
-          {{/if}}
-          {{#if __GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__ }}
-          - **discussion-number**: #__GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER__
-          {{/if}}
-          {{#if __GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__ }}
-          - **pull-request-number**: #__GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER__
-          {{/if}}
-          {{#if __GH_AW_GITHUB_EVENT_COMMENT_ID__ }}
-          - **comment-id**: __GH_AW_GITHUB_EVENT_COMMENT_ID__
-          {{/if}}
-          {{#if __GH_AW_GITHUB_RUN_ID__ }}
-          - **workflow-run-id**: __GH_AW_GITHUB_RUN_ID__
-          {{/if}}
-          </github-context>
-
-          GH_AW_PROMPT_EOF
-          cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
-          </system>
-          GH_AW_PROMPT_EOF
-          cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
-          {{#runtime-import .github/aw/imports/github/gh-aw/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github_workflows_shared_reporting.md}}
-          GH_AW_PROMPT_EOF
-          cat << 'GH_AW_PROMPT_EOF' >> "$GH_AW_PROMPT"
-          {{#runtime-import .github/workflows/issue-triage-agent.md}}
-          GH_AW_PROMPT_EOF
-      - name: Substitute placeholders
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+          GH_AW_MCP_CONFIG_8874a73d1c6a94b7_EOF
+      - name: Mount MCP servers as CLIs
+        id: mount-mcp-clis
+        continue-on-error: true
         env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
-          GH_AW_GITHUB_ACTOR: ${{ github.actor }}
-          GH_AW_GITHUB_EVENT_COMMENT_ID: ${{ github.event.comment.id }}
-          GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: ${{ github.event.discussion.number }}
-          GH_AW_GITHUB_EVENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
-          GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: ${{ github.event.pull_request.number }}
-          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
-          GH_AW_GITHUB_RUN_ID: ${{ github.run_id }}
-          GH_AW_GITHUB_WORKSPACE: ${{ github.workspace }}
-        with:
-          script: |
-            const substitutePlaceholders = require('/opt/gh-aw/actions/substitute_placeholders.cjs');
-
-            // Call the substitution function
-            return await substitutePlaceholders({
-              file: process.env.GH_AW_PROMPT,
-              substitutions: {
-                GH_AW_GITHUB_ACTOR: process.env.GH_AW_GITHUB_ACTOR,
-                GH_AW_GITHUB_EVENT_COMMENT_ID: process.env.GH_AW_GITHUB_EVENT_COMMENT_ID,
-                GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER: process.env.GH_AW_GITHUB_EVENT_DISCUSSION_NUMBER,
-                GH_AW_GITHUB_EVENT_ISSUE_NUMBER: process.env.GH_AW_GITHUB_EVENT_ISSUE_NUMBER,
-                GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER: process.env.GH_AW_GITHUB_EVENT_PULL_REQUEST_NUMBER,
-                GH_AW_GITHUB_REPOSITORY: process.env.GH_AW_GITHUB_REPOSITORY,
-                GH_AW_GITHUB_RUN_ID: process.env.GH_AW_GITHUB_RUN_ID,
-                GH_AW_GITHUB_WORKSPACE: process.env.GH_AW_GITHUB_WORKSPACE
-              }
-            });
-      - name: Interpolate variables and render templates
+          MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
+          MCP_GATEWAY_DOMAIN: ${{ steps.start-mcp-gateway.outputs.gateway-domain }}
+          MCP_GATEWAY_PORT: ${{ steps.start-mcp-gateway.outputs.gateway-port }}
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
-          GH_AW_GITHUB_REPOSITORY: ${{ github.repository }}
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
             setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/interpolate_prompt.cjs');
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/mount_mcp_as_cli.cjs');
             await main();
-      - name: Validate prompt placeholders
-        env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
-        run: bash /opt/gh-aw/actions/validate_prompt_placeholders.sh
-      - name: Print prompt
-        env:
-          GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
-        run: bash /opt/gh-aw/actions/print_prompt_summary.sh
-      - name: Clean git credentials
-        run: bash /opt/gh-aw/actions/clean_git_credentials.sh
+      - name: Clean credentials
+        continue-on-error: true
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/clean_git_credentials.sh"
+      - name: Audit pre-agent workspace
+        id: pre_agent_audit
+        continue-on-error: true
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
       - name: Execute GitHub Copilot CLI
         id: agentic_execution
         # Copilot CLI tool arguments (sorted):
         timeout-minutes: 5
         run: |
           set -o pipefail
-          sudo -E awf --env-all --container-workdir "${GITHUB_WORKSPACE}" --allow-domains api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --enable-host-access --image-tag 0.18.0 --skip-pull \
-            -- /bin/bash -c '/usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --add-dir "${GITHUB_WORKSPACE}" --disable-builtin-mcps --allow-all-tools --allow-all-paths --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"${GH_AW_MODEL_AGENT_COPILOT:+ --model "$GH_AW_MODEL_AGENT_COPILOT"}' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
+          printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
+          touch /tmp/gh-aw/agent-step-summary.md
+          GH_AW_NODE_BIN=$(command -v node 2>/dev/null || true)
+          export GH_AW_NODE_BIN
+          export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK"
+          (umask 177 && touch /tmp/gh-aw/agent-stdio.log)
+          printf '%s\n' '{"$schema":"https://github.com/github/gh-aw-firewall/releases/download/v0.25.55/awf-config.schema.json","network":{"allowDomains":["api.business.githubcopilot.com","api.enterprise.githubcopilot.com","api.github.com","api.githubcopilot.com","api.individual.githubcopilot.com","api.snapcraft.io","archive.ubuntu.com","azure.archive.ubuntu.com","crl.geotrust.com","crl.globalsign.com","crl.identrust.com","crl.sectigo.com","crl.thawte.com","crl.usertrust.com","crl.verisign.com","crl3.digicert.com","crl4.digicert.com","crls.ssl.com","github.com","host.docker.internal","json-schema.org","json.schemastore.org","keyserver.ubuntu.com","ocsp.digicert.com","ocsp.geotrust.com","ocsp.globalsign.com","ocsp.identrust.com","ocsp.sectigo.com","ocsp.ssl.com","ocsp.thawte.com","ocsp.usertrust.com","ocsp.verisign.com","packagecloud.io","packages.cloud.google.com","packages.microsoft.com","ppa.launchpad.net","raw.githubusercontent.com","registry.npmjs.org","s.symcb.com","s.symcd.com","security.ubuntu.com","telemetry.enterprise.githubcopilot.com","ts-crl.ws.symantec.com","ts-ocsp.ws.symantec.com","www.googleapis.com"]},"apiProxy":{"enabled":true,"enableTokenSteering":true,"maxRuns":500,"maxEffectiveTokens":25000000,"models":{"agent":["sonnet-6x","gpt-5.4","gpt-5.3","gemini-pro","any"],"antigravity":["copilot/antigravity*","google/antigravity*","gemini/antigravity*"],"any":["copilot/*","anthropic/*","openai/*","google/*","gemini/*"],"claude":["agent"],"codex":["agent"],"coding":["copilot/gpt-5*codex*","openai/gpt-5*codex*","gpt-5-codex"],"computer-use":["copilot/*computer-use*","google/*computer-use*","gemini/*computer-use*","openai/*computer-use*"],"copilot":["agent"],"deep-research":["copilot/deep-research*","copilot/o3-deep-research*","copilot/o4-mini-deep-research*","google/deep-research*","gemini/deep-research*","openai/o3-deep-research*","openai/o4-mini-deep-research*"],"gemini":["agent"],"gemini-3-flash":["copilot/gemini-3*flash*","google/gemini-3*flash*","gemini/gemini-3*flash*"],"gemini-3-pro":["copilot/gemini-3*pro*","google/gemini-3*pro*","gemini/gemini-3*pro*"],"gemini-3.1-flash":["copilot/gemini-3.1*flash*","google/gemini-3.1*flash*","gemini/gemini-3.1*flash*"],"gemini-3.1-pro":["copilot/gemini-3.1*pro*","google/gemini-3.1*pro*","gemini/gemini-3.1*pro*"],"gemini-3.5-flash":["copilot/gemini-3.5*flash*","google/gemini-3.5*flash*","gemini/gemini-3.5*flash*"],"gemini-flash":["copilot/gemini-*flash*","google/gemini-*flash*","gemini/gemini-*flash*"],"gemini-flash-lite":["copilot/gemini-*flash*lite*","google/gemini-*flash*lite*","gemini/gemini-*flash*lite*"],"gemini-pro":["copilot/gemini-*pro*","google/gemini-*pro*","gemini/gemini-*pro*"],"gemma":["copilot/gemma*","google/gemma*","gemini/gemma*"],"gpt-4.1":["copilot/gpt-4.1*","openai/gpt-4.1*"],"gpt-5":["copilot/gpt-5*","openai/gpt-5*"],"gpt-5-codex":["copilot/gpt-5*codex*","openai/gpt-5*codex*"],"gpt-5-mini":["copilot/gpt-5*mini*","openai/gpt-5*mini*"],"gpt-5-nano":["copilot/gpt-5*nano*","openai/gpt-5*nano*"],"gpt-5-pro":["copilot/gpt-5*pro*","openai/gpt-5*pro*"],"gpt-5.2":["copilot/gpt-5.2*","openai/gpt-5.2*"],"gpt-5.3":["copilot/gpt-5.3*","openai/gpt-5.3*"],"gpt-5.4":["copilot/gpt-5.4*","openai/gpt-5.4*"],"gpt-5.5":["copilot/gpt-5.5*","openai/gpt-5.5*"],"haiku":["copilot/*haiku*","anthropic/*haiku*"],"large":["sonnet","gpt-5-pro","gpt-5","gemini-pro"],"mini":["haiku","gpt-5-mini","gpt-5-nano","gemini-flash-lite"],"opus":["copilot/*opus*","anthropic/*opus*"],"opusplan":["opus?effort=high"],"reasoning":["copilot/o1*","copilot/o3*","copilot/o4*","openai/o1*","openai/o3*","openai/o4*"],"robotics":["copilot/*robotics*","google/*robotics*","gemini/*robotics*"],"small":["mini"],"sonnet":["copilot/*sonnet*","anthropic/*sonnet*"],"sonnet-6x":["copilot/*sonnet-4-5-*","anthropic/*sonnet-4-5-*","copilot/*sonnet-4-6*","anthropic/*sonnet-4-6*"],"summarization":["haiku","gpt-5-mini","gemini-flash-lite","mini"],"vision":["copilot/gemini-*image*","gemini/gemini-*image*","copilot/gemini-*flash*","gemini/gemini-*flash*"]}},"container":{"imageTag":"0.25.55,squid=sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca,agent=sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731,api-proxy=sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3"}}' > "${RUNNER_TEMP}/gh-aw/awf-config.json"
+          cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
+          GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=""
+          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
+            GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS="--docker-host-path-prefix /tmp/gh-aw"
+          fi
+          # shellcheck disable=SC1003
+          sudo -E awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env COPILOT_GITHUB_TOKEN --exclude-env GITHUB_MCP_SERVER_TOKEN --exclude-env MCP_GATEWAY_API_KEY --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \
+            -- /bin/bash -c 'export PATH="${RUNNER_TEMP}/gh-aw/mcp-cli/bin:$PATH" && export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --allow-all-paths --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/agent-stdio.log
         env:
+          AWF_REFLECT_ENABLED: 1
           COPILOT_AGENT_RUNNER_TYPE: STANDALONE
+          COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+          COPILOT_MODEL: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || 'claude-sonnet-4.6' }}
           GH_AW_MCP_CONFIG: /home/runner/.copilot/mcp-config.json
-          GH_AW_MODEL_AGENT_COPILOT: ${{ vars.GH_AW_MODEL_AGENT_COPILOT || '' }}
+          GH_AW_PHASE: agent
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
-          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+          GH_AW_VERSION: v0.76.1
+          GITHUB_API_URL: ${{ github.api_url }}
+          GITHUB_AW: true
+          GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
           GITHUB_HEAD_REF: ${{ github.head_ref }}
+          GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN || secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           GITHUB_REF_NAME: ${{ github.ref_name }}
-          GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
           GITHUB_WORKSPACE: ${{ github.workspace }}
+          GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: github-actions[bot]
           XDG_CONFIG_HOME: /home/runner
+      - name: Detect agent errors
+        if: always()
+        id: detect-agent-errors
+        continue-on-error: true
+        run: node "${RUNNER_TEMP}/gh-aw/actions/detect_agent_errors.cjs"
       - name: Configure Git credentials
         env:
           REPO_NAME: ${{ github.repository }}
           SERVER_URL: ${{ github.server_url }}
+          GITHUB_TOKEN: ${{ github.token }}
         run: |
           git config --global user.email "github-actions[bot]@users.noreply.github.com"
           git config --global user.name "github-actions[bot]"
+          git config --global am.keepcr true
           # Re-authenticate git with GitHub token
           SERVER_URL_STRIPPED="${SERVER_URL#https://}"
-          git remote set-url origin "https://x-access-token:${{ github.token }}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
+          git remote set-url origin "https://x-access-token:${GITHUB_TOKEN}@${SERVER_URL_STRIPPED}/${REPO_NAME}.git"
           echo "Git configured with standard GitHub Actions identity"
       - name: Copy Copilot session state files to logs
         if: always()
         continue-on-error: true
-        run: |
-          # Copy Copilot session state files to logs folder for artifact collection
-          # This ensures they are in /tmp/gh-aw/ where secret redaction can scan them
-          SESSION_STATE_DIR="$HOME/.copilot/session-state"
-          LOGS_DIR="/tmp/gh-aw/sandbox/agent/logs"
-
-          if [ -d "$SESSION_STATE_DIR" ]; then
-            echo "Copying Copilot session state files from $SESSION_STATE_DIR to $LOGS_DIR"
-            mkdir -p "$LOGS_DIR"
-            cp -v "$SESSION_STATE_DIR"/*.jsonl "$LOGS_DIR/" 2>/dev/null || true
-            echo "Session state files copied successfully"
-          else
-            echo "No session-state directory found at $SESSION_STATE_DIR"
-          fi
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/copy_copilot_session_state.sh"
       - name: Stop MCP Gateway
         if: always()
         continue-on-error: true
@@ -658,15 +792,15 @@ jobs:
           MCP_GATEWAY_API_KEY: ${{ steps.start-mcp-gateway.outputs.gateway-api-key }}
           GATEWAY_PID: ${{ steps.start-mcp-gateway.outputs.gateway-pid }}
         run: |
-          bash /opt/gh-aw/actions/stop_mcp_gateway.sh "$GATEWAY_PID"
+          bash "${RUNNER_TEMP}/gh-aw/actions/stop_mcp_gateway.sh" "$GATEWAY_PID"
       - name: Redact secrets in logs
         if: always()
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/redact_secrets.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/redact_secrets.cjs');
             await main();
         env:
           GH_AW_SECRET_NAMES: 'COPILOT_GITHUB_TOKEN,GH_AW_GITHUB_MCP_SERVER_TOKEN,GH_AW_GITHUB_TOKEN,GITHUB_TOKEN'
@@ -674,43 +808,31 @@ jobs:
           SECRET_GH_AW_GITHUB_MCP_SERVER_TOKEN: ${{ secrets.GH_AW_GITHUB_MCP_SERVER_TOKEN }}
           SECRET_GH_AW_GITHUB_TOKEN: ${{ secrets.GH_AW_GITHUB_TOKEN }}
           SECRET_GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Upload Safe Outputs
+      - name: Append agent step summary
         if: always()
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: safe-output
-          path: ${{ env.GH_AW_SAFE_OUTPUTS }}
-          if-no-files-found: warn
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/append_agent_step_summary.sh"
+      - name: Copy Safe Outputs
+        if: always()
+        env:
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+        run: |
+          mkdir -p /tmp/gh-aw
+          cp "$GH_AW_SAFE_OUTPUTS" /tmp/gh-aw/safeoutputs.jsonl 2>/dev/null || true
       - name: Ingest agent output
         id: collect_output
         if: always()
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_SAFE_OUTPUTS: ${{ env.GH_AW_SAFE_OUTPUTS }}
-          GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com"
+          GH_AW_SAFE_OUTPUTS: ${{ steps.set-runtime-paths.outputs.GH_AW_SAFE_OUTPUTS }}
+          GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
           GITHUB_SERVER_URL: ${{ github.server_url }}
           GITHUB_API_URL: ${{ github.api_url }}
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/collect_ndjson_output.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/collect_ndjson_output.cjs');
             await main();
-      - name: Upload sanitized agent output
-        if: always() && env.GH_AW_AGENT_OUTPUT
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: agent-output
-          path: ${{ env.GH_AW_AGENT_OUTPUT }}
-          if-no-files-found: warn
-      - name: Upload engine output files
-        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
-        with:
-          name: agent_outputs
-          path: |
-            /tmp/gh-aw/sandbox/agent/logs/
-            /tmp/gh-aw/redacted-urls.log
-          if-no-files-found: ignore
       - name: Parse agent logs for step summary
         if: always()
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -718,18 +840,19 @@ jobs:
           GH_AW_AGENT_OUTPUT: /tmp/gh-aw/sandbox/agent/logs/
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/parse_copilot_log.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_copilot_log.cjs');
             await main();
       - name: Parse MCP Gateway logs for step summary
         if: always()
+        id: parse-mcp-gateway
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/parse_mcp_gateway_log.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_mcp_gateway_log.cjs');
             await main();
       - name: Print firewall logs
         if: always()
@@ -737,28 +860,65 @@ jobs:
         env:
           AWF_LOGS_DIR: /tmp/gh-aw/sandbox/firewall/logs
         run: |
-          # Fix permissions on firewall logs so they can be uploaded as artifacts
+          # Fix permissions on firewall logs/audit dirs so they can be uploaded as artifacts
           # AWF runs with sudo, creating files owned by root
-          sudo chmod -R a+r /tmp/gh-aw/sandbox/firewall/logs 2>/dev/null || true
+          sudo chmod -R a+rX /tmp/gh-aw/sandbox/firewall 2>/dev/null || true
           # Only run awf logs summary if awf command exists (it may not be installed if workflow failed before install step)
           if command -v awf &> /dev/null; then
             awf logs summary | tee -a "$GITHUB_STEP_SUMMARY"
           else
             echo 'AWF binary not installed, skipping firewall log summary'
           fi
+      - name: Parse token usage for step summary
+        if: always()
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_token_usage.cjs');
+            await main();
+      - name: Print AWF reflect summary
+        if: always()
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/awf_reflect_summary.cjs');
+            await main();
+      - name: Write agent output placeholder if missing
+        if: always()
+        run: |
+          if [ ! -f /tmp/gh-aw/agent_output.json ]; then
+            echo '{"items":[]}' > /tmp/gh-aw/agent_output.json
+          fi
       - name: Upload agent artifacts
         if: always()
         continue-on-error: true
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: agent-artifacts
+          name: agent
           path: |
             /tmp/gh-aw/aw-prompts/prompt.txt
-            /tmp/gh-aw/aw_info.json
+            /tmp/gh-aw/sandbox/agent/logs/
+            /tmp/gh-aw/redacted-urls.log
             /tmp/gh-aw/mcp-logs/
-            /tmp/gh-aw/sandbox/firewall/logs/
+            /tmp/gh-aw/agent_usage.json
             /tmp/gh-aw/agent-stdio.log
+            /tmp/gh-aw/pre-agent-audit.txt
             /tmp/gh-aw/agent/
+            /tmp/gh-aw/github_rate_limits.jsonl
+            /tmp/gh-aw/safeoutputs.jsonl
+            /tmp/gh-aw/agent_output.json
+            /tmp/gh-aw/aw-*.patch
+            /tmp/gh-aw/aw-*.bundle
+            /tmp/gh-aw/awf-config.json
+            /tmp/gh-aw/sandbox/firewall/logs/
+            /tmp/gh-aw/sandbox/firewall/audit/
+            /tmp/gh-aw/sandbox/firewall/awf-reflect.json
           if-no-files-found: ignore
 
   conclusion:
@@ -767,134 +927,252 @@ jobs:
       - agent
       - detection
       - safe_outputs
-    if: (always()) && (needs.agent.result != 'skipped')
+    if: >
+      always() && (needs.agent.result != 'skipped' || needs.activation.outputs.lockdown_check_failed == 'true' ||
+      needs.activation.outputs.stale_lock_file_failed == 'true')
     runs-on: ubuntu-slim
     permissions:
       contents: read
       discussions: write
       issues: write
       pull-requests: write
+    concurrency:
+      group: "gh-aw-conclusion-issue-triage-agent"
+      cancel-in-progress: false
+      queue: max
     outputs:
+      incomplete_count: ${{ steps.report_incomplete.outputs.incomplete_count }}
       noop_message: ${{ steps.noop.outputs.noop_message }}
       tools_reported: ${{ steps.missing_tool.outputs.tools_reported }}
       total_count: ${{ steps.missing_tool.outputs.total_count }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
         with:
-          destination: /opt/gh-aw/actions
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
       - name: Download agent output artifact
+        id: download-agent-output
         continue-on-error: true
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: agent-output
-          path: /tmp/gh-aw/safeoutputs/
+          name: agent
+          path: /tmp/gh-aw/
       - name: Setup agent output environment variable
+        id: setup-agent-output-env
+        if: steps.download-agent-output.outcome == 'success'
         run: |
-          mkdir -p /tmp/gh-aw/safeoutputs/
-          find "/tmp/gh-aw/safeoutputs/" -type f -print
-          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
-      - name: Process No-Op Messages
+          mkdir -p /tmp/gh-aw/
+          find "/tmp/gh-aw/" -type f -print
+          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+      - name: Process no-op messages
         id: noop
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_NOOP_MAX: 1
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_NOOP_MAX: "1"
           GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/tree/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github/workflows/issue-triage-agent.md"
+          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
+          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
+          GH_AW_NOOP_REPORT_AS_ISSUE: "true"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/noop.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_noop_message.cjs');
+            await main();
+      - name: Log detection run
+        id: detection_runs
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
+          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
+          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+          GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
+          GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
+        with:
+          github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
+          script: |
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_detection_runs.cjs');
             await main();
-      - name: Record Missing Tool
+      - name: Record missing tool
         id: missing_tool
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_MISSING_TOOL_CREATE_ISSUE: "true"
           GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/tree/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github/workflows/issue-triage-agent.md"
+          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/missing_tool.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/missing_tool.cjs');
             await main();
-      - name: Handle Agent Failure
-        id: handle_agent_failure
+      - name: Record incomplete
+        id: report_incomplete
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_REPORT_INCOMPLETE_CREATE_ISSUE: "true"
           GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/tree/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github/workflows/issue-triage-agent.md"
-          GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-          GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
-          GH_AW_WORKFLOW_ID: "issue-triage-agent"
-          GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.agent.outputs.secret_verification_result }}
+          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/handle_agent_failure.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/report_incomplete_handler.cjs');
             await main();
-      - name: Handle No-Op Message
-        id: handle_noop_message
+      - name: Handle agent failure
+        id: handle_agent_failure
+        if: always()
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
           GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4"
-          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/tree/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github/workflows/issue-triage-agent.md"
+          GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
+          GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
           GH_AW_RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
           GH_AW_AGENT_CONCLUSION: ${{ needs.agent.result }}
-          GH_AW_NOOP_MESSAGE: ${{ steps.noop.outputs.noop_message }}
-          GH_AW_NOOP_REPORT_AS_ISSUE: "true"
+          GH_AW_WORKFLOW_ID: "issue-triage-agent"
+          GH_AW_ACTION_FAILURE_ISSUE_EXPIRES_HOURS: "168"
+          GH_AW_ENGINE_ID: "copilot"
+          GH_AW_SECRET_VERIFICATION_RESULT: ${{ needs.activation.outputs.secret_verification_result }}
+          GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens || '' }}
+          GH_AW_EFFECTIVE_TOKENS_RATE_LIMIT_ERROR: ${{ needs.agent.outputs.effective_tokens_rate_limit_error || 'false' }}
+          GH_AW_INFERENCE_ACCESS_ERROR: ${{ needs.agent.outputs.inference_access_error }}
+          GH_AW_MCP_POLICY_ERROR: ${{ needs.agent.outputs.mcp_policy_error }}
+          GH_AW_AGENTIC_ENGINE_TIMEOUT: ${{ needs.agent.outputs.agentic_engine_timeout }}
+          GH_AW_MODEL_NOT_SUPPORTED_ERROR: ${{ needs.agent.outputs.model_not_supported_error }}
+          GH_AW_ENGINE_API_HOSTS: "api.enterprise.githubcopilot.com,api.githubcopilot.com,api.business.githubcopilot.com,api.individual.githubcopilot.com"
+          GH_AW_LOCKDOWN_CHECK_FAILED: ${{ needs.activation.outputs.lockdown_check_failed }}
+          GH_AW_STALE_LOCK_FILE_FAILED: ${{ needs.activation.outputs.stale_lock_file_failed }}
+          GH_AW_GROUP_REPORTS: "false"
+          GH_AW_FAILURE_REPORT_AS_ISSUE: "true"
+          GH_AW_MISSING_TOOL_REPORT_AS_FAILURE: "true"
+          GH_AW_MISSING_DATA_REPORT_AS_FAILURE: "true"
+          GH_AW_TIMEOUT_MINUTES: "5"
+          GH_AW_MAX_EFFECTIVE_TOKENS: "25000000"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/handle_noop_message.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/handle_agent_failure.cjs');
             await main();
 
   detection:
-    needs: agent
-    if: needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true'
+    needs:
+      - activation
+      - agent
+    if: >
+      always() && needs.agent.result != 'skipped' && (needs.agent.outputs.output_types != '' || needs.agent.outputs.has_patch == 'true')
     runs-on: ubuntu-latest
-    permissions: {}
-    timeout-minutes: 10
+    permissions:
+      contents: read
     outputs:
-      success: ${{ steps.parse_results.outputs.success }}
+      detection_conclusion: ${{ steps.detection_conclusion.outputs.conclusion }}
+      detection_reason: ${{ steps.detection_conclusion.outputs.reason }}
+      detection_success: ${{ steps.detection_conclusion.outputs.success }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
-        with:
-          destination: /opt/gh-aw/actions
-      - name: Download agent artifacts
-        continue-on-error: true
-        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
         with:
-          name: agent-artifacts
-          path: /tmp/gh-aw/threat-detection/
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
       - name: Download agent output artifact
+        id: download-agent-output
         continue-on-error: true
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: agent-output
-          path: /tmp/gh-aw/threat-detection/
-      - name: Echo agent output types
+          name: agent
+          path: /tmp/gh-aw/
+      - name: Setup agent output environment variable
+        id: setup-agent-output-env
+        if: steps.download-agent-output.outcome == 'success'
+        run: |
+          mkdir -p /tmp/gh-aw/
+          find "/tmp/gh-aw/" -type f -print
+          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+      - name: Checkout repository for patch context
+        if: needs.agent.outputs.has_patch == 'true'
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      # --- Threat Detection ---
+      - name: Clean stale firewall files from agent artifact
+        run: |
+          rm -rf /tmp/gh-aw/sandbox/firewall/logs
+          rm -rf /tmp/gh-aw/sandbox/firewall/audit
+      - name: Download container images
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/download_docker_images.sh" ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731 ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3 ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca
+      - name: Check if detection needed
+        id: detection_guard
+        if: always()
         env:
-          AGENT_OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
+          OUTPUT_TYPES: ${{ needs.agent.outputs.output_types }}
+          HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
+        run: |
+          if [[ -n "$OUTPUT_TYPES" || "$HAS_PATCH" == "true" ]]; then
+            echo "run_detection=true" >> "$GITHUB_OUTPUT"
+            echo "Detection will run: output_types=$OUTPUT_TYPES, has_patch=$HAS_PATCH"
+          else
+            echo "run_detection=false" >> "$GITHUB_OUTPUT"
+            echo "Detection skipped: no agent outputs or patches to analyze"
+          fi
+      - name: Clear MCP Config for detection
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        run: |
+          rm -f "${RUNNER_TEMP}/gh-aw/mcp-config/mcp-servers.json"
+          rm -f /home/runner/.copilot/mcp-config.json
+          rm -f "$GITHUB_WORKSPACE/.gemini/settings.json"
+      - name: Prepare threat detection files
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
         run: |
-          echo "Agent output-types: $AGENT_OUTPUT_TYPES"
+          mkdir -p /tmp/gh-aw/threat-detection/aw-prompts
+          cp /tmp/gh-aw/aw-prompts/prompt.txt /tmp/gh-aw/threat-detection/aw-prompts/prompt.txt 2>/dev/null || true
+          cp /tmp/gh-aw/agent_output.json /tmp/gh-aw/threat-detection/agent_output.json 2>/dev/null || true
+          for f in /tmp/gh-aw/aw-*.patch; do
+            [ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true
+          done
+          for f in /tmp/gh-aw/aw-*.bundle; do
+            [ -f "$f" ] && cp "$f" /tmp/gh-aw/threat-detection/ 2>/dev/null || true
+          done
+          echo "Prepared threat detection files:"
+          ls -la /tmp/gh-aw/threat-detection/ 2>/dev/null || true
       - name: Setup threat detection
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
           WORKFLOW_NAME: "Issue Triage Agent"
@@ -902,72 +1180,117 @@ jobs:
           HAS_PATCH: ${{ needs.agent.outputs.has_patch }}
         with:
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/setup_threat_detection.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/setup_threat_detection.cjs');
             await main();
       - name: Ensure threat-detection directory and log
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
         run: |
           mkdir -p /tmp/gh-aw/threat-detection
           touch /tmp/gh-aw/threat-detection/detection.log
-      - name: Validate COPILOT_GITHUB_TOKEN secret
-        id: validate-secret
-        run: /opt/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN 'GitHub Copilot CLI' https://github.github.com/gh-aw/reference/engines/#github-copilot-default
-        env:
-          COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
+      - name: Setup Node.js
+        uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: '24'
+          package-manager-cache: false
       - name: Install GitHub Copilot CLI
-        run: /opt/gh-aw/actions/install_copilot_cli.sh 0.0.410
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_copilot_cli.sh" 1.0.52
+        env:
+          GH_HOST: github.com
+      - name: Install AWF binary
+        run: bash "${RUNNER_TEMP}/gh-aw/actions/install_awf_binary.sh" v0.25.55
       - name: Execute GitHub Copilot CLI
-        id: agentic_execution
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
+        continue-on-error: true
+        id: detection_agentic_execution
         # Copilot CLI tool arguments (sorted):
-        # --allow-tool shell(cat)
-        # --allow-tool shell(grep)
-        # --allow-tool shell(head)
-        # --allow-tool shell(jq)
-        # --allow-tool shell(ls)
-        # --allow-tool shell(tail)
-        # --allow-tool shell(wc)
         timeout-minutes: 20
         run: |
           set -o pipefail
-          COPILOT_CLI_INSTRUCTION="$(cat /tmp/gh-aw/aw-prompts/prompt.txt)"
-          mkdir -p /tmp/
-          mkdir -p /tmp/gh-aw/
-          mkdir -p /tmp/gh-aw/agent/
-          mkdir -p /tmp/gh-aw/sandbox/agent/logs/
-          copilot --add-dir /tmp/ --add-dir /tmp/gh-aw/ --add-dir /tmp/gh-aw/agent/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --allow-tool 'shell(cat)' --allow-tool 'shell(grep)' --allow-tool 'shell(head)' --allow-tool 'shell(jq)' --allow-tool 'shell(ls)' --allow-tool 'shell(tail)' --allow-tool 'shell(wc)' --share /tmp/gh-aw/sandbox/agent/logs/conversation.md --prompt "$COPILOT_CLI_INSTRUCTION"${GH_AW_MODEL_DETECTION_COPILOT:+ --model "$GH_AW_MODEL_DETECTION_COPILOT"} 2>&1 | tee /tmp/gh-aw/threat-detection/detection.log
+          printf '%s' "$(date +%s%3N)" > /tmp/gh-aw/agent_cli_start_ms.txt
+          touch /tmp/gh-aw/agent-step-summary.md
+          GH_AW_NODE_BIN=$(command -v node 2>/dev/null || true)
+          export GH_AW_NODE_BIN
+          export COPILOT_API_KEY="$COPILOT_DUMMY_BYOK"
+          (umask 177 && touch /tmp/gh-aw/threat-detection/detection.log)
+          printf '%s\n' '{"$schema":"https://github.com/github/gh-aw-firewall/releases/download/v0.25.55/awf-config.schema.json","network":{"allowDomains":["api.business.githubcopilot.com","api.enterprise.githubcopilot.com","api.github.com","api.githubcopilot.com","api.individual.githubcopilot.com","github.com","host.docker.internal","telemetry.enterprise.githubcopilot.com"]},"apiProxy":{"enabled":true,"enableTokenSteering":true,"maxRuns":500,"maxEffectiveTokens":25000000},"container":{"imageTag":"0.25.55"}}' > "${RUNNER_TEMP}/gh-aw/awf-config.json"
+          cp "${RUNNER_TEMP}/gh-aw/awf-config.json" /tmp/gh-aw/awf-config.json
+          GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS=""
+          if [[ "${DOCKER_HOST:-}" =~ ^tcp:// ]]; then
+            GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS="--docker-host-path-prefix /tmp/gh-aw"
+          fi
+          # shellcheck disable=SC1003
+          sudo -E awf --config "${RUNNER_TEMP}/gh-aw/awf-config.json" --container-workdir "${GITHUB_WORKSPACE}" --mount "${RUNNER_TEMP}/gh-aw:${RUNNER_TEMP}/gh-aw:ro" --mount "${RUNNER_TEMP}/gh-aw:/host${RUNNER_TEMP}/gh-aw:ro" ${GH_AW_DOCKER_HOST_PATH_PREFIX_ARGS} --env-all --exclude-env COPILOT_GITHUB_TOKEN --log-level info --proxy-logs-dir /tmp/gh-aw/sandbox/firewall/logs --audit-dir /tmp/gh-aw/sandbox/firewall/audit --enable-host-access --allow-host-ports 80,443,8080 --skip-pull \
+            -- /bin/bash -c 'export PATH="$(find /opt/hostedtoolcache /home/runner/work/_tool -maxdepth 5 -type d -name bin 2>/dev/null | tr '\''\n'\'' '\'':'\'')$PATH"; [ -n "$GOROOT" ] && export PATH="$GOROOT/bin:$PATH" || true && GH_AW_NODE_EXEC="${GH_AW_NODE_BIN:-}"; if [ -z "$GH_AW_NODE_EXEC" ] || [ ! -x "$GH_AW_NODE_EXEC" ]; then GH_AW_NODE_EXEC="$(command -v node 2>/dev/null || true)"; fi; if [ -z "$GH_AW_NODE_EXEC" ]; then echo "node runtime missing on this runner — check runtimes.node in workflow YAML" >&2; exit 127; fi; "$GH_AW_NODE_EXEC" ${RUNNER_TEMP}/gh-aw/actions/copilot_harness.cjs /usr/local/bin/copilot --add-dir /tmp/gh-aw/ --log-level all --log-dir /tmp/gh-aw/sandbox/agent/logs/ --disable-builtin-mcps --no-ask-user --allow-all-tools --add-dir "${GITHUB_WORKSPACE}" --prompt-file /tmp/gh-aw/aw-prompts/prompt.txt' 2>&1 | tee -a /tmp/gh-aw/threat-detection/detection.log
         env:
+          AWF_REFLECT_ENABLED: 1
           COPILOT_AGENT_RUNNER_TYPE: STANDALONE
+          COPILOT_DUMMY_BYOK: dummy-byok-key-for-offline-mode
           COPILOT_GITHUB_TOKEN: ${{ secrets.COPILOT_GITHUB_TOKEN }}
-          GH_AW_MODEL_DETECTION_COPILOT: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || '' }}
+          COPILOT_MODEL: ${{ vars.GH_AW_MODEL_DETECTION_COPILOT || 'claude-sonnet-4.6' }}
+          GH_AW_PHASE: detection
           GH_AW_PROMPT: /tmp/gh-aw/aw-prompts/prompt.txt
+          GH_AW_VERSION: v0.76.1
+          GITHUB_API_URL: ${{ github.api_url }}
+          GITHUB_AW: true
+          GITHUB_COPILOT_INTEGRATION_ID: agentic-workflows
           GITHUB_HEAD_REF: ${{ github.head_ref }}
           GITHUB_REF_NAME: ${{ github.ref_name }}
-          GITHUB_STEP_SUMMARY: ${{ env.GITHUB_STEP_SUMMARY }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_STEP_SUMMARY: /tmp/gh-aw/agent-step-summary.md
           GITHUB_WORKSPACE: ${{ github.workspace }}
+          GIT_AUTHOR_EMAIL: github-actions[bot]@users.noreply.github.com
+          GIT_AUTHOR_NAME: github-actions[bot]
+          GIT_COMMITTER_EMAIL: github-actions[bot]@users.noreply.github.com
+          GIT_COMMITTER_NAME: github-actions[bot]
           XDG_CONFIG_HOME: /home/runner
-      - name: Parse threat detection results
-        id: parse_results
-        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
-        with:
-          script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/parse_threat_detection_results.cjs');
-            await main();
       - name: Upload threat detection log
-        if: always()
+        if: always() && steps.detection_guard.outputs.run_detection == 'true'
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
-          name: threat-detection.log
+          name: detection
           path: /tmp/gh-aw/threat-detection/detection.log
           if-no-files-found: ignore
+      - name: Parse and conclude threat detection
+        id: detection_conclusion
+        if: always()
+        continue-on-error: true
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          RUN_DETECTION: ${{ steps.detection_guard.outputs.run_detection }}
+          DETECTION_AGENTIC_EXECUTION_OUTCOME: ${{ steps.detection_agentic_execution.outcome }}
+          GH_AW_DETECTION_CONTINUE_ON_ERROR: "true"
+        with:
+          script: |
+            try {
+              const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+              setupGlobals(core, github, context, exec, io, getOctokit);
+              const { main } = require('${{ runner.temp }}/gh-aw/actions/parse_threat_detection_results.cjs');
+              await main();
+            } catch (loadErr) {
+              const continueOnError = process.env.GH_AW_DETECTION_CONTINUE_ON_ERROR !== 'false';
+              const detectionExecutionFailed = process.env.DETECTION_AGENTIC_EXECUTION_OUTCOME === 'failure';
+              const msg = 'ERR_SYSTEM: \u274C Unexpected error loading threat detection module: ' + (loadErr && loadErr.message ? loadErr.message : String(loadErr));
+              core.error(msg);
+              core.setOutput('reason', 'parse_error');
+              if (continueOnError && !detectionExecutionFailed) {
+                core.warning('\u26A0\uFE0F ' + msg);
+                core.setOutput('conclusion', 'warning');
+                core.setOutput('success', 'false');
+              } else {
+                core.setOutput('conclusion', 'failure');
+                core.setOutput('success', 'false');
+                core.setFailed(msg);
+              }
+            }
 
   safe_outputs:
     needs:
+      - activation
       - agent
       - detection
-    if: ((!cancelled()) && (needs.agent.result != 'skipped')) && (needs.detection.outputs.success == 'true')
+    if: (!cancelled()) && needs.agent.result != 'skipped' && needs.detection.result == 'success'
     runs-on: ubuntu-slim
     permissions:
       contents: read
@@ -976,41 +1299,89 @@ jobs:
       pull-requests: write
     timeout-minutes: 15
     env:
+      GH_AW_CALLER_WORKFLOW_ID: "${{ github.repository }}/issue-triage-agent"
+      GH_AW_DETECTION_CONCLUSION: ${{ needs.detection.outputs.detection_conclusion }}
+      GH_AW_DETECTION_REASON: ${{ needs.detection.outputs.detection_reason }}
+      GH_AW_EFFECTIVE_TOKENS: ${{ needs.agent.outputs.effective_tokens }}
+      GH_AW_ENGINE_ID: "copilot"
+      GH_AW_ENGINE_MODEL: ${{ needs.agent.outputs.model }}
+      GH_AW_ENGINE_VERSION: "1.0.52"
+      GH_AW_WORKFLOW_EMOJI: "🔧"
       GH_AW_WORKFLOW_ID: "issue-triage-agent"
       GH_AW_WORKFLOW_NAME: "Issue Triage Agent"
-      GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4"
-      GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/tree/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github/workflows/issue-triage-agent.md"
+      GH_AW_WORKFLOW_SOURCE: "github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115"
+      GH_AW_WORKFLOW_SOURCE_URL: "${{ github.server_url }}/github/gh-aw/blob/359795d49ada21681ab616bd4cbcb144a7387115/.github/workflows/issue-triage-agent.md"
     outputs:
+      code_push_failure_count: ${{ steps.process_safe_outputs.outputs.code_push_failure_count }}
+      code_push_failure_errors: ${{ steps.process_safe_outputs.outputs.code_push_failure_errors }}
+      comment_id: ${{ steps.process_safe_outputs.outputs.comment_id }}
+      comment_url: ${{ steps.process_safe_outputs.outputs.comment_url }}
       create_discussion_error_count: ${{ steps.process_safe_outputs.outputs.create_discussion_error_count }}
       create_discussion_errors: ${{ steps.process_safe_outputs.outputs.create_discussion_errors }}
       process_safe_outputs_processed_count: ${{ steps.process_safe_outputs.outputs.processed_count }}
       process_safe_outputs_temporary_id_map: ${{ steps.process_safe_outputs.outputs.temporary_id_map }}
     steps:
       - name: Setup Scripts
-        uses: github/gh-aw/actions/setup@0feed75a980b06f247abbbf80127f8eb2c19e2c5 # v0.74.8
+        id: setup
+        uses: github/gh-aw-actions/setup@46d564922b082d0db93244972e8005ea6904ee5f # v0.76.1
         with:
-          destination: /opt/gh-aw/actions
+          destination: ${{ runner.temp }}/gh-aw/actions
+          job-name: ${{ github.job }}
+          trace-id: ${{ needs.activation.outputs.setup-trace-id }}
+          parent-span-id: ${{ needs.activation.outputs.setup-parent-span-id || needs.activation.outputs.setup-span-id }}
+        env:
+          GH_AW_SETUP_WORKFLOW_NAME: "Issue Triage Agent"
+          GH_AW_CURRENT_WORKFLOW_REF: ${{ github.repository }}/.github/workflows/issue-triage-agent.lock.yml@${{ github.ref }}
+          GH_AW_INFO_VERSION: "1.0.52"
+          GH_AW_INFO_AWF_VERSION: "v0.25.55"
+          GH_AW_INFO_BODY_MODIFIED: "false"
+          GH_AW_INFO_ENGINE_ID: "copilot"
       - name: Download agent output artifact
+        id: download-agent-output
         continue-on-error: true
         uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
-          name: agent-output
-          path: /tmp/gh-aw/safeoutputs/
+          name: agent
+          path: /tmp/gh-aw/
       - name: Setup agent output environment variable
+        id: setup-agent-output-env
+        if: steps.download-agent-output.outcome == 'success'
+        run: |
+          mkdir -p /tmp/gh-aw/
+          find "/tmp/gh-aw/" -type f -print
+          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/agent_output.json" >> "$GITHUB_OUTPUT"
+      - name: Configure GH_HOST for enterprise compatibility
+        id: ghes-host-config
+        shell: bash
         run: |
-          mkdir -p /tmp/gh-aw/safeoutputs/
-          find "/tmp/gh-aw/safeoutputs/" -type f -print
-          echo "GH_AW_AGENT_OUTPUT=/tmp/gh-aw/safeoutputs/agent_output.json" >> "$GITHUB_ENV"
+          # Derive GH_HOST from GITHUB_SERVER_URL so the gh CLI targets the correct
+          # GitHub instance (GHES/GHEC). On github.com this is a harmless no-op.
+          GH_HOST="${GITHUB_SERVER_URL#https://}"
+          GH_HOST="${GH_HOST#http://}"
+          echo "GH_HOST=${GH_HOST}" >> "$GITHUB_ENV"
       - name: Process Safe Outputs
         id: process_safe_outputs
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         env:
-          GH_AW_AGENT_OUTPUT: ${{ env.GH_AW_AGENT_OUTPUT }}
-          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"add_labels\":{\"allowed\":[\"bug\",\"feature\",\"enhancement\",\"documentation\",\"question\",\"help-wanted\",\"good-first-issue\"]},\"missing_data\":{},\"missing_tool\":{}}"
+          GH_AW_AGENT_OUTPUT: ${{ steps.setup-agent-output-env.outputs.GH_AW_AGENT_OUTPUT }}
+          GH_AW_COMMENT_ID: ${{ needs.activation.outputs.comment_id }}
+          GH_AW_ALLOWED_DOMAINS: "api.business.githubcopilot.com,api.enterprise.githubcopilot.com,api.github.com,api.githubcopilot.com,api.individual.githubcopilot.com,api.snapcraft.io,archive.ubuntu.com,azure.archive.ubuntu.com,crl.geotrust.com,crl.globalsign.com,crl.identrust.com,crl.sectigo.com,crl.thawte.com,crl.usertrust.com,crl.verisign.com,crl3.digicert.com,crl4.digicert.com,crls.ssl.com,github.com,host.docker.internal,json-schema.org,json.schemastore.org,keyserver.ubuntu.com,ocsp.digicert.com,ocsp.geotrust.com,ocsp.globalsign.com,ocsp.identrust.com,ocsp.sectigo.com,ocsp.ssl.com,ocsp.thawte.com,ocsp.usertrust.com,ocsp.verisign.com,packagecloud.io,packages.cloud.google.com,packages.microsoft.com,ppa.launchpad.net,raw.githubusercontent.com,registry.npmjs.org,s.symcb.com,s.symcd.com,security.ubuntu.com,telemetry.enterprise.githubcopilot.com,ts-crl.ws.symantec.com,ts-ocsp.ws.symantec.com,www.googleapis.com"
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_API_URL: ${{ github.api_url }}
+          GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG: "{\"add_comment\":{\"max\":1},\"add_labels\":{\"allowed\":[\"bug\",\"feature\",\"enhancement\",\"documentation\",\"question\",\"help-wanted\",\"good-first-issue\"]},\"create_report_incomplete_issue\":{},\"missing_data\":{},\"missing_tool\":{},\"noop\":{\"max\":1,\"report-as-issue\":\"true\"},\"report_incomplete\":{}}"
         with:
           github-token: ${{ secrets.GH_AW_GITHUB_TOKEN || secrets.GITHUB_TOKEN }}
           script: |
-            const { setupGlobals } = require('/opt/gh-aw/actions/setup_globals.cjs');
-            setupGlobals(core, github, context, exec, io);
-            const { main } = require('/opt/gh-aw/actions/safe_output_handler_manager.cjs');
+            const { setupGlobals } = require('${{ runner.temp }}/gh-aw/actions/setup_globals.cjs');
+            setupGlobals(core, github, context, exec, io, getOctokit);
+            const { main } = require('${{ runner.temp }}/gh-aw/actions/safe_output_handler_manager.cjs');
             await main();
+      - name: Upload Safe Outputs Items
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: safe-outputs-items
+          path: |
+            /tmp/gh-aw/safe-output-items.jsonl
+            /tmp/gh-aw/temporary-id-map.json
+          if-no-files-found: ignore
diff --git a/.github/workflows/issue-triage-agent.md b/.github/workflows/issue-triage-agent.md
index 06ff227b740d..26c43644618c 100644
--- a/.github/workflows/issue-triage-agent.md
+++ b/.github/workflows/issue-triage-agent.md
@@ -1,11 +1,11 @@
 ---
 on:
-  schedule: 0 14 * * 1-5
+  schedule: daily around 14:00 on weekdays
   workflow_dispatch: null
 permissions:
   issues: read
 imports:
-- github/gh-aw/.github/workflows/shared/reporting.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4
+- github/gh-aw/.github/workflows/shared/reporting.md@359795d49ada21681ab616bd4cbcb144a7387115
 safe-outputs:
   add-comment: {}
   add-labels:
@@ -17,10 +17,12 @@ safe-outputs:
     - question
     - help-wanted
     - good-first-issue
-source: github/gh-aw/.github/workflows/issue-triage-agent.md@94662b1dee8ce96c876ba9f33b3ab8be32de82a4
+emoji: 🔧
+source: github/gh-aw/.github/workflows/issue-triage-agent.md@359795d49ada21681ab616bd4cbcb144a7387115
 strict: true
 timeout-minutes: 5
 tools:
+  cli-proxy: true
   github:
     toolsets:
     - issues
@@ -45,7 +47,7 @@ Hi @{author}! I've categorized this issue as **{label_name}** based on the follo
 **Reasoning**: {brief_explanation_of_why_this_label}
 
 <details>
-<summary><b>View Triage Details</b></summary>
+<summary>View Triage Details</summary>
 
 #### Analysis
 - **Keywords detected**: {list_of_keywords_that_matched}
@@ -76,3 +78,15 @@ For efficiency, if multiple issues are triaged in a single run:
 3. Optionally: Create a discussion summarizing all triage actions for that run
 
 This provides both per-issue context and batch visibility.
+
+## Labels
+
+- `bug`: Indicates a problem or error in the code that needs fixing.
+- `feature`: Represents a new feature request or enhancement to existing functionality.
+- `enhancement`: Suggests improvements to existing features or code.
+- `documentation`: Pertains to issues related to documentation, such as missing or unclear docs.
+- `question`: Used for issues that are asking for clarification or have questions about the project.
+- `help-wanted`: Indicates that the issue is a good candidate for external contributions and help
+- `good-first-issue`: Marks issues that are suitable for newcomers to the project, often with simpler scope.
+
+{{#runtime-import shared/noop-reminder.md}}

From be5194814616ec8d3bf9410ed6bc533186bd0eed Mon Sep 17 00:00:00 2001
From: Gabriel Pordeus Santos <gabriel.santos@scclouds.com.br>
Date: Wed, 3 Jun 2026 15:06:06 -0300
Subject: [PATCH 57/64] Stop role from auto-changing if user manually selected
 a role during account creation (#13320)

---
 ui/src/views/iam/AddAccount.vue | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/ui/src/views/iam/AddAccount.vue b/ui/src/views/iam/AddAccount.vue
index 25b45cded4ec..a211fd2d8c3d 100644
--- a/ui/src/views/iam/AddAccount.vue
+++ b/ui/src/views/iam/AddAccount.vue
@@ -36,6 +36,7 @@
             v-focus="true"
             showSearch
             optionFilterProp="label"
+            @change="onRoleChange"
             :filterOption="(input, option) => {
               return option.label.toLowerCase().indexOf(input.toLowerCase()) >= 0
             }">
@@ -211,6 +212,7 @@ export default {
       domain: { id: null, loading: false },
       domainsList: [],
       dom: null,
+      roleManuallySelected: false,
       roleLoading: false,
       roles: [],
       timeZoneLoading: false,
@@ -299,8 +301,13 @@ export default {
         })
       }
     },
+    onRoleChange (newRoleId) {
+      if (newRoleId) {
+        this.roleManuallySelected = true
+      }
+    },
     setDefaultRole () {
-      if (this.roles.length === 0) return
+      if (this.roles.length === 0 || this.roleManuallySelected) return
 
       let targetRoleType = null
 

From a1959f2dc2e93badc5f3e04a85922f9d391c8ba0 Mon Sep 17 00:00:00 2001
From: Abhishek Kumar <abhishek.mrt22@gmail.com>
Date: Mon, 8 Jun 2026 12:17:00 +0530
Subject: [PATCH 58/64] backup: veeam kvm integration (#12991)

This PR introduces the initial implementation of Veeam integration support for KVM in CloudStack by adding a UHAPI-compatible server and image server components.

Veeam Backup & Replication interacts with virtualization platforms using its Universal Hypervisor API (UHAPI). To enable backup and restore workflows for CloudStack-managed KVM environments, this change introduces a UHAPI server that exposes CloudStack resources through a UHAPI-compatible interface.

In addition to the control plane APIs, an image server component is introduced to handle the data transfer operations required during backup and restore workflows.


The integration consists of two main components:

1. UHAPI Server (Control Plane) named CloudStack Veeam Control Service

A lightweight UHAPI server runs inside the CloudStack management server and exposes endpoints under:

/ovirt-engine
    - /api - For APIs
    - /sso - For authentication
    - /services/pki-resource - For certificates

This server provides inventory discovery APIs required by Veeam and translates CloudStack resources into the structures expected by UHAPI.

The server:

- exposes infrastructure inventory
- handles authentication and session tokens
- maps CloudStack resources to UHAPI-compatible representations


2. Image Server (Data Plane) named CloudStack Image Service

A separate image server component is introduced to handle backup and restore data transfer operations.

This component:

- serves disk image data during backup
- receives image data during restore operations
- exposes endpoints used by Veeam worker components
- integrates with CloudStack storage to read and write VM disk data

The separation between both these components server ensures that:

- metadata APIs and control operations remain lightweight
- bulk image transfer operations are handled independently

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Co-authored-by: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com>
Co-authored-by: abh1sar <abhisar.sinha@gmail.com>
Co-authored-by: Wei Zhou <weizhou@apache.org>
---
 agent/conf/agent.properties                   |    8 +
 .../agent/properties/AgentProperties.java     |   14 +
 .../com/cloud/storage/VolumeApiService.java   |    9 +
 .../java/com/cloud/user/AccountService.java   |    6 +
 .../java/com/cloud/vm/VmDetailConstants.java  |    6 +
 .../apache/cloudstack/api/ApiConstants.java   |    5 +
 .../cloudstack/api/ApiServerService.java      |   19 +
 .../api/BaseAsyncCreateCustomIdCmd.java       |    2 +-
 .../admin/backup/CreateImageTransferCmd.java  |  100 +
 .../admin/backup/DeleteVmCheckpointCmd.java   |   85 +
 .../admin/backup/FinalizeBackupCmd.java       |  103 +
 .../backup/FinalizeImageTransferCmd.java      |   69 +
 .../admin/backup/ListImageTransfersCmd.java   |   81 +
 .../admin/backup/ListVmCheckpointsCmd.java    |   69 +
 .../command/admin/backup/StartBackupCmd.java  |  120 +
 .../command/admin/config/ListCfgsByCmd.java   |   24 +-
 .../api/command/admin/config/ResetCfgCmd.java |   20 +-
 .../command/admin/config/UpdateCfgCmd.java    |   24 +-
 .../api/command/admin/vm/AssignVMCmd.java     |   31 +
 .../command/admin/vm/DeployVMCmdByAdmin.java  |   46 +
 .../command/admin/vm/DestroyVMCmdByAdmin.java |   20 +-
 .../offering/ListServiceOfferingsCmd.java     |   16 +
 .../api/command/user/vm/AddNicToVMCmd.java    |   20 +
 .../api/command/user/vm/BaseDeployVMCmd.java  |   45 +-
 .../api/command/user/vm/DeployVMCmd.java      |  111 +-
 .../api/command/user/vm/DestroyVMCmd.java     |    4 +
 .../api/command/user/vm/UpdateVMCmd.java      |    8 +
 .../command/user/volume/AssignVolumeCmd.java  |   15 +
 .../command/user/volume/CreateVolumeCmd.java  |   10 +-
 .../command/user/volume/DetachVolumeCmd.java  |    4 +
 .../api/response/BackupResponse.java          |   36 +
 .../api/response/CheckpointResponse.java      |   53 +
 .../api/response/ImageTransferResponse.java   |  104 +
 .../org/apache/cloudstack/backup/Backup.java  |   10 +-
 .../cloudstack/backup/ImageTransfer.java      |   61 +
 .../backup/KVMBackupExportService.java        |  106 +
 .../storage/sharedfs/SharedFSService.java     |   15 +-
 .../api/command/admin/vm/AssignVMCmdTest.java |   55 +
 .../admin/vm/DeployVMCmdByAdminTest.java      |   75 +
 .../api/command/user/vm/DeployVMCmdTest.java  |  144 ++
 client/pom.xml                                |    5 +
 .../backup/CreateImageTransferAnswer.java     |   56 +
 .../backup/CreateImageTransferCommand.java    |   94 +
 .../backup/DeleteVmCheckpointCommand.java     |   60 +
 .../backup/FinalizeImageTransferCommand.java  |   40 +
 .../cloudstack/backup/StartBackupAnswer.java  |   44 +
 .../cloudstack/backup/StartBackupCommand.java |   91 +
 .../backup/StartNBDServerAnswer.java          |   56 +
 .../backup/StartNBDServerCommand.java         |   78 +
 .../cloudstack/backup/StopBackupAnswer.java   |   30 +
 .../cloudstack/backup/StopBackupCommand.java  |   52 +
 .../backup/StopNBDServerCommand.java          |   46 +
 debian/control                                |    2 +-
 .../com/cloud/vm/VirtualMachineManager.java   |    6 +
 .../cloud/vm/VirtualMachineManagerImpl.java   |   24 +-
 .../orchestration/CloudOrchestrator.java      |    7 +-
 ...ring-engine-orchestration-core-context.xml |    1 +
 .../java/com/cloud/dc/dao/ClusterDao.java     |    3 +
 .../java/com/cloud/dc/dao/ClusterDaoImpl.java |   18 +
 .../com/cloud/network/dao/NetworkDao.java     |    6 +
 .../com/cloud/network/dao/NetworkDaoImpl.java |   42 +-
 .../security/dao/SecurityGroupDao.java        |    2 +
 .../security/dao/SecurityGroupDaoImpl.java    |   10 +
 .../cloud/storage/dao/DiskOfferingDao.java    |    2 +-
 .../storage/dao/DiskOfferingDaoImpl.java      |    8 +-
 .../com/cloud/storage/dao/VMTemplateDao.java  |    2 +
 .../cloud/storage/dao/VMTemplateDaoImpl.java  |    8 +
 .../java/com/cloud/storage/dao/VolumeDao.java |    2 +
 .../com/cloud/storage/dao/VolumeDaoImpl.java  |   11 +
 .../com/cloud/tags/dao/ResourceTagDao.java    |   13 +-
 .../cloud/tags/dao/ResourceTagsDaoImpl.java   |   67 +-
 .../main/java/com/cloud/vm/dao/NicDao.java    |    2 +
 .../java/com/cloud/vm/dao/NicDaoImpl.java     |    7 +
 .../java/com/cloud/vm/dao/VMInstanceDao.java  |    2 +
 .../com/cloud/vm/dao/VMInstanceDaoImpl.java   |   16 +
 .../apache/cloudstack/backup/BackupVO.java    |   48 +
 .../cloudstack/backup/ImageTransferVO.java    |  242 ++
 .../backup/dao/ImageTransferDao.java          |   36 +
 .../backup/dao/ImageTransferDaoImpl.java      |  136 +
 .../storage/sharedfs/dao/SharedFSDao.java     |    2 +
 .../storage/sharedfs/dao/SharedFSDaoImpl.java |   10 +
 ...spring-engine-schema-core-daos-context.xml |    2 +
 .../META-INF/db/schema-42100to42200.sql       |    1 -
 .../META-INF/db/schema-42210to42300.sql       |   47 +
 .../META-INF/db/views/cloud.user_vm_view.sql  |    1 +
 .../cloud/storage/dao/VolumeDaoImplTest.java  |   65 +-
 .../userdata/UserDataManagerImpl.java         |    6 +-
 framework/cluster/pom.xml                     |    6 +
 .../cluster/ManagementServerHostDetailVO.java |   87 +
 .../dao/ManagementServerHostDetailsDao.java   |   26 +
 .../ManagementServerHostDetailsDaoImpl.java   |   46 +
 .../framework/jobs/dao/AsyncJobDao.java       |    2 +
 .../framework/jobs/dao/AsyncJobDaoImpl.java   |   10 +
 packaging/el8/cloud.spec                      |    2 +
 .../resource/ImageServerControlSocket.java    |  123 +
 .../resource/LibvirtComputingResource.java    |   45 +
 ...virtCreateImageTransferCommandWrapper.java |  178 ++
 ...bvirtDeleteVmCheckpointCommandWrapper.java |   79 +
 ...rtFinalizeImageTransferCommandWrapper.java |  101 +
 .../LibvirtStartBackupCommandWrapper.java     |  300 +++
 .../LibvirtStartNBDServerCommandWrapper.java  |  197 ++
 .../LibvirtStopBackupCommandWrapper.java      |   69 +
 .../LibvirtStopNBDServerCommandWrapper.java   |   72 +
 ...CreateImageTransferCommandWrapperTest.java |  121 +
 ...tDeleteVmCheckpointCommandWrapperTest.java |   88 +
 ...nalizeImageTransferCommandWrapperTest.java |   87 +
 .../LibvirtStartBackupCommandWrapperTest.java |  182 ++
 ...bvirtStartNBDServerCommandWrapperTest.java |  179 ++
 .../LibvirtStopBackupCommandWrapperTest.java  |   95 +
 .../veeam-control-service/pom.xml             |   66 +
 .../apache/cloudstack/veeam/RouteHandler.java |   81 +
 .../cloudstack/veeam/VeeamControlServer.java  |  221 ++
 .../cloudstack/veeam/VeeamControlService.java |   89 +
 .../veeam/VeeamControlServiceImpl.java        |  157 ++
 .../cloudstack/veeam/VeeamControlServlet.java |  161 ++
 .../cloudstack/veeam/adapter/ApiAccess.java   |   31 +
 .../veeam/adapter/ApiAccessInterceptor.java   |   68 +
 .../veeam/adapter/ServerAdapter.java          | 2188 +++++++++++++++++
 .../cloudstack/veeam/api/ApiRouteHandler.java |  129 +
 .../veeam/api/ClustersRouteHandler.java       |  110 +
 .../veeam/api/DataCentersRouteHandler.java    |  151 ++
 .../veeam/api/DisksRouteHandler.java          |  201 ++
 .../veeam/api/HostsRouteHandler.java          |  110 +
 .../veeam/api/ImageTransfersRouteHandler.java |  162 ++
 .../veeam/api/JobsRouteHandler.java           |  108 +
 .../veeam/api/NetworksRouteHandler.java       |  110 +
 .../veeam/api/TagsRouteHandler.java           |  111 +
 .../cloudstack/veeam/api/VmsRouteHandler.java |  580 +++++
 .../veeam/api/VnicProfilesRouteHandler.java   |  110 +
 .../AsyncJobJoinVOToJobConverter.java         |   90 +
 .../converter/BackupVOToBackupConverter.java  |   99 +
 .../ClusterVOToClusterConverter.java          |  155 ++
 ...DataCenterJoinVOToDataCenterConverter.java |   76 +
 .../converter/HostJoinVOToHostConverter.java  |  103 +
 ...ageTransferVOToImageTransferConverter.java |   89 +
 .../NetworkVOToNetworkConverter.java          |   79 +
 .../NetworkVOToVnicProfileConverter.java      |   65 +
 .../api/converter/NicVOToNicConverter.java    |  116 +
 .../ResourceTagVOToTagConverter.java          |   82 +
 .../StoreVOToStorageDomainConverter.java      |  244 ++
 .../converter/UserVmJoinVOToVmConverter.java  |  270 ++
 .../UserVmVOToCheckpointConverter.java        |   45 +
 .../VmSnapshotVOToSnapshotConverter.java      |   54 +
 .../VolumeJoinVOToDiskConverter.java          |  198 ++
 .../apache/cloudstack/veeam/api/dto/Api.java  |  104 +
 .../cloudstack/veeam/api/dto/ApiSummary.java  |   61 +
 .../cloudstack/veeam/api/dto/Backup.java      |  103 +
 .../cloudstack/veeam/api/dto/BaseDto.java     |   55 +
 .../cloudstack/veeam/api/dto/Certificate.java |   42 +
 .../cloudstack/veeam/api/dto/Checkpoint.java  |   76 +
 .../cloudstack/veeam/api/dto/Cluster.java     |  408 +++
 .../apache/cloudstack/veeam/api/dto/Cpu.java  |   69 +
 .../cloudstack/veeam/api/dto/DataCenter.java  |  129 +
 .../apache/cloudstack/veeam/api/dto/Disk.java |  247 ++
 .../veeam/api/dto/DiskAttachment.java         |  124 +
 .../veeam/api/dto/EmptyElement.java           |   26 +
 .../veeam/api/dto/EmptyElementSerializer.java |   36 +
 .../cloudstack/veeam/api/dto/Fault.java       |   39 +
 .../apache/cloudstack/veeam/api/dto/Host.java |  315 +++
 .../veeam/api/dto/ImageTransfer.java          |  167 ++
 .../apache/cloudstack/veeam/api/dto/Ip.java   |   61 +
 .../apache/cloudstack/veeam/api/dto/Job.java  |  117 +
 .../apache/cloudstack/veeam/api/dto/Link.java |   49 +
 .../apache/cloudstack/veeam/api/dto/Mac.java  |   34 +
 .../cloudstack/veeam/api/dto/NamedList.java   |   63 +
 .../cloudstack/veeam/api/dto/Network.java     |  126 +
 .../apache/cloudstack/veeam/api/dto/Nic.java  |  122 +
 .../apache/cloudstack/veeam/api/dto/Os.java   |  114 +
 .../cloudstack/veeam/api/dto/OvfXmlUtil.java  | 1138 +++++++++
 .../cloudstack/veeam/api/dto/ProductInfo.java |   52 +
 .../apache/cloudstack/veeam/api/dto/Ref.java  |   31 +
 .../veeam/api/dto/ReportedDevice.java         |   84 +
 .../veeam/api/dto/ResourceAction.java         |   39 +
 .../cloudstack/veeam/api/dto/Snapshot.java    |  105 +
 .../veeam/api/dto/SpecialObjects.java         |   43 +
 .../cloudstack/veeam/api/dto/Storage.java     |   70 +
 .../veeam/api/dto/StorageDomain.java          |  236 ++
 .../veeam/api/dto/SummaryCount.java           |   43 +
 .../veeam/api/dto/SupportedVersions.java      |   38 +
 .../apache/cloudstack/veeam/api/dto/Tag.java  |   57 +
 .../cloudstack/veeam/api/dto/Topology.java    |   60 +
 .../cloudstack/veeam/api/dto/Version.java     |   94 +
 .../apache/cloudstack/veeam/api/dto/Vm.java   |  643 +++++
 .../cloudstack/veeam/api/dto/VmAction.java    |   30 +
 .../cloudstack/veeam/api/dto/VnicProfile.java |   81 +
 .../veeam/api/request/ListQuery.java          |  158 ++
 .../filter/AllowedClientCidrsFilter.java      |  100 +
 .../veeam/filter/BearerOrBasicAuthFilter.java |  220 ++
 .../services/PkiResourceRouteHandler.java     |  106 +
 .../cloudstack/veeam/sso/SsoService.java      |  136 +
 .../veeam/utils/CloudConfigUtil.java          |  156 ++
 .../cloudstack/veeam/utils/DataUtil.java      |   44 +
 .../cloudstack/veeam/utils/JwtUtil.java       |   61 +
 .../apache/cloudstack/veeam/utils/Mapper.java |   63 +
 .../cloudstack/veeam/utils/Negotiation.java   |   45 +
 .../cloudstack/veeam/utils/PathUtil.java      |   75 +
 .../veeam/utils/ResponseWriter.java           |   87 +
 .../veeam-control-service/module.properties   |   18 +
 .../spring-veeam-control-service-context.xml  |   66 +
 .../veeam/VeeamControlServerTest.java         |  227 ++
 .../veeam/VeeamControlServiceImplTest.java    |  185 ++
 .../veeam/VeeamControlServletTest.java        |  121 +
 .../adapter/ApiAccessInterceptorTest.java     |  204 ++
 .../veeam/adapter/ServerAdapterTest.java      | 1140 +++++++++
 .../veeam/api/ApiRouteHandlerTest.java        |   91 +
 .../veeam/api/ClustersRouteHandlerTest.java   |   80 +
 .../api/DataCentersRouteHandlerTest.java      |   91 +
 .../veeam/api/DisksRouteHandlerTest.java      |  122 +
 .../veeam/api/HostsRouteHandlerTest.java      |   64 +
 .../api/ImageTransfersRouteHandlerTest.java   |  102 +
 .../veeam/api/JobsRouteHandlerTest.java       |   67 +
 .../veeam/api/NetworksRouteHandlerTest.java   |   63 +
 .../veeam/api/RouteHandlerTestSupport.java    |  102 +
 .../veeam/api/TagsRouteHandlerTest.java       |   63 +
 .../veeam/api/VmsRouteHandlerTest.java        |  297 +++
 .../api/VnicProfilesRouteHandlerTest.java     |   63 +
 .../AsyncJobJoinVOToJobConverterTest.java     |   85 +
 .../BackupVOToBackupConverterTest.java        |   99 +
 .../ClusterVOToClusterConverterTest.java      |   81 +
 ...CenterJoinVOToDataCenterConverterTest.java |   88 +
 .../HostJoinVOToHostConverterTest.java        |  123 +
 ...ransferVOToImageTransferConverterTest.java |   41 +
 .../NetworkVOToNetworkConverterTest.java      |  113 +
 .../NetworkVOToVnicProfileConverterTest.java  |  100 +
 .../converter/NicVOToNicConverterTest.java    |   66 +
 .../ResourceTagVOToTagConverterTest.java      |   87 +
 .../StoreVOToStorageDomainConverterTest.java  |   99 +
 .../UserVmJoinVOToVmConverterTest.java        |  140 ++
 .../UserVmVOToCheckpointConverterTest.java    |   56 +
 .../VmSnapshotVOToSnapshotConverterTest.java  |   74 +
 .../VolumeJoinVOToDiskConverterTest.java      |  100 +
 .../cloudstack/veeam/api/dto/BackupTest.java  |   79 +
 .../cloudstack/veeam/api/dto/BaseDtoTest.java |  100 +
 .../veeam/api/dto/CertificateTest.java        |   45 +
 .../cloudstack/veeam/api/dto/DiskTest.java    |   68 +
 .../veeam/api/dto/DtoSerializationTest.java   |   82 +
 .../cloudstack/veeam/api/dto/FaultTest.java   |   41 +
 .../cloudstack/veeam/api/dto/HostTest.java    |   73 +
 .../veeam/api/dto/ImageTransferTest.java      |   67 +
 .../cloudstack/veeam/api/dto/MacIpTest.java   |   67 +
 .../veeam/api/dto/NamedListTest.java          |   93 +
 .../veeam/api/dto/OvfXmlUtilTest.java         |   81 +
 .../veeam/api/dto/ProductInfoApiTest.java     |   95 +
 .../veeam/api/dto/SnapshotTest.java           |   51 +
 .../veeam/api/dto/StorageDomainTest.java      |   53 +
 .../veeam/api/dto/SummaryCountTest.java       |   57 +
 .../veeam/api/dto/TopologyTest.java           |   78 +
 .../cloudstack/veeam/api/dto/VersionTest.java |   80 +
 .../cloudstack/veeam/api/dto/VmTest.java      |   98 +
 .../dto/VnicProfileReportedDeviceTest.java    |   83 +
 .../veeam/api/request/ListQueryTest.java      |   92 +
 .../filter/AllowedClientCidrsFilterTest.java  |  130 +
 .../filter/BearerOrBasicAuthFilterTest.java   |  129 +
 .../services/PkiResourceRouteHandlerTest.java |  127 +
 .../cloudstack/veeam/sso/SsoServiceTest.java  |  219 ++
 .../veeam/utils/CloudConfigUtilTest.java      |   82 +
 .../cloudstack/veeam/utils/DataUtilTest.java  |   57 +
 .../cloudstack/veeam/utils/JwtUtilTest.java   |   79 +
 .../cloudstack/veeam/utils/MapperTest.java    |   72 +
 .../veeam/utils/NegotiationTest.java          |   66 +
 .../cloudstack/veeam/utils/PathUtilTest.java  |   54 +
 .../veeam/utils/ResponseWriterTest.java       |  116 +
 .../src/test/resources/test-ovf.xml           |  225 ++
 .../management/MockAccountManager.java        |   40 +-
 plugins/pom.xml                               |    1 +
 .../vm/hypervisor/kvm/imageserver/__init__.py |   32 +
 .../vm/hypervisor/kvm/imageserver/__main__.py |   20 +
 .../kvm/imageserver/backends/__init__.py      |   36 +
 .../kvm/imageserver/backends/base.py          |  148 ++
 .../kvm/imageserver/backends/file.py          |  123 +
 .../kvm/imageserver/backends/nbd.py           |  471 ++++
 .../vm/hypervisor/kvm/imageserver/config.py   |  204 ++
 .../hypervisor/kvm/imageserver/constants.py   |   55 +
 .../vm/hypervisor/kvm/imageserver/handler.py  |  899 +++++++
 .../vm/hypervisor/kvm/imageserver/server.py   |  222 ++
 .../kvm/imageserver/tests/__init__.py         |   22 +
 .../kvm/imageserver/tests/test_base.py        |  568 +++++
 .../imageserver/tests/test_combinations.py    |  397 +++
 .../imageserver/tests/test_control_socket.py  |  258 ++
 .../imageserver/tests/test_file_backend.py    |  230 ++
 .../tests/test_http11_lifecycle.py            |  148 ++
 .../kvm/imageserver/tests/test_nbd_backend.py |  706 ++++++
 .../imageserver/tests/test_registry_idle.py   |  101 +
 .../kvm/imageserver/tests/test_stress_io.py   |  412 ++++
 .../tests/test_transfer_idle_expiry.py        |   57 +
 .../kvm/imageserver/tests/test_util.py        |  122 +
 scripts/vm/hypervisor/kvm/imageserver/util.py |  125 +
 .../main/java/com/cloud/api/ApiServer.java    |  188 +-
 .../cloud/api/query/dao/AsyncJobJoinDao.java  |    4 +
 .../api/query/dao/AsyncJobJoinDaoImpl.java    |   18 +-
 .../api/query/dao/DataCenterJoinDao.java      |    5 +
 .../api/query/dao/DataCenterJoinDaoImpl.java  |   33 +-
 .../com/cloud/api/query/dao/HostJoinDao.java  |    4 +
 .../cloud/api/query/dao/HostJoinDaoImpl.java  |   26 +
 .../api/query/dao/StoragePoolJoinDao.java     |    5 +
 .../api/query/dao/StoragePoolJoinDaoImpl.java |   31 +-
 .../cloud/api/query/dao/UserVmJoinDao.java    |    6 +
 .../api/query/dao/UserVmJoinDaoImpl.java      |   43 +-
 .../cloud/api/query/dao/VolumeJoinDao.java    |    7 +
 .../api/query/dao/VolumeJoinDaoImpl.java      |   49 +-
 .../com/cloud/api/query/vo/UserVmJoinVO.java  |   13 +-
 .../com/cloud/api/query/vo/VolumeJoinVO.java  |    5 +
 .../ConfigurationManagerImpl.java             |   34 +-
 .../cloud/server/ManagementServerImpl.java    |    6 +
 .../cloud/storage/VolumeApiServiceImpl.java   |  131 +-
 .../java/com/cloud/user/AccountManager.java   |    2 +
 .../com/cloud/user/AccountManagerImpl.java    |   25 +
 .../main/java/com/cloud/vm/UserVmManager.java |    7 +-
 .../java/com/cloud/vm/UserVmManagerImpl.java  |  188 +-
 .../cloudstack/backup/BackupManagerImpl.java  |   19 +-
 .../backup/KVMBackupExportServiceImpl.java    | 1036 ++++++++
 .../backup/VmWorkWaitForBackupFinalize.java   |   35 +
 .../storage/sharedfs/SharedFSServiceImpl.java |   33 +
 .../spring-server-core-managers-context.xml   |    2 +
 .../query/dao/StoragePoolJoinDaoImplTest.java |  121 +
 .../ConfigurationManagerImplTest.java         |    1 +
 .../server/ManagementServerImplTest.java      |    1 +
 .../storage/VolumeApiServiceImplTest.java     |  139 +-
 .../com/cloud/vm/UserVmManagerImplTest.java   |    5 +-
 .../com/cloud/vpc/dao/MockNetworkDaoImpl.java |   22 +-
 .../cloudstack/backup/BackupManagerTest.java  |   40 +-
 .../KVMBackupExportServiceImplTest.java       |  467 ++++
 .../resource/NfsSecondaryStorageResource.java |    4 +-
 tools/apidoc/gen_toc.py                       |    4 +
 ui/src/components/view/InfoCard.vue           |   12 +-
 ui/src/components/view/SettingsTab.vue        |    3 +
 .../config/section/infra/managementServers.js |    4 +
 ui/src/utils/links.js                         |   72 +
 .../utils/server/ServerPropertiesUtil.java    |   11 +
 329 files changed, 34111 insertions(+), 352 deletions(-)
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/backup/CreateImageTransferCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/backup/DeleteVmCheckpointCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeBackupCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeImageTransferCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListImageTransfersCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListVmCheckpointsCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/command/admin/backup/StartBackupCmd.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/CheckpointResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/api/response/ImageTransferResponse.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/backup/ImageTransfer.java
 create mode 100644 api/src/main/java/org/apache/cloudstack/backup/KVMBackupExportService.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmdTest.java
 create mode 100644 api/src/test/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdminTest.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferAnswer.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferCommand.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/DeleteVmCheckpointCommand.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/FinalizeImageTransferCommand.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/StartBackupAnswer.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/StartBackupCommand.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/StartNBDServerAnswer.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/StartNBDServerCommand.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/StopBackupAnswer.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/StopBackupCommand.java
 create mode 100644 core/src/main/java/org/apache/cloudstack/backup/StopNBDServerCommand.java
 create mode 100644 engine/schema/src/main/java/org/apache/cloudstack/backup/ImageTransferVO.java
 create mode 100644 engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDao.java
 create mode 100644 engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDaoImpl.java
 create mode 100644 framework/cluster/src/main/java/com/cloud/cluster/ManagementServerHostDetailVO.java
 create mode 100644 framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDao.java
 create mode 100644 framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDaoImpl.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/ImageServerControlSocket.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopNBDServerCommandWrapper.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapperTest.java
 create mode 100644 plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapperTest.java
 create mode 100644 plugins/integrations/veeam-control-service/pom.xml
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/RouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServer.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlService.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServiceImpl.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServlet.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccess.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptor.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ApiRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ClustersRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DisksRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/HostsRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/JobsRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/NetworksRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/TagsRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VmsRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Api.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ApiSummary.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Backup.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/BaseDto.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Certificate.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Checkpoint.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cluster.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cpu.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DataCenter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Disk.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DiskAttachment.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElement.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElementSerializer.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Fault.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Host.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ImageTransfer.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ip.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Job.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Link.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Mac.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/NamedList.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Network.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Nic.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Os.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtil.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ProductInfo.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ref.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ReportedDevice.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ResourceAction.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Snapshot.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SpecialObjects.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Storage.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/StorageDomain.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SummaryCount.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SupportedVersions.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Tag.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Topology.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Version.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Vm.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VmAction.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VnicProfile.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/request/ListQuery.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandler.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/sso/SsoService.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/CloudConfigUtil.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/DataUtil.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/JwtUtil.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Mapper.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Negotiation.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/PathUtil.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/ResponseWriter.java
 create mode 100644 plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/module.properties
 create mode 100644 plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/spring-veeam-control-service-context.xml
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServiceImplTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServletTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptorTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ApiRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ClustersRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DisksRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/HostsRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/JobsRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/NetworksRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/RouteHandlerTestSupport.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/TagsRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VmsRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BackupTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BaseDtoTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/CertificateTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DiskTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DtoSerializationTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/FaultTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/HostTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ImageTransferTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/MacIpTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/NamedListTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtilTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ProductInfoApiTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SnapshotTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/StorageDomainTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SummaryCountTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/TopologyTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VersionTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VmTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VnicProfileReportedDeviceTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/request/ListQueryTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandlerTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/sso/SsoServiceTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/CloudConfigUtilTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/DataUtilTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/JwtUtilTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/MapperTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/NegotiationTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/PathUtilTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/ResponseWriterTest.java
 create mode 100644 plugins/integrations/veeam-control-service/src/test/resources/test-ovf.xml
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/__init__.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/__main__.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/backends/__init__.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/backends/base.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/backends/file.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/config.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/constants.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/handler.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/server.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/__init__.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_base.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_combinations.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_control_socket.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_file_backend.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_http11_lifecycle.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_backend.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_registry_idle.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_stress_io.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_transfer_idle_expiry.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/tests/test_util.py
 create mode 100644 scripts/vm/hypervisor/kvm/imageserver/util.py
 create mode 100644 server/src/main/java/org/apache/cloudstack/backup/KVMBackupExportServiceImpl.java
 create mode 100644 server/src/main/java/org/apache/cloudstack/backup/VmWorkWaitForBackupFinalize.java
 create mode 100644 server/src/test/java/com/cloud/api/query/dao/StoragePoolJoinDaoImplTest.java
 create mode 100644 server/src/test/java/org/apache/cloudstack/backup/KVMBackupExportServiceImplTest.java

diff --git a/agent/conf/agent.properties b/agent/conf/agent.properties
index ba4a3874664a..0a459d8d4fc5 100644
--- a/agent/conf/agent.properties
+++ b/agent/conf/agent.properties
@@ -78,6 +78,14 @@ zone=default
 # Generated with "uuidgen".
 local.storage.uuid=
 
+# Enable TLS for image server transfers. The keys are read from:
+# cert file = /etc/cloudstack/agent/cloud.crt
+# key file = /etc/cloudstack/agent/cloud.key
+image.server.tls.enabled=true
+
+# The Address for the network interface that the image server listens on. If not specified, it will listen on the Management network.
+#image.server.listen.address=
+
 # Location for KVM virtual router scripts.
 # The path defined in this property is relative to the directory "/usr/share/cloudstack-common/".
 domr.scripts.dir=scripts/network/domr/kvm
diff --git a/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java b/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
index e69a7efdc9c7..18a6b6df1006 100644
--- a/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
+++ b/agent/src/main/java/com/cloud/agent/properties/AgentProperties.java
@@ -123,6 +123,20 @@ public class AgentProperties{
      */
     public static final Property<String> LOCAL_STORAGE_PATH = new Property<>("local.storage.path", "/var/lib/libvirt/images/");
 
+    /**
+     * Enables TLS on the KVM image server transfer endpoint.<br>
+     * Data type: Boolean.<br>
+     * Default value: <code>true</code>
+     */
+    public static final Property<Boolean> IMAGE_SERVER_TLS_ENABLED = new Property<>("image.server.tls.enabled", true);
+
+    /**
+     * The IP address that the KVM image server listens on.<br>
+     * Data type: String.<br>
+     * Default value: <code>null</code>
+     */
+    public static final Property<String> IMAGE_SERVER_LISTEN_ADDRESS = new Property<>("image.server.listen.address", null, String.class);
+
     /**
      * Directory where Qemu sockets are placed.<br>
      * These sockets are for the Qemu Guest Agent and SSVM provisioning.<br>
diff --git a/api/src/main/java/com/cloud/storage/VolumeApiService.java b/api/src/main/java/com/cloud/storage/VolumeApiService.java
index 1a9bcc6ee98b..43ead8d287b9 100644
--- a/api/src/main/java/com/cloud/storage/VolumeApiService.java
+++ b/api/src/main/java/com/cloud/storage/VolumeApiService.java
@@ -22,6 +22,7 @@
 import java.util.List;
 import java.util.Map;
 
+import com.cloud.dc.DataCenter;
 import com.cloud.exception.ResourceAllocationException;
 import com.cloud.offering.DiskOffering;
 import com.cloud.user.Account;
@@ -70,6 +71,10 @@ public interface VolumeApiService {
      */
     Volume allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationException;
 
+    Volume allocVolume(long ownerId, Long zoneId, Long diskOfferingId, Long vmId, Long snapshotId, String name,
+           Long cmdSize, Boolean displayVolume, Long cmdMinIops, Long cmdMaxIops, String customId)
+            throws ResourceAllocationException;
+
     /**
      * Creates the volume based on the given criteria
      *
@@ -80,6 +85,8 @@ public interface VolumeApiService {
      */
     Volume createVolume(CreateVolumeCmd cmd);
 
+    Volume createVolume(long volumeId, Long vmId, Long snapshotId, Long storageId, Boolean display);
+
     /**
      * Resizes the volume based on the given criteria
      *
@@ -203,4 +210,6 @@ Volume updateVolume(long volumeId, String path, String state, Long storageId,
     Pair<String, String> checkAndRepairVolume(CheckAndRepairVolumeCmd cmd) throws ResourceAllocationException;
 
     Long getVolumePhysicalSize(Storage.ImageFormat format, String path, String chainInfo);
+
+    Long getCustomDiskOfferingIdForVolumeUpload(Account owner, DataCenter zone, boolean encryptEnabledOnly);
 }
diff --git a/api/src/main/java/com/cloud/user/AccountService.java b/api/src/main/java/com/cloud/user/AccountService.java
index 4145e2b89eb3..fc450e9179c5 100644
--- a/api/src/main/java/com/cloud/user/AccountService.java
+++ b/api/src/main/java/com/cloud/user/AccountService.java
@@ -88,10 +88,16 @@ User createUser(String userName, String password, String firstName, String lastN
 
     Account getActiveAccountById(long accountId);
 
+    Account getActiveAccountByUuid(String accountUuid);
+
     Account getAccount(long accountId);
 
+    Account getAccountByUuid(String accountUuid);
+
     User getActiveUser(long userId);
 
+    User getOneActiveUserForAccount(Account account);
+
     User getUserIncludingRemoved(long userId);
 
     boolean isRootAdmin(Long accountId);
diff --git a/api/src/main/java/com/cloud/vm/VmDetailConstants.java b/api/src/main/java/com/cloud/vm/VmDetailConstants.java
index 9e56bf4f17b2..33cc6da70812 100644
--- a/api/src/main/java/com/cloud/vm/VmDetailConstants.java
+++ b/api/src/main/java/com/cloud/vm/VmDetailConstants.java
@@ -130,4 +130,10 @@ public interface VmDetailConstants {
     String EXTERNAL_DETAIL_PREFIX = "External:";
     String CLOUDSTACK_VM_DETAILS = "cloudstack.vm.details";
     String CLOUDSTACK_VLAN = "cloudstack.vlan";
+
+    // KVM Checkpoints related
+    String ACTIVE_CHECKPOINT_ID = "active.checkpoint.id";
+    String ACTIVE_CHECKPOINT_CREATE_TIME = "active.checkpoint.create.time";
+    String LAST_CHECKPOINT_ID = "last.checkpoint.id";
+    String LAST_CHECKPOINT_CREATE_TIME = "last.checkpoint.create.time";
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index 694830ea2f36..ee10db031ba7 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -79,6 +79,7 @@ public class ApiConstants {
     public static final String BOOTABLE = "bootable";
     public static final String BIND_DN = "binddn";
     public static final String BIND_PASSWORD = "bindpass";
+    public static final String BLANK_INSTANCE = "blankinstance";
     public static final String BUS_ADDRESS = "busaddress";
     public static final String BYTES_READ_RATE = "bytesreadrate";
     public static final String BYTES_READ_RATE_MAX = "bytesreadratemax";
@@ -220,6 +221,7 @@ public class ApiConstants {
     public static final String DOMAIN_PATH = "domainpath";
     public static final String DOMAIN_ID = "domainid";
     public static final String DOMAIN__ID = "domainId";
+    public static final String DUMMY = "dummy";
     public static final String DURATION = "duration";
     public static final String ELIGIBLE = "eligible";
     public static final String EMAIL = "email";
@@ -263,6 +265,7 @@ public class ApiConstants {
     public static final String FOR_VIRTUAL_NETWORK = "forvirtualnetwork";
     public static final String FOR_SYSTEM_VMS = "forsystemvms";
     public static final String FOR_PROVIDER = "forprovider";
+    public static final String FROM_CHECKPOINT_ID = "fromcheckpointid";
     public static final String FULL_PATH = "fullpath";
     public static final String GATEWAY = "gateway";
     public static final String IP6_GATEWAY = "ip6gateway";
@@ -335,6 +338,7 @@ public class ApiConstants {
     public static final String IS_2FA_VERIFIED = "is2faverified";
 
     public static final String IS_2FA_MANDATED = "is2famandated";
+    public static final String IS_ACTIVE = "isactive";
     public static final String IS_ASYNC = "isasync";
     public static final String IP_AVAILABLE = "ipavailable";
     public static final String IP_LIMIT = "iplimit";
@@ -611,6 +615,7 @@ public class ApiConstants {
     public static final String TENANT_NAME = "tenantname";
     public static final String TOTAL = "total";
     public static final String TOTAL_SUBNETS = "totalsubnets";
+    public static final String TO_CHECKPOINT_ID = "tocheckpointid";
     public static final String TOTAL_QUOTA = "totalquota";
     public static final String TYPE = "type";
     public static final String TRUST_STORE = "truststore";
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiServerService.java b/api/src/main/java/org/apache/cloudstack/api/ApiServerService.java
index 18c96c371591..1ee41ac86c22 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiServerService.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiServerService.java
@@ -21,8 +21,11 @@
 
 import javax.servlet.http.HttpSession;
 
+import org.apache.cloudstack.context.CallContext;
+
 import com.cloud.domain.Domain;
 import com.cloud.exception.CloudAuthenticationException;
+import com.cloud.user.Account;
 import com.cloud.user.UserAccount;
 
 public interface ApiServerService {
@@ -52,4 +55,20 @@ public ResponseObject loginUser(HttpSession session, String username, String pas
     String getDomainId(Map<String, Object[]> params);
 
     boolean isPostRequestsAndTimestampsEnforced();
+
+    AsyncCmdResult processAsyncCmd(BaseAsyncCmd cmdObj, Map<String, String> params, CallContext ctx, Long callerUserId, Account caller) throws Exception;
+
+    class AsyncCmdResult {
+        public final Long objectId;
+        public final String objectUuid;
+        public final BaseAsyncCmd asyncCmd;
+        public final long jobId;
+
+        public AsyncCmdResult(Long objectId, String objectUuid, BaseAsyncCmd asyncCmd, long jobId) {
+            this.objectId = objectId;
+            this.objectUuid = objectUuid;
+            this.asyncCmd = asyncCmd;
+            this.jobId = jobId;
+        }
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCreateCustomIdCmd.java b/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCreateCustomIdCmd.java
index 30baa71d6d85..b9b13dcfd884 100644
--- a/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCreateCustomIdCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/BaseAsyncCreateCustomIdCmd.java
@@ -20,7 +20,7 @@ public abstract class BaseAsyncCreateCustomIdCmd extends BaseAsyncCreateCmd {
     @Parameter(name = ApiConstants.CUSTOM_ID,
                type = CommandType.STRING,
                description = "An optional field, in case you want to set a custom id to the resource. Allowed to Root Admins only")
-    private String customId;
+    protected String customId;
 
     public String getCustomId() {
         return customId;
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/CreateImageTransferCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/CreateImageTransferCmd.java
new file mode 100644
index 000000000000..c98bfb850529
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/CreateImageTransferCmd.java
@@ -0,0 +1,100 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.api.response.VolumeResponse;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+import com.cloud.utils.EnumUtils;
+
+@APICommand(name = "createImageTransfer",
+        description = "Create image transfer for a disk in backup. This API is intended for testing only and is disabled by default.",
+        responseObject = ImageTransferResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class CreateImageTransferCmd extends BaseCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.BACKUP_ID,
+            type = CommandType.UUID,
+            entityType = BackupResponse.class,
+            description = "ID of the backup")
+    private Long backupId;
+
+    @Parameter(name = ApiConstants.VOLUME_ID,
+            type = CommandType.UUID,
+            entityType = VolumeResponse.class,
+            required = true,
+            description = "ID of the disk/volume")
+    private Long volumeId;
+
+    @Parameter(name = ApiConstants.DIRECTION,
+            type = CommandType.STRING,
+            required = true,
+            description = "Direction of the transfer: upload, download")
+    private String direction;
+
+    @Parameter(name = ApiConstants.FORMAT,
+            type = CommandType.STRING,
+            description = "Format for the image transfer: raw/cow. 'raw' will create an NBD backend. 'cow' will use the File backend." +
+                    "For download, only the 'raw' format is supported. Default: raw")
+    private String format;
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    public Long getVolumeId() {
+        return volumeId;
+    }
+
+    public ImageTransfer.Direction getDirection() {
+        return ImageTransfer.Direction.valueOf(direction);
+    }
+
+    public ImageTransfer.Format getFormat() {
+        return EnumUtils.getEnum(ImageTransfer.Format.class, format);
+    }
+
+   @Override
+    public void execute() {
+        ImageTransferResponse response = kvmBackupExportService.createImageTransfer(this);
+        response.setObjectName(ImageTransfer.class.getSimpleName().toLowerCase());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/DeleteVmCheckpointCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/DeleteVmCheckpointCmd.java
new file mode 100644
index 000000000000..d0e17e86d427
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/DeleteVmCheckpointCmd.java
@@ -0,0 +1,85 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+@APICommand(name = "deleteVirtualMachineCheckpoint",
+        description = "Delete a VM checkpoint. This API is intended for testing only and is disabled by default.",
+        responseObject = SuccessResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class DeleteVmCheckpointCmd extends BaseCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID,
+            type = CommandType.UUID,
+            entityType = UserVmResponse.class,
+            required = true,
+            description = "ID of the VM")
+    private Long vmId;
+
+    @Parameter(name = "checkpointid",
+            type = CommandType.STRING,
+            required = true,
+            description = "Checkpoint ID")
+    private String checkpointId;
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    public String getCheckpointId() {
+        return checkpointId;
+    }
+
+    public void setVmId(Long vmId) {
+        this.vmId = vmId;
+    }
+
+    public void setCheckpointId(String checkpointId) {
+        this.checkpointId = checkpointId;
+    }
+
+    @Override
+    public void execute() {
+        boolean result = kvmBackupExportService.deleteVmCheckpoint(this);
+        SuccessResponse response = new SuccessResponse(getCommandName());
+        response.setSuccess(result);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeBackupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeBackupCmd.java
new file mode 100644
index 000000000000..45173f8668ee
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeBackupCmd.java
@@ -0,0 +1,103 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupManager;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+import com.cloud.event.EventTypes;
+
+@APICommand(name = "finalizeBackup",
+        description = "Finalize a VM backup session. This API is intended for testing only and is disabled by default.",
+        responseObject = BackupResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class FinalizeBackupCmd extends BaseAsyncCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Inject
+    private BackupManager backupManager;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID,
+            type = CommandType.UUID,
+            entityType = UserVmResponse.class,
+            required = true,
+            description = "ID of the VM")
+    private Long vmId;
+
+    @Parameter(name = ApiConstants.ID,
+            type = CommandType.UUID,
+            entityType = BackupResponse.class,
+            required = true,
+            description = "ID of the backup")
+    private Long backupId;
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    @Override
+    public void execute() {
+        Backup backup = kvmBackupExportService.finalizeBackup(this);
+
+        if (backup == null) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to create Backup");
+        }
+
+        BackupResponse response = backupManager.createBackupResponse(backup, null);
+
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_VM_BACKUP_CREATE;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return "Finalizing backup " + backupId;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeImageTransferCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeImageTransferCmd.java
new file mode 100644
index 000000000000..dfc43e233bf2
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/FinalizeImageTransferCmd.java
@@ -0,0 +1,69 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.api.response.SuccessResponse;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+@APICommand(name = "finalizeImageTransfer",
+        description = "Finalize an image transfer. This API is intended for testing only and is disabled by default.",
+        responseObject = SuccessResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class FinalizeImageTransferCmd extends BaseCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.ID,
+            type = CommandType.UUID,
+            entityType = ImageTransferResponse.class,
+            required = true,
+            description = "ID of the image transfer")
+    private Long imageTransferId;
+
+    public Long getImageTransferId() {
+        return imageTransferId;
+    }
+
+    @Override
+    public void execute() {
+        boolean result = kvmBackupExportService.finalizeImageTransfer(this);
+        SuccessResponse response = new SuccessResponse(getCommandName());
+        response.setSuccess(result);
+        response.setObjectName(ImageTransfer.class.getSimpleName().toLowerCase());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListImageTransfersCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListImageTransfersCmd.java
new file mode 100644
index 000000000000..d810d21ab5f8
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListImageTransfersCmd.java
@@ -0,0 +1,81 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import java.util.List;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseListCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+@APICommand(name = "listImageTransfers",
+        description = "List image transfers for a backup. This API is intended for testing only and is disabled by default.",
+        responseObject = ImageTransferResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class ListImageTransfersCmd extends BaseListCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.ID,
+            type = CommandType.UUID,
+            entityType = ImageTransferResponse.class,
+            description = "ID of the Image Transfer")
+    private Long id;
+
+    @Parameter(name = ApiConstants.BACKUP_ID,
+            type = CommandType.UUID,
+            entityType = BackupResponse.class,
+            description = "ID of the backup")
+    private Long backupId;
+
+    public Long getId() {
+        return id;
+    }
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    @Override
+    public void execute() {
+        List<ImageTransferResponse> responses = kvmBackupExportService.listImageTransfers(this);
+        ListResponse<ImageTransferResponse> response = new ListResponse<>();
+        response.setResponses(responses);
+        response.setObjectName(ImageTransfer.class.getSimpleName().toLowerCase());
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListVmCheckpointsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListVmCheckpointsCmd.java
new file mode 100644
index 000000000000..a61661e982de
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/ListVmCheckpointsCmd.java
@@ -0,0 +1,69 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import java.util.List;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseListCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.CheckpointResponse;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+
+@APICommand(name = "listVirtualMachineCheckpoints",
+        description = "List checkpoints for a VM. This API is intended for testing only and is disabled by default.",
+        responseObject = CheckpointResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+public class ListVmCheckpointsCmd extends BaseListCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID,
+            type = CommandType.UUID,
+            entityType = UserVmResponse.class,
+            required = true,
+            description = "ID of the VM")
+    private Long vmId;
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    @Override
+    public void execute() {
+        List<CheckpointResponse> responses = kvmBackupExportService.listVmCheckpoints(this);
+        ListResponse<CheckpointResponse> response = new ListResponse<>();
+        response.setResponses(responses);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return 0;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/StartBackupCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/StartBackupCmd.java
new file mode 100644
index 000000000000..1bf6d45db049
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/backup/StartBackupCmd.java
@@ -0,0 +1,120 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.command.admin.backup;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.BaseAsyncCreateCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
+import org.apache.cloudstack.api.command.admin.AdminCmd;
+import org.apache.cloudstack.api.response.BackupResponse;
+import org.apache.cloudstack.api.response.UserVmResponse;
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupManager;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.context.CallContext;
+
+import com.cloud.event.EventTypes;
+
+@APICommand(name = "startBackup",
+        description = "Start a VM backup session using pull mode backup-begin on the KVM host. This API is intended for testing only and is disabled by default.",
+        responseObject = BackupResponse.class,
+        since = "4.23.0",
+        authorized = {RoleType.Admin})
+    public class StartBackupCmd extends BaseAsyncCreateCmd implements AdminCmd {
+
+    @Inject
+    private KVMBackupExportService kvmBackupExportService;
+
+    @Inject
+    private BackupManager backupManager;
+
+    @Parameter(name = ApiConstants.VIRTUAL_MACHINE_ID,
+            type = CommandType.UUID,
+            entityType = UserVmResponse.class,
+            required = true,
+            description = "ID of the VM")
+    private Long vmId;
+
+    @Parameter(name = ApiConstants.NAME,
+            type = CommandType.STRING,
+            description = "the name of the backup")
+    private String name;
+
+    @Parameter(name = ApiConstants.DESCRIPTION,
+            type = CommandType.STRING,
+            description = "the description for the backup")
+    private String description;
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    @Override
+    public void execute() {
+        try {
+            Backup backup = kvmBackupExportService.startBackup(this);
+            BackupResponse response = backupManager.createBackupResponse(backup, null);
+
+            response.setResponseName(getCommandName());
+            setResponseObject(response);
+        } catch (Exception e) {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, e.getMessage());
+        }
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        return CallContext.current().getCallingAccount().getId();
+    }
+
+    @Override
+    public void create() {
+        Backup backup = kvmBackupExportService.createBackup(this);
+
+        if (backup != null) {
+            setEntityId(backup.getId());
+            setEntityUuid(backup.getUuid());
+        } else {
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, "Failed to create Backup");
+        }
+    }
+
+    @Override
+    public String getEventType() {
+        return EventTypes.EVENT_VM_BACKUP_CREATE;
+    }
+
+    @Override
+    public String getEventDescription() {
+        return "Starting backup for Instance " + vmId;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ListCfgsByCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ListCfgsByCmd.java
index f6f66415f533..055443934609 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ListCfgsByCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ListCfgsByCmd.java
@@ -19,23 +19,23 @@
 import java.util.ArrayList;
 import java.util.List;
 
-import org.apache.cloudstack.api.ApiErrorCode;
-import org.apache.cloudstack.api.ServerApiException;
-import org.apache.cloudstack.api.response.DomainResponse;
-import org.apache.commons.lang3.StringUtils;
-
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiErrorCode;
 import org.apache.cloudstack.api.BaseListCmd;
 import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.ClusterResponse;
 import org.apache.cloudstack.api.response.ConfigurationResponse;
+import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.response.ImageStoreResponse;
 import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.ManagementServerResponse;
 import org.apache.cloudstack.api.response.StoragePoolResponse;
 import org.apache.cloudstack.api.response.ZoneResponse;
 import org.apache.cloudstack.config.Configuration;
+import org.apache.commons.lang3.StringUtils;
 
 import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.utils.Pair;
@@ -94,6 +94,13 @@ public class ListCfgsByCmd extends BaseListCmd {
             description = "The ID of the Image Store to update the parameter value for corresponding image store")
     private Long imageStoreId;
 
+    @Parameter(name = ApiConstants.MANAGEMENT_SERVER_ID,
+            type = CommandType.UUID,
+            entityType = ManagementServerResponse.class,
+            description = "the ID of the Management Server to update the parameter value for corresponding management server",
+            since = "4.23.0")
+    private Long managementServerId;
+
     @Parameter(name = ApiConstants.GROUP, type = CommandType.STRING, description = "Lists configuration by group name (primarily used for UI)", since = "4.18.0")
     private String groupName;
 
@@ -139,6 +146,10 @@ public Long getImageStoreId() {
         return imageStoreId;
     }
 
+    public Long getManagementServerId() {
+        return managementServerId;
+    }
+
     public String getGroupName() {
         return groupName;
     }
@@ -200,6 +211,9 @@ private void setScope(ConfigurationResponse cfgResponse) {
         if (getImageStoreId() != null){
             cfgResponse.setScope("imagestore");
         }
+        if (getManagementServerId() != null){
+            cfgResponse.setScope("managementserver");
+        }
     }
 
     @Override
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ResetCfgCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ResetCfgCmd.java
index 2d511cff34db..3c3c36b29d7e 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ResetCfgCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/ResetCfgCmd.java
@@ -23,16 +23,16 @@
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ServerApiException;
-import org.apache.cloudstack.api.response.ImageStoreResponse;
-import org.apache.cloudstack.framework.config.ConfigKey;
-
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.ClusterResponse;
 import org.apache.cloudstack.api.response.ConfigurationResponse;
 import org.apache.cloudstack.api.response.DomainResponse;
+import org.apache.cloudstack.api.response.ImageStoreResponse;
+import org.apache.cloudstack.api.response.ManagementServerResponse;
 import org.apache.cloudstack.api.response.StoragePoolResponse;
 import org.apache.cloudstack.api.response.ZoneResponse;
 import org.apache.cloudstack.config.Configuration;
+import org.apache.cloudstack.framework.config.ConfigKey;
 
 import com.cloud.user.Account;
 import com.cloud.utils.Pair;
@@ -84,6 +84,13 @@ public class ResetCfgCmd extends BaseCmd {
             description = "The ID of the Image Store to reset the parameter value for corresponding image store")
     private Long imageStoreId;
 
+    @Parameter(name = ApiConstants.MANAGEMENT_SERVER_ID,
+            type = CommandType.UUID,
+            entityType = ManagementServerResponse.class,
+            description = "the ID of the Management Server to update the parameter value for corresponding management server",
+            since = "4.23.0")
+    private Long managementServerId;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -116,6 +123,10 @@ public Long getImageStoreId() {
         return imageStoreId;
     }
 
+    public Long getManagementServerId() {
+        return managementServerId;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -149,6 +160,9 @@ public void execute() {
             if (getImageStoreId() != null) {
                 response.setScope(ConfigKey.Scope.ImageStore.name());
             }
+            if (getManagementServerId() != null) {
+                response.setScope(ConfigKey.Scope.ManagementServer.name());
+            }
             response.setValue(cfg.second());
             this.setResponseObject(response);
         } else {
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/UpdateCfgCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/UpdateCfgCmd.java
index 97dee8f638af..9db9529dc8d8 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/config/UpdateCfgCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/config/UpdateCfgCmd.java
@@ -16,9 +16,7 @@
 // under the License.
 package org.apache.cloudstack.api.command.admin.config;
 
-import com.cloud.utils.crypt.DBEncryptionUtil;
 import org.apache.cloudstack.acl.RoleService;
-import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiArgValidator;
 import org.apache.cloudstack.api.ApiConstants;
@@ -29,13 +27,17 @@
 import org.apache.cloudstack.api.response.AccountResponse;
 import org.apache.cloudstack.api.response.ClusterResponse;
 import org.apache.cloudstack.api.response.ConfigurationResponse;
+import org.apache.cloudstack.api.response.DomainResponse;
 import org.apache.cloudstack.api.response.ImageStoreResponse;
+import org.apache.cloudstack.api.response.ManagementServerResponse;
 import org.apache.cloudstack.api.response.StoragePoolResponse;
 import org.apache.cloudstack.api.response.ZoneResponse;
 import org.apache.cloudstack.config.Configuration;
+import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.commons.lang3.StringUtils;
 
 import com.cloud.user.Account;
+import com.cloud.utils.crypt.DBEncryptionUtil;
 
 @APICommand(name = "updateConfiguration", description = "Updates a configuration.", responseObject = ConfigurationResponse.class,
         requestHasSensitiveInfo = false, responseHasSensitiveInfo = false)
@@ -88,6 +90,13 @@ public class UpdateCfgCmd extends BaseCmd {
             validations = ApiArgValidator.PositiveNumber)
     private Long imageStoreId;
 
+    @Parameter(name = ApiConstants.MANAGEMENT_SERVER_ID,
+            type = CommandType.UUID,
+            entityType = ManagementServerResponse.class,
+            description = "the ID of the Management Server to update the parameter value for corresponding management server",
+            since = "4.23.0")
+    private Long managementServerId;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -112,7 +121,7 @@ public Long getClusterId() {
         return clusterId;
     }
 
-    public Long getStoragepoolId() {
+    public Long getStoragePoolId() {
         return storagePoolId;
     }
 
@@ -128,6 +137,10 @@ public Long getImageStoreId() {
         return imageStoreId;
     }
 
+    public Long getManagementServerId() {
+        return managementServerId;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
@@ -182,7 +195,7 @@ public ConfigurationResponse setResponseScopes(ConfigurationResponse response) {
         if (getClusterId() != null) {
             response.setScope("cluster");
         }
-        if (getStoragepoolId() != null) {
+        if (getStoragePoolId() != null) {
             response.setScope("storagepool");
         }
         if (getAccountId() != null) {
@@ -191,6 +204,9 @@ public ConfigurationResponse setResponseScopes(ConfigurationResponse response) {
         if (getDomainId() != null) {
             response.setScope("domain");
         }
+        if (getManagementServerId() != null) {
+            response.setScope(ConfigKey.Scope.ManagementServer.name().toLowerCase());
+        }
         return response;
     }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmd.java
index e11d20d06466..50ff97ac676f 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmd.java
@@ -85,6 +85,9 @@ public class AssignVMCmd extends BaseCmd  {
                    "In case no security groups are provided the Instance is part of the default security group.")
     private List<Long> securityGroupIdList;
 
+    // Internal flag to allow assignment without adding a network
+    private boolean  skipNetwork = false;
+
     /////////////////////////////////////////////////////
     /////////////////// Accessors ///////////////////////
     /////////////////////////////////////////////////////
@@ -113,6 +116,34 @@ public List<Long> getSecurityGroupIdList() {
         return securityGroupIdList;
     }
 
+    public boolean isSkipNetwork() {
+        return skipNetwork;
+    }
+
+    /////////////////////////////////////////////////////
+    /////////////////// Setters /////////////////////////
+    /////////////////////////////////////////////////////
+
+    public void setVirtualMachineId(Long virtualMachineId) {
+        this.virtualMachineId = virtualMachineId;
+    }
+
+    public void setAccountName(String accountName) {
+        this.accountName = accountName;
+    }
+
+    public void setDomainId(Long domainId) {
+        this.domainId = domainId;
+    }
+
+    public void setProjectId(Long projectId) {
+        this.projectId = projectId;
+    }
+
+    public void setSkipNetwork(boolean skipNetwork) {
+        this.skipNetwork = skipNetwork;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdmin.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdmin.java
index e64c8b3f46c6..b7c3b2ba41a6 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdmin.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdmin.java
@@ -41,6 +41,19 @@ public class DeployVMCmdByAdmin extends DeployVMCmd implements AdminCmd {
     @Parameter(name = ApiConstants.CLUSTER_ID, type = CommandType.UUID, entityType = ClusterResponse.class, description = "Destination Cluster ID to deploy the Instance to - parameter available for root admin only", since = "4.13")
     private Long clusterId;
 
+    @Parameter(name = ApiConstants.BLANK_INSTANCE,
+            type = CommandType.BOOLEAN,
+            description = "Whether to create a blank instance without storage and network",
+            since = "4.23.0")
+    private Boolean blankInstance;
+
+    // Internal flag to allow deploying instance with a given type
+    private String instanceType;
+
+    /////////////////////////////////////////////////////
+    ////////////////// Getters //////////////////////////
+    /////////////////////////////////////////////////////
+
     public Long getPodId() {
         return podId;
     }
@@ -48,4 +61,37 @@ public Long getPodId() {
     public Long getClusterId() {
         return clusterId;
     }
+
+    @Override
+    public boolean isBlankInstance() {
+        return Boolean.TRUE.equals(blankInstance);
+    }
+
+    @Override
+    public String getInstanceType() {
+        if (!isBlankInstance()) {
+            return null;
+        }
+        return instanceType;
+    }
+
+    /////////////////////////////////////////////////////
+    ////////////////// Setters //////////////////////////
+    /////////////////////////////////////////////////////
+
+    public void setClusterId(Long clusterId) {
+        this.clusterId = clusterId;
+    }
+
+    public void setBlankInstance(boolean blankInstance) {
+        this.blankInstance = blankInstance;
+    }
+
+    public void setInstanceType(String instanceType) {
+        this.instanceType = instanceType;
+    }
+
+    public void setCustomId(String customId) {
+        this.customId = customId;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DestroyVMCmdByAdmin.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DestroyVMCmdByAdmin.java
index 93d4b610b900..cbe6494d4004 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DestroyVMCmdByAdmin.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/vm/DestroyVMCmdByAdmin.java
@@ -17,6 +17,8 @@
 package org.apache.cloudstack.api.command.admin.vm;
 
 import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.Parameter;
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
 import org.apache.cloudstack.api.command.admin.AdminCmd;
 import org.apache.cloudstack.api.command.user.vm.DestroyVMCmd;
@@ -27,4 +29,20 @@
 @APICommand(name = "destroyVirtualMachine", description = "Destroys  an Instance. Once destroyed, only the administrator can recover it.", responseObject = UserVmResponse.class, responseView = ResponseView.Full, entityType = {VirtualMachine.class},
         requestHasSensitiveInfo = false,
         responseHasSensitiveInfo = true)
-public class DestroyVMCmdByAdmin extends DestroyVMCmd implements AdminCmd {}
+public class DestroyVMCmdByAdmin extends DestroyVMCmd implements AdminCmd {
+
+    @Parameter( name = ApiConstants.FORCED,
+            type = CommandType.BOOLEAN,
+            description = "Force destroy the Instance",
+            since = "4.23.0")
+    Boolean forced;
+
+    @Override
+    public boolean isForced() {
+        return Boolean.TRUE.equals(forced);
+    }
+
+    public void setForced(Boolean forced) {
+        this.forced = forced;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java
index 5c5c8776bce3..cd6baaf827bb 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/offering/ListServiceOfferingsCmd.java
@@ -193,6 +193,22 @@ public Boolean getGpuEnabled() {
         return gpuEnabled;
     }
 
+    public void setZoneId(Long zoneId) {
+        this.zoneId = zoneId;
+    }
+
+    public void setCpuNumber(Integer cpuNumber) {
+        this.cpuNumber = cpuNumber;
+    }
+
+    public void setMemory(Integer memory) {
+        this.memory = memory;
+    }
+
+    public void setEncryptRoot(Boolean encryptRoot) {
+        this.encryptRoot = encryptRoot;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddNicToVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddNicToVMCmd.java
index 6347c38811e8..f6ef955956f6 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddNicToVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/AddNicToVMCmd.java
@@ -100,6 +100,26 @@ public String getMacAddress() {
         return NetUtils.standardizeMacAddress(macaddr);
     }
 
+    public void setVmId(Long vmId) {
+        this.vmId = vmId;
+    }
+
+    public void setNetworkId(Long netId) {
+        this.netId = netId;
+    }
+
+    public void setIpaddr(String ipaddr) {
+        this.ipaddr = ipaddr;
+    }
+
+    public void setMacAddress(String macaddr) {
+        this.macaddr = macaddr;
+    }
+
+    public void setDhcpOptions(Map dhcpOptions) {
+        this.dhcpOptions = dhcpOptions;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java
index 8c29d7338b85..68b0821ba44d 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/BaseDeployVMCmd.java
@@ -61,10 +61,10 @@
 import com.cloud.network.Network.IpAddresses;
 import com.cloud.offering.DiskOffering;
 import com.cloud.template.VirtualMachineTemplate;
+import com.cloud.utils.net.Dhcp;
 import com.cloud.utils.net.NetUtils;
 import com.cloud.vm.VmDetailConstants;
 import com.cloud.vm.VmDiskInfo;
-import com.cloud.utils.net.Dhcp;
 
 public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd implements SecurityGroupAction, UserCmd {
 
@@ -75,13 +75,13 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     /////////////////////////////////////////////////////
 
     @Parameter(name = ApiConstants.ZONE_ID, type = CommandType.UUID, entityType = ZoneResponse.class, required = true, description = "availability zone for the virtual machine")
-    private Long zoneId;
+    protected Long zoneId;
 
     @Parameter(name = ApiConstants.NAME, type = CommandType.STRING, description = "host name for the virtual machine", validations = {ApiArgValidator.RFCComplianceDomainName})
-    private String name;
+    protected String name;
 
     @Parameter(name = ApiConstants.DISPLAY_NAME, type = CommandType.STRING, description = "an optional user generated name for the virtual machine")
-    private String displayName;
+    protected String displayName;
 
     @Parameter(name=ApiConstants.PASSWORD, type=CommandType.STRING, description="The password of the virtual machine. If null, a random password will be generated for the VM.",
             since="4.19.0.0")
@@ -89,21 +89,21 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
 
     //Owner information
     @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING, description = "an optional account for the virtual machine. Must be used with domainId.")
-    private String accountName;
+    protected String accountName;
 
     @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class, description = "an optional domainId for the virtual machine. If the account parameter is used, domainId must also be used. If account is NOT provided then virtual machine will be assigned to the caller account and domain.")
-    private Long domainId;
+    protected Long domainId;
 
     //Network information
     //@ACL(accessType = AccessType.UseEntry)
     @Parameter(name = ApiConstants.NETWORK_IDS, type = CommandType.LIST, collectionType = CommandType.UUID, entityType = NetworkResponse.class, description = "list of network ids used by virtual machine. Can't be specified with ipToNetworkList parameter")
-    private List<Long> networkIds;
+    protected List<Long> networkIds;
 
     @Parameter(name = ApiConstants.BOOT_TYPE, type = CommandType.STRING, required = false, description = "Guest VM Boot option either custom[UEFI] or default boot [BIOS]. Not applicable with VMware if the template is marked as deploy-as-is, as we honour what is defined in the template.", since = "4.14.0.0")
-    private String bootType;
+    protected String bootType;
 
     @Parameter(name = ApiConstants.BOOT_MODE, type = CommandType.STRING, required = false, description = "Boot Mode [Legacy] or [Secure] Applicable when Boot Type Selected is UEFI, otherwise Legacy only for BIOS. Not applicable with VMware if the template is marked as deploy-as-is, as we honour what is defined in the template.", since = "4.14.0.0")
-    private String bootMode;
+    protected String bootMode;
 
     @Parameter(name = ApiConstants.BOOT_INTO_SETUP, type = CommandType.BOOLEAN, required = false, description = "Boot into hardware setup or not (ignored if startVm = false, only valid for vmware)", since = "4.15.0.0")
     private Boolean bootIntoSetup;
@@ -138,7 +138,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
 
     @Parameter(name = ApiConstants.HYPERVISOR, type = CommandType.STRING, description = "the hypervisor on which to deploy the virtual machine. "
             + "The parameter is required and respected only when hypervisor info is not set on the ISO/Template passed to the call")
-    private String hypervisor;
+    protected String hypervisor;
 
     @Parameter(name = ApiConstants.USER_DATA, type = CommandType.STRING,
             description = "an optional binary data that can be sent to the virtual machine upon a successful deployment. " +
@@ -147,10 +147,10 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
                     "Using HTTP POST (via POST body), you can send up to 1MB of data after base64 encoding. " +
                     "You also need to change vm.userdata.max.length value",
             length = 1048576)
-    private String userData;
+    protected String userData;
 
     @Parameter(name = ApiConstants.USER_DATA_ID, type = CommandType.UUID, entityType = UserDataResponse.class, description = "the ID of the Userdata", since = "4.18")
-    private Long userdataId;
+    protected Long userdataId;
 
     @Parameter(name = ApiConstants.USER_DATA_DETAILS, type = CommandType.MAP, description = "used to specify the parameters values for the variables in userdata.", since = "4.18")
     private Map userdataDetails;
@@ -160,7 +160,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     private String sshKeyPairName;
 
     @Parameter(name = ApiConstants.SSH_KEYPAIRS, type = CommandType.LIST, collectionType = CommandType.STRING, since="4.17", description = "names of the ssh key pairs used to login to the virtual machine")
-    private List<String> sshKeyPairNames;
+    protected List<String> sshKeyPairNames;
 
     @Parameter(name = ApiConstants.HOST_ID, type = CommandType.UUID, entityType = HostResponse.class, description = "destination Host ID to deploy the VM to - parameter available for root admin only")
     private Long hostId;
@@ -168,7 +168,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     @ACL
     @Parameter(name = ApiConstants.SECURITY_GROUP_IDS, type = CommandType.LIST, collectionType = CommandType.UUID, entityType = SecurityGroupResponse.class, description = "comma separated list of security groups id that going to be applied to the virtual machine. "
             + "Should be passed only when vm is created from a zone with Basic Network support." + " Mutually exclusive with securitygroupnames parameter")
-    private List<Long> securityGroupIdList;
+    protected List<Long> securityGroupIdList;
 
     @ACL
     @Parameter(name = ApiConstants.SECURITY_GROUP_NAMES, type = CommandType.LIST, collectionType = CommandType.STRING, entityType = SecurityGroupResponse.class, description = "comma separated list of security groups names that going to be applied to the virtual machine."
@@ -189,10 +189,10 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     private String macAddress;
 
     @Parameter(name = ApiConstants.KEYBOARD, type = CommandType.STRING, description = "an optional keyboard device type for the virtual machine. valid value can be one of de,de-ch,es,es-latam,fi,fr,fr-be,fr-ch,is,it,jp,nl-be,no,pt,uk,us")
-    private String keyboard;
+    protected String keyboard;
 
     @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class, description = "Deploy vm for the project")
-    private Long projectId;
+    protected Long projectId;
 
     @Parameter(name = ApiConstants.START_VM, type = CommandType.BOOLEAN, description = "true if start vm after creating; defaulted to true if not specified")
     private Boolean startVm;
@@ -200,7 +200,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     @ACL
     @Parameter(name = ApiConstants.AFFINITY_GROUP_IDS, type = CommandType.LIST, collectionType = CommandType.UUID, entityType = AffinityGroupResponse.class, description = "comma separated list of affinity groups id that are going to be applied to the virtual machine."
             + " Mutually exclusive with affinitygroupnames parameter")
-    private List<Long> affinityGroupIdList;
+    protected List<Long> affinityGroupIdList;
 
     @ACL
     @Parameter(name = ApiConstants.AFFINITY_GROUP_NAMES, type = CommandType.LIST, collectionType = CommandType.STRING, entityType = AffinityGroupResponse.class, description = "comma separated list of affinity groups names that are going to be applied to the virtual machine."
@@ -208,10 +208,10 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     private List<String> affinityGroupNameList;
 
     @Parameter(name = ApiConstants.DISPLAY_VM, type = CommandType.BOOLEAN, since = "4.2", description = "an optional field, whether to the display the vm to the end user or not.", authorized = {RoleType.Admin})
-    private Boolean displayVm;
+    protected Boolean displayVm;
 
     @Parameter(name = ApiConstants.DETAILS, type = CommandType.MAP, since = "4.3", description = "used to specify the custom parameters. 'extraconfig' is not allowed to be passed in details")
-    private Map details;
+    protected Map details;
 
     @Parameter(name = ApiConstants.DEPLOYMENT_PLANNER, type = CommandType.STRING, description = "Deployment planner to use for vm allocation. Available to ROOT admin only", since = "4.4", authorized = { RoleType.Admin })
     private String deploymentPlanner;
@@ -225,7 +225,7 @@ public abstract class BaseDeployVMCmd extends BaseAsyncCreateCustomIdCmd impleme
     private Map dataDiskTemplateToDiskOfferingList;
 
     @Parameter(name = ApiConstants.EXTRA_CONFIG, type = CommandType.STRING, since = "4.12", description = "an optional URL encoded string that can be passed to the virtual machine upon successful deployment", length = 5120)
-    private String extraConfig;
+    protected String extraConfig;
 
     @Parameter(name = ApiConstants.COPY_IMAGE_TAGS, type = CommandType.BOOLEAN, since = "4.13", description = "if true the image tags (if any) will be copied to the VM, default value is false")
     private Boolean copyImageTags;
@@ -798,6 +798,11 @@ public IoDriverPolicy getIoDriverPolicy() {
         }
         return null;
     }
+
+    public String getInstanceType() {
+        return null;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java
index 050592b97a3b..0a943fab118d 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmd.java
@@ -16,10 +16,11 @@
 // under the License.
 package org.apache.cloudstack.api.command.user.vm;
 
+import java.util.List;
+import java.util.Map;
 import java.util.Objects;
 import java.util.stream.Stream;
 
-import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
@@ -40,6 +41,7 @@
 import com.cloud.exception.ResourceAllocationException;
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.uservm.UserVm;
+import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.vm.VirtualMachine;
 
 @APICommand(name = "deployVirtualMachine", description = "Creates and automatically starts an Instance based on a service offering, disk offering, and Template.", responseObject = UserVmResponse.class, responseView = ResponseView.Restricted, entityType = {VirtualMachine.class},
@@ -88,6 +90,111 @@ public boolean isVolumeOrSnapshotProvided() {
         return volumeId != null || snapshotId != null;
     }
 
+    public boolean isBlankInstance() {
+        return false;
+    }
+
+
+
+    /////////////////////////////////////////////////////
+    ////////////////// Setters //////////////////////////
+    /////////////////////////////////////////////////////
+    public void setZoneId(Long zoneId) {
+        this.zoneId = zoneId;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public void setDisplayName(String displayName) {
+        this.displayName = displayName;
+    }
+
+    public void setAccountName(String accountName) {
+        this.accountName = accountName;
+    }
+
+    public void setDomainId(Long domainId) {
+        this.domainId = domainId;
+    }
+
+    public void setNetworkIds(List<Long> networkIds) {
+        this.networkIds = networkIds;
+    }
+
+    public void setBootType(String bootType) {
+        this.bootType = bootType;
+    }
+
+    public void setBootMode(String bootMode) {
+        this.bootMode = bootMode;
+    }
+
+    public void setHypervisor(String hypervisor) {
+        this.hypervisor = hypervisor;
+    }
+
+    public void setUserData(String userData) {
+        this.userData = userData;
+    }
+
+    public void setKeyboard(String keyboard) {
+        this.keyboard = keyboard;
+    }
+
+    public void setProjectId(Long projectId) {
+        this.projectId = projectId;
+    }
+
+    public void setDisplayVm(Boolean displayVm) {
+        this.displayVm = displayVm;
+    }
+
+    public void setUserDataId(Long userDataId) {
+        this.userdataId = userDataId;
+    }
+
+    public void setAffinityGroupIds(List<Long> ids) {
+        this.affinityGroupIdList = ids;
+    }
+
+    public void setDetails(Map details) {
+        this.details = details;
+    }
+
+    public void setExtraConfig(String extraConfig) {
+        this.extraConfig = extraConfig;
+    }
+
+    public void setDynamicScalingEnabled(Boolean dynamicScalingEnabled) {
+        this.dynamicScalingEnabled = dynamicScalingEnabled;
+    }
+
+    public void setServiceOfferingId(Long serviceOfferingId) {
+        this.serviceOfferingId = serviceOfferingId;
+    }
+
+    public void setTemplateId(Long templateId) {
+        this.templateId = templateId;
+    }
+
+    public void setVolumeId(Long volumeId) {
+        this.volumeId = volumeId;
+    }
+
+    public void setSnapshotId(Long snapshotId) {
+        this.snapshotId = snapshotId;
+    }
+
+    public void setSshKeyPairNames(List<String> sshKeyPairNames) {
+        this.sshKeyPairNames = sshKeyPairNames;
+    }
+
+    public void setSecurityGroupList(List<Long> securityGroupIdList) {
+        this.securityGroupIdList = securityGroupIdList;
+    }
+
     @Override
     public void execute() {
         UserVm result;
@@ -132,7 +239,7 @@ public void execute() {
 
     @Override
     public void create() throws ResourceAllocationException {
-        if (Stream.of(templateId, snapshotId, volumeId).filter(Objects::nonNull).count() != 1) {
+        if (!isBlankInstance() && Stream.of(templateId, snapshotId, volumeId).filter(Objects::nonNull).count() != 1) {
             throw new CloudRuntimeException("Please provide only one of the following parameters - template ID, volume ID or snapshot ID");
         }
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java
index 9e2f2bcb72ce..aec0688f1779 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/DestroyVMCmd.java
@@ -90,6 +90,10 @@ public List<Long> getVolumeIds() {
         return volumeIds;
     }
 
+    public boolean isForced() {
+        return false;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
index e3ad0502f454..a5f06e6ecbb3 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/vm/UpdateVMCmd.java
@@ -288,6 +288,14 @@ public boolean isCleanupExtraConfig() {
         return Boolean.TRUE.equals(cleanupExtraConfig);
     }
 
+    public void setId(Long id) {
+        this.id = id;
+    }
+
+    public void setSecurityGroupIdList(List<Long> securityGroupIdList) {
+        this.securityGroupIdList = securityGroupIdList;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/AssignVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/AssignVolumeCmd.java
index f39853512281..f50abaf73c96 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/AssignVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/AssignVolumeCmd.java
@@ -70,6 +70,21 @@ public Long getProjectid() {
         return projectid;
     }
 
+    /////////////////////////////////////////////////////
+    /////////////////// Setter///////////////////////////
+    /////////////////////////////////////////////////////
+    public void setVolumeId(Long volumeId) {
+        this.volumeId = volumeId;
+    }
+
+    public void setAccountId(Long accountId) {
+        this.accountId = accountId;
+    }
+
+    public void setProjectId(Long projectid) {
+        this.projectid = projectid;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java
index 78de05648486..ec7a626fa156 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/CreateVolumeCmd.java
@@ -114,7 +114,8 @@ public class CreateVolumeCmd extends BaseAsyncCreateCustomIdCmd implements UserC
             type = CommandType.UUID,
             entityType = StoragePoolResponse.class,
             description = "Storage pool ID to create the volume in. Cannot be used with the snapshotid parameter.",
-            authorized = {RoleType.Admin})
+            authorized = {RoleType.Admin},
+            since = "4.22.1")
     private Long storageId;
 
     /////////////////////////////////////////////////////
@@ -150,6 +151,10 @@ public Long getMaxIops() {
     }
 
     public Long getSnapshotId() {
+        if (storageId != null && snapshotId != null) {
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    "Snapshot ID cannot be specified with the Storage ID.");
+        }
         return snapshotId;
     }
 
@@ -163,7 +168,8 @@ private Long getProjectId() {
 
     public Long getStorageId() {
         if (snapshotId != null && storageId != null) {
-            throw new IllegalArgumentException("StorageId parameter cannot be specified with the SnapshotId parameter.");
+            throw new ServerApiException(ApiErrorCode.PARAM_ERROR,
+                    "Storage ID cannot be specified with the Snapshot ID.");
         }
         return storageId;
     }
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DetachVolumeCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DetachVolumeCmd.java
index 66a558abf982..f6e811da6055 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DetachVolumeCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/user/volume/DetachVolumeCmd.java
@@ -77,6 +77,10 @@ public Long getVirtualMachineId() {
         return virtualMachineId;
     }
 
+    public void setId(Long id) {
+        this.id = id;
+    }
+
     /////////////////////////////////////////////////////
     /////////////// API Implementation///////////////////
     /////////////////////////////////////////////////////
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java
index b855bfe40b8d..51fcaa9836e9 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/BackupResponse.java
@@ -127,6 +127,18 @@ public class BackupResponse extends BaseResponse {
     @Param(description = "Indicates whether the VM from which the backup was taken is expunged or not", since = "4.22.0")
     private Boolean isVmExpunged;
 
+    @SerializedName(ApiConstants.FROM_CHECKPOINT_ID)
+    @Param(description = "Previous active checkpoint ID for incremental backups", since = "4.23.0")
+    private String fromCheckpointId;
+
+    @SerializedName(ApiConstants.TO_CHECKPOINT_ID)
+    @Param(description = "Next checkpoint ID for incremental backups", since = "4.23.0")
+    private String toCheckpointId;
+
+    @SerializedName(ApiConstants.HOST_ID)
+    @Param(description = "Host ID where the backup is running", since = "4.23.0")
+    private String hostId;
+
     public String getId() {
         return id;
     }
@@ -314,4 +326,28 @@ public void setVmOfferingRemoved(Boolean vmOfferingRemoved) {
     public void setVmExpunged(Boolean isVmExpunged) {
         this.isVmExpunged = isVmExpunged;
     }
+
+    public void setFromCheckpointId(String fromCheckpointId) {
+        this.fromCheckpointId = fromCheckpointId;
+    }
+
+    public String getFromCheckpointId() {
+        return this.fromCheckpointId;
+    }
+
+    public void setToCheckpointId(String toCheckpointId) {
+        this.toCheckpointId = toCheckpointId;
+    }
+
+    public String getToCheckpointId() {
+        return this.toCheckpointId;
+    }
+
+    public void setHostId(String hostId) {
+        this.hostId = hostId;
+    }
+
+    public String getHostId() {
+        return this.hostId;
+    }
 }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/CheckpointResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/CheckpointResponse.java
new file mode 100644
index 000000000000..2bec7711064f
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/CheckpointResponse.java
@@ -0,0 +1,53 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.response;
+
+import java.util.Date;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+public class CheckpointResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "the checkpoint ID")
+    private String id;
+
+    @SerializedName(ApiConstants.CREATED)
+    @Param(description = "the checkpoint creation time")
+    private Date created;
+
+    @SerializedName(ApiConstants.IS_ACTIVE)
+    @Param(description = "whether this is the active checkpoint")
+    private Boolean isActive;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setCreated(Date created) {
+        this.created = created;
+    }
+
+    public void setIsActive(Boolean isActive) {
+        this.isActive = isActive;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/ImageTransferResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/ImageTransferResponse.java
new file mode 100644
index 000000000000..15576e8f1012
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/api/response/ImageTransferResponse.java
@@ -0,0 +1,104 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.api.response;
+
+import java.util.Date;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+import org.apache.cloudstack.api.EntityReference;
+import org.apache.cloudstack.backup.ImageTransfer;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+@EntityReference(value = ImageTransfer.class)
+public class ImageTransferResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.ID)
+    @Param(description = "the ID of the image transfer")
+    private String id;
+
+    @SerializedName("backupid")
+    @Param(description = "the backup ID")
+    private String backupId;
+
+    @SerializedName("vmid")
+    @Param(description = "the VM ID")
+    private String vmId;
+
+    @SerializedName(ApiConstants.VOLUME_ID)
+    @Param(description = "the disk/volume ID")
+    private String diskId;
+
+    @SerializedName("devicename")
+    @Param(description = "the device name (vda, vdb, etc)")
+    private String deviceName;
+
+    @SerializedName("transferurl")
+    @Param(description = "the transfer URL")
+    private String transferUrl;
+
+    @SerializedName("phase")
+    @Param(description = "the transfer phase")
+    private String phase;
+
+    @SerializedName("direction")
+    @Param(description = "the image transfer direction: upload / download")
+    private String direction;
+
+    @SerializedName(ApiConstants.CREATED)
+    @Param(description = "the date created")
+    private Date created;
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public void setBackupId(String backupId) {
+        this.backupId = backupId;
+    }
+
+    public void setVmId(String vmId) {
+        this.vmId = vmId;
+    }
+
+    public void setDiskId(String diskId) {
+        this.diskId = diskId;
+    }
+
+    public void setDeviceName(String deviceName) {
+        this.deviceName = deviceName;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+    public void setPhase(String phase) {
+        this.phase = phase;
+    }
+
+    public void setDirection(String direction) {
+        this.direction = direction;
+    }
+
+    public void setCreated(Date created) {
+        this.created = created;
+    }
+}
diff --git a/api/src/main/java/org/apache/cloudstack/backup/Backup.java b/api/src/main/java/org/apache/cloudstack/backup/Backup.java
index 951af9180e7f..2d68f18b953f 100644
--- a/api/src/main/java/org/apache/cloudstack/backup/Backup.java
+++ b/api/src/main/java/org/apache/cloudstack/backup/Backup.java
@@ -30,8 +30,16 @@
 
 public interface Backup extends ControlledEntity, InternalIdentity, Identity {
 
+    String getFromCheckpointId();
+
+    String getToCheckpointId();
+
+    Long getCheckpointCreateTime();
+
+    Long getHostId();
+
     enum Status {
-        Allocated, Queued, BackingUp, BackedUp, Error, Failed, Restoring, Removed, Expunged
+        Allocated, Queued, BackingUp, ReadyForImageTransfer, FinalizingImageTransfer, BackedUp, Error, Failed, Restoring, Removed, Expunged
     }
 
     class Metric {
diff --git a/api/src/main/java/org/apache/cloudstack/backup/ImageTransfer.java b/api/src/main/java/org/apache/cloudstack/backup/ImageTransfer.java
new file mode 100644
index 000000000000..e1153be3ae02
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/backup/ImageTransfer.java
@@ -0,0 +1,61 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.backup;
+
+import org.apache.cloudstack.acl.ControlledEntity;
+import org.apache.cloudstack.api.InternalIdentity;
+
+public interface ImageTransfer extends ControlledEntity, InternalIdentity {
+    long getDataCenterId();
+
+    public enum Direction {
+        upload, download
+    }
+
+    public enum Format {
+        raw,
+        cow
+    }
+
+    public enum Backend {
+        nbd,
+        file
+    }
+
+    public enum Phase {
+        initializing, transferring, finished, failed
+    }
+
+    String getUuid();
+
+    Long getBackupId();
+
+    long getVolumeId();
+
+    long getHostId();
+
+    String getTransferUrl();
+
+    Phase getPhase();
+
+    Direction getDirection();
+
+    Backend getBackend();
+
+    String getSignedTicketId();
+}
diff --git a/api/src/main/java/org/apache/cloudstack/backup/KVMBackupExportService.java b/api/src/main/java/org/apache/cloudstack/backup/KVMBackupExportService.java
new file mode 100644
index 000000000000..e1affb311ec6
--- /dev/null
+++ b/api/src/main/java/org/apache/cloudstack/backup/KVMBackupExportService.java
@@ -0,0 +1,106 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import java.util.List;
+
+import org.apache.cloudstack.api.command.admin.backup.CreateImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.DeleteVmCheckpointCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeBackupCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListImageTransfersCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListVmCheckpointsCmd;
+import org.apache.cloudstack.api.command.admin.backup.StartBackupCmd;
+import org.apache.cloudstack.api.response.CheckpointResponse;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+
+import com.cloud.utils.component.PluggableService;
+
+/**
+ * Service for Creating Backups and ImageTransfer sessions which will be consumed by an external orchestrator.
+ */
+public interface KVMBackupExportService extends Configurable, PluggableService {
+
+    ConfigKey<Integer> ImageTransferIdleTimeoutSeconds = new ConfigKey<>("Advanced", Integer.class,
+            "image.transfer.idle.timeout.seconds",
+            "600",
+            "Seconds since last completed HTTP request to an image transfer before the image server unregisters it (idle timeout).",
+            true, ConfigKey.Scope.Zone);
+
+    ConfigKey<Boolean> ExposeKVMBackupExportServiceApis = new ConfigKey<>("Advanced", Boolean.class,
+            "expose.kvm.backup.export.service.apis",
+            "false",
+            "Enable to expose APIs for testing the KVM Backup Export Service.",
+            false, ConfigKey.Scope.Global);
+    /**
+     * Creates a backup session for a VM
+     */
+    Backup createBackup(StartBackupCmd cmd);
+
+    /**
+     * Start a backup session for a VM
+     * Creates a new checkpoint and starts NBD server for pull-mode backup
+     */
+    Backup startBackup(StartBackupCmd cmd);
+
+    /**
+     * Finalize a backup session
+     * Stops NBD server, updates checkpoint tracking, deletes old checkpoints
+     */
+    Backup finalizeBackup(FinalizeBackupCmd cmd);
+
+    /**
+     * Create an image transfer object for a disk
+     * Registers NBD endpoint with ImageIO (stubbed for POC)
+     */
+    ImageTransferResponse createImageTransfer(CreateImageTransferCmd cmd);
+
+    ImageTransfer createImageTransfer(long volumeId, Long backupId, ImageTransfer.Direction direction, ImageTransfer.Format format);
+
+    boolean cancelImageTransfer(long imageTransferId);
+
+    /**
+     * Finalize an image transfer
+     * Marks transfer as complete (NBD is closed globally in finalize backup)
+     */
+    boolean finalizeImageTransfer(FinalizeImageTransferCmd cmd);
+
+    boolean finalizeImageTransfer(long imageTransferId);
+
+    /**
+     * List image transfers for a backup
+     */
+    List<ImageTransferResponse> listImageTransfers(ListImageTransfersCmd cmd);
+
+    /**
+     * List checkpoints for a VM
+     */
+    List<CheckpointResponse> listVmCheckpoints(ListVmCheckpointsCmd cmd);
+
+    /**
+     * Delete a VM checkpoint (no-op for normal flow, kept for API parity)
+     */
+    boolean deleteVmCheckpoint(DeleteVmCheckpointCmd cmd);
+
+    /**
+     * List Compatible Data Center Ids for the service
+     */
+    List<Long> listCompatibleDataCenterIds();
+}
diff --git a/api/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSService.java b/api/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSService.java
index 21184de27a26..3e349cf0bd39 100644
--- a/api/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSService.java
+++ b/api/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSService.java
@@ -23,6 +23,10 @@
 import org.apache.cloudstack.api.command.user.storage.sharedfs.ChangeSharedFSServiceOfferingCmd;
 import org.apache.cloudstack.api.command.user.storage.sharedfs.CreateSharedFSCmd;
 import org.apache.cloudstack.api.command.user.storage.sharedfs.DestroySharedFSCmd;
+import org.apache.cloudstack.api.command.user.storage.sharedfs.ListSharedFSCmd;
+import org.apache.cloudstack.api.command.user.storage.sharedfs.UpdateSharedFSCmd;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.SharedFSResponse;
 
 import com.cloud.exception.InsufficientCapacityException;
 import com.cloud.exception.ManagementServerException;
@@ -31,11 +35,6 @@
 import com.cloud.exception.ResourceUnavailableException;
 import com.cloud.exception.VirtualMachineMigrationException;
 
-import org.apache.cloudstack.api.command.user.storage.sharedfs.ListSharedFSCmd;
-import org.apache.cloudstack.api.command.user.storage.sharedfs.UpdateSharedFSCmd;
-import org.apache.cloudstack.api.response.SharedFSResponse;
-import org.apache.cloudstack.api.response.ListResponse;
-
 public interface SharedFSService {
 
     List<SharedFSProvider> getSharedFSProviders();
@@ -69,4 +68,10 @@ public interface SharedFSService {
     SharedFS recoverSharedFS(Long sharedFSId);
 
     void deleteSharedFS(Long sharedFSId);
+
+    SharedFS getSharedFSByUuid(String uuid);
+
+    SharedFS getSharedFSForVmId(long vmId);
+
+    SharedFS updateSharedFSPostRestore(long sharedFsId, long volumeId);
 }
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmdTest.java
new file mode 100644
index 000000000000..27bc4614e1b5
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/AssignVMCmdTest.java
@@ -0,0 +1,55 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.admin.vm;
+
+import org.junit.Assert;
+import org.junit.Test;
+import org.springframework.test.util.ReflectionTestUtils;
+
+public class AssignVMCmdTest {
+
+    @Test
+    public void test_setSkipNetwork_default() {
+        AssignVMCmd assignVMCmd = new AssignVMCmd();
+        Object value = ReflectionTestUtils.getField(assignVMCmd, "skipNetwork");
+        Assert.assertTrue(value instanceof Boolean);
+        Assert.assertFalse((Boolean) value);
+    }
+
+    @Test
+    public void test_setSkipNetwork_set() {
+        AssignVMCmd assignVMCmd = new AssignVMCmd();
+        assignVMCmd.setSkipNetwork(true);
+        Object value = ReflectionTestUtils.getField(assignVMCmd, "skipNetwork");
+        Assert.assertTrue(value instanceof Boolean);
+        Assert.assertTrue((Boolean) value);
+    }
+
+    @Test
+    public void test_isSkipNetwork_default() {
+        AssignVMCmd assignVMCmd = new AssignVMCmd();
+        Assert.assertFalse(assignVMCmd.isSkipNetwork());
+    }
+
+    @Test
+    public void test_isSkipNetwork_set() {
+        AssignVMCmd assignVMCmd = new AssignVMCmd();
+        ReflectionTestUtils.setField(assignVMCmd, "skipNetwork", true);
+        Assert.assertTrue(assignVMCmd.isSkipNetwork());
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdminTest.java b/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdminTest.java
new file mode 100644
index 000000000000..d82dc9f766f9
--- /dev/null
+++ b/api/src/test/java/org/apache/cloudstack/api/command/admin/vm/DeployVMCmdByAdminTest.java
@@ -0,0 +1,75 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.api.command.admin.vm;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+@RunWith(MockitoJUnitRunner.class)
+public class DeployVMCmdByAdminTest {
+
+    @InjectMocks
+    private DeployVMCmdByAdmin cmd;
+
+    @Test
+    public void testIsBlankInstance_default() {
+        assertFalse(cmd.isBlankInstance());
+    }
+
+    @Test
+    public void testIsBlankInstance_true() {
+        ReflectionTestUtils.setField(cmd, "blankInstance", true);
+        assertTrue(cmd.isBlankInstance());
+    }
+
+    @Test
+    public void testIsBlankInstance_false() {
+        ReflectionTestUtils.setField(cmd, "blankInstance", false);
+        assertFalse(cmd.isBlankInstance());
+    }
+
+    @Test
+    public void testSetBlankInstance_default() {
+        Object obj = ReflectionTestUtils.getField(cmd, "blankInstance");
+        assertNull(obj);
+    }
+
+    @Test
+    public void testSetBlankInstance_true() {
+        cmd.setBlankInstance(true);
+        Object obj = ReflectionTestUtils.getField(cmd, "blankInstance");
+        assertNotNull(obj);
+        assertTrue((boolean)obj);
+    }
+
+    @Test
+    public void testSetBlankInstance_false() {
+        cmd.setBlankInstance(false);
+        Object obj = ReflectionTestUtils.getField(cmd, "blankInstance");
+        assertNotNull(obj);
+        assertFalse((boolean)obj);
+    }
+}
diff --git a/api/src/test/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmdTest.java b/api/src/test/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmdTest.java
index f7e3e38d9c3f..09d396e40237 100644
--- a/api/src/test/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmdTest.java
+++ b/api/src/test/java/org/apache/cloudstack/api/command/user/vm/DeployVMCmdTest.java
@@ -17,6 +17,7 @@
 package org.apache.cloudstack.api.command.user.vm;
 
 import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertNull;
 import static org.junit.Assert.assertThrows;
@@ -41,6 +42,7 @@
 import org.springframework.test.util.ReflectionTestUtils;
 
 import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.hypervisor.Hypervisor.HypervisorType;
 import com.cloud.network.NetworkService;
 import com.cloud.utils.db.EntityManager;
 import com.cloud.vm.VmDetailConstants;
@@ -480,4 +482,146 @@ public void testGetDataDiskTemplateToDiskOfferingMapInvalidTemplateId() {
         });
         assertTrue(thrownException.getMessage().contains("Unable to translate and find entity with datadisktemplateid"));
     }
+
+    @Test
+    public void testSetServiceOfferingId() {
+        cmd.setServiceOfferingId(101L);
+        assertEquals(Long.valueOf(101L), cmd.getServiceOfferingId());
+    }
+
+    @Test
+    public void testSetTemplateId() {
+        cmd.setTemplateId(102L);
+        assertEquals(Long.valueOf(102L), cmd.getTemplateId());
+    }
+
+    @Test
+    public void testSetVolumeId() {
+        cmd.setVolumeId(103L);
+        assertEquals(Long.valueOf(103L), cmd.getVolumeId());
+    }
+
+    @Test
+    public void testSetSnapshotId() {
+        cmd.setSnapshotId(104L);
+        assertEquals(Long.valueOf(104L), cmd.getSnapshotId());
+    }
+
+    @Test
+    public void testSetZoneId() {
+        cmd.setZoneId(105L);
+        assertEquals(Long.valueOf(105L), cmd.getZoneId());
+    }
+
+    @Test
+    public void testSetName() {
+        cmd.setName("vm-name");
+        assertEquals("vm-name", cmd.getName());
+    }
+
+    @Test
+    public void testSetDisplayName() {
+        cmd.setDisplayName("vm-display-name");
+        assertEquals("vm-display-name", cmd.getDisplayName());
+    }
+
+    @Test
+    public void testSetAccountName() {
+        cmd.setAccountName("account-name");
+        assertEquals("account-name", cmd.getAccountName());
+    }
+
+    @Test
+    public void testSetDomainId() {
+        cmd.setDomainId(106L);
+        assertEquals(Long.valueOf(106L), cmd.getDomainId());
+    }
+
+    @Test
+    public void testSetNetworkIds() {
+        List<Long> networkIds = Arrays.asList(11L, 12L);
+        cmd.setNetworkIds(networkIds);
+        assertEquals(networkIds, cmd.getNetworkIds());
+    }
+
+    @Test
+    public void testSetBootType() {
+        cmd.setBootType("UEFI");
+        assertEquals(BootType.UEFI, cmd.getBootType());
+    }
+
+    @Test
+    public void testSetBootMode() {
+        cmd.setBootType("UEFI");
+        cmd.setBootMode("SECURE");
+        assertEquals(BootMode.SECURE, cmd.getBootMode());
+    }
+
+    @Test
+    public void testSetHypervisor() {
+        cmd.setHypervisor("KVM");
+        assertEquals(HypervisorType.KVM, cmd.getHypervisor());
+    }
+
+    @Test
+    public void testSetUserData() {
+        cmd.setUserData("dXNlci1kYXRh");
+        assertEquals("dXNlci1kYXRh", cmd.getUserData());
+    }
+
+    @Test
+    public void testSetKeyboard() {
+        cmd.setKeyboard("us");
+        assertEquals("us", cmd.getKeyboard());
+    }
+
+    @Test
+    public void testSetProjectId() {
+        cmd.setProjectId(107L);
+        assertEquals(Long.valueOf(107L), ReflectionTestUtils.getField(cmd, "projectId"));
+    }
+
+    @Test
+    public void testSetDisplayVm() {
+        cmd.setDisplayVm(Boolean.FALSE);
+        assertEquals(Boolean.FALSE, cmd.isDisplayVm());
+    }
+
+    @Test
+    public void testSetUserDataId() {
+        cmd.setUserDataId(108L);
+        assertEquals(Long.valueOf(108L), cmd.getUserdataId());
+    }
+
+    @Test
+    public void testSetAffinityGroupIds() {
+        List<Long> affinityGroupIds = Arrays.asList(21L, 22L);
+        cmd.setAffinityGroupIds(affinityGroupIds);
+        assertEquals(affinityGroupIds, cmd.getAffinityGroupIdList());
+    }
+
+    @Test
+    public void testSetDetails() {
+        Map<String, String> details = new HashMap<>();
+        details.put("key", "value");
+        cmd.setDetails(details);
+        assertEquals(details, ReflectionTestUtils.getField(cmd, "details"));
+    }
+
+    @Test
+    public void testSetExtraConfig() {
+        cmd.setExtraConfig("cpu-mode=host-passthrough");
+        assertEquals("cpu-mode=host-passthrough", cmd.getExtraConfig());
+    }
+
+    @Test
+    public void testSetDynamicScalingEnabled() {
+        cmd.setDynamicScalingEnabled(Boolean.FALSE);
+        assertFalse(cmd.isDynamicScalingEnabled());
+    }
+
+    @Test
+    public void testIsBlankInstance() {
+        assertFalse(cmd.isBlankInstance());
+    }
 }
diff --git a/client/pom.xml b/client/pom.xml
index ba16cc5d34a2..7d37225dbbb3 100644
--- a/client/pom.xml
+++ b/client/pom.xml
@@ -612,6 +612,11 @@
             <artifactId>cloud-plugin-backup-nas</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-plugin-integrations-veeam-control-service</artifactId>
+            <version>${project.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.apache.cloudstack</groupId>
             <artifactId>cloud-plugin-integrations-kubernetes-service</artifactId>
diff --git a/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferAnswer.java
new file mode 100644
index 000000000000..34cf6d4ca34c
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferAnswer.java
@@ -0,0 +1,56 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+
+public class CreateImageTransferAnswer extends Answer {
+    private String imageTransferId;
+    private String transferUrl;
+
+    public CreateImageTransferAnswer() {
+    }
+
+    public CreateImageTransferAnswer(CreateImageTransferCommand cmd, boolean success, String details) {
+        super(cmd, success, details);
+    }
+
+    public CreateImageTransferAnswer(CreateImageTransferCommand cmd, boolean success, String details,
+                                    String imageTransferId, String transferUrl) {
+        super(cmd, success, details);
+        this.imageTransferId = imageTransferId;
+        this.transferUrl = transferUrl;
+    }
+
+    public String getImageTransferId() {
+        return imageTransferId;
+    }
+
+    public void setImageTransferId(String imageTransferId) {
+        this.imageTransferId = imageTransferId;
+    }
+
+    public String getTransferUrl() {
+        return transferUrl;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferCommand.java b/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferCommand.java
new file mode 100644
index 000000000000..95b56c9a9c38
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/CreateImageTransferCommand.java
@@ -0,0 +1,94 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+
+public class CreateImageTransferCommand extends Command {
+    private String transferId;
+    private String exportName;
+    private String socket;
+    private String direction;
+    private String checkpointId;
+    private String file;
+    private ImageTransfer.Backend backend;
+    private int idleTimeoutSeconds;
+
+    public CreateImageTransferCommand() {
+    }
+
+    private CreateImageTransferCommand(String transferId, String direction, String socket, int idleTimeoutSeconds) {
+        this.transferId = transferId;
+        this.direction = direction;
+        this.socket = socket;
+        this.idleTimeoutSeconds = idleTimeoutSeconds;
+    }
+
+    public CreateImageTransferCommand(String transferId, String direction, String exportName, String socket, String checkpointId, int idleTimeoutSeconds) {
+        this(transferId, direction, socket, idleTimeoutSeconds);
+        this.backend = ImageTransfer.Backend.nbd;
+        this.exportName = exportName;
+        this.checkpointId = checkpointId;
+    }
+
+    public CreateImageTransferCommand(String transferId, String direction, String socket, String file, int idleTimeoutSeconds) {
+        this(transferId, direction, socket, idleTimeoutSeconds);
+        if (direction == ImageTransfer.Direction.download.toString()) {
+            throw new IllegalArgumentException("File backend is only supported for upload");
+        }
+        this.backend = ImageTransfer.Backend.file;
+        this.file = file;
+    }
+
+    public String getExportName() {
+        return exportName;
+    }
+
+    public String getSocket() {
+        return socket;
+    }
+
+    public String getFile() {
+        return file;
+    }
+
+    public ImageTransfer.Backend getBackend() {
+        return backend;
+    }
+
+    public String getTransferId() {
+        return transferId;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    public String getCheckpointId() {
+        return checkpointId;
+    }
+
+    public int getIdleTimeoutSeconds() {
+        return idleTimeoutSeconds;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/DeleteVmCheckpointCommand.java b/core/src/main/java/org/apache/cloudstack/backup/DeleteVmCheckpointCommand.java
new file mode 100644
index 000000000000..81cf6c1abfcc
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/DeleteVmCheckpointCommand.java
@@ -0,0 +1,60 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import java.util.Map;
+
+import com.cloud.agent.api.Command;
+
+public class DeleteVmCheckpointCommand extends Command {
+    private String vmName;
+    private String checkpointId;
+    private Map<String, String> diskPathUuidMap;
+    private boolean stoppedVM;
+
+    public DeleteVmCheckpointCommand() {
+    }
+
+    public DeleteVmCheckpointCommand(String vmName, String checkpointId, Map<String, String> diskPathUuidMap, boolean stoppedVM) {
+        this.vmName = vmName;
+        this.checkpointId = checkpointId;
+        this.diskPathUuidMap = diskPathUuidMap;
+        this.stoppedVM = stoppedVM;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public String getCheckpointId() {
+        return checkpointId;
+    }
+
+    public Map<String, String> getDiskPathUuidMap() {
+        return diskPathUuidMap;
+    }
+
+    public boolean isStoppedVM() {
+        return stoppedVM;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/FinalizeImageTransferCommand.java b/core/src/main/java/org/apache/cloudstack/backup/FinalizeImageTransferCommand.java
new file mode 100644
index 000000000000..84d9b1ff8186
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/FinalizeImageTransferCommand.java
@@ -0,0 +1,40 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+
+public class FinalizeImageTransferCommand extends Command {
+    private String transferId;
+
+    public FinalizeImageTransferCommand() {
+    }
+
+    public FinalizeImageTransferCommand(String transferId) {
+        this.transferId = transferId;
+    }
+
+    public String getTransferId() {
+        return transferId;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StartBackupAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/StartBackupAnswer.java
new file mode 100644
index 000000000000..d7cbf097df90
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StartBackupAnswer.java
@@ -0,0 +1,44 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+
+public class StartBackupAnswer extends Answer {
+    private Long checkpointCreateTime;
+
+    public StartBackupAnswer() {
+    }
+
+    public StartBackupAnswer(StartBackupCommand cmd, boolean success, String details) {
+        super(cmd, success, details);
+    }
+
+    public StartBackupAnswer(StartBackupCommand cmd, boolean success, String details, Long checkpointCreateTime) {
+        super(cmd, success, details);
+        this.checkpointCreateTime = checkpointCreateTime;
+    }
+
+    public Long getCheckpointCreateTime() {
+        return checkpointCreateTime;
+    }
+
+    public void setCheckpointCreateTime(Long checkpointCreateTime) {
+        this.checkpointCreateTime = checkpointCreateTime;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StartBackupCommand.java b/core/src/main/java/org/apache/cloudstack/backup/StartBackupCommand.java
new file mode 100644
index 000000000000..6f1ed6834500
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StartBackupCommand.java
@@ -0,0 +1,91 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import java.util.Map;
+
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.LogLevel;
+
+public class StartBackupCommand extends Command {
+    private String vmName;
+    private String toCheckpointId;
+    private String fromCheckpointId;
+    private Long fromCheckpointCreateTime;
+    private String socket;
+    private Map<String, String> diskPathUuidMap;
+    private boolean stoppedVM;
+    @LogLevel(LogLevel.Log4jLevel.Off)
+    private Map<String, byte[]> diskPathPassphraseMap;
+
+    public StartBackupCommand() {
+    }
+
+    public StartBackupCommand(String vmName, String toCheckpointId, String fromCheckpointId, Long fromCheckpointCreateTime,
+                              String socket, Map<String, String> diskPathUuidMap, Map<String, byte[]> passphrases, boolean stoppedVM) {
+        this.vmName = vmName;
+        this.toCheckpointId = toCheckpointId;
+        this.fromCheckpointId = fromCheckpointId;
+        this.fromCheckpointCreateTime = fromCheckpointCreateTime;
+        this.socket = socket;
+        this.diskPathUuidMap = diskPathUuidMap;
+        this.diskPathPassphraseMap = passphrases;
+        this.stoppedVM = stoppedVM;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public String getToCheckpointId() {
+        return toCheckpointId;
+    }
+
+    public String getFromCheckpointId() {
+        return fromCheckpointId;
+    }
+
+    public Long getFromCheckpointCreateTime() {
+        return fromCheckpointCreateTime;
+    }
+
+    public String getSocket() {
+        return socket;
+    }
+
+    public Map<String, String> getDiskPathUuidMap() {
+        return diskPathUuidMap;
+    }
+
+    public boolean isIncremental() {
+        return fromCheckpointId != null && !fromCheckpointId.isEmpty();
+    }
+
+    public boolean isStoppedVM() {
+        return stoppedVM;
+    }
+
+    public Map<String, byte[]> getDiskPathPassphraseMap() {
+        return diskPathPassphraseMap;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerAnswer.java
new file mode 100644
index 000000000000..d8c78d3c8807
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerAnswer.java
@@ -0,0 +1,56 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+
+public class StartNBDServerAnswer extends Answer {
+    private String imageTransferId;
+    private String transferUrl;
+
+    public StartNBDServerAnswer() {
+    }
+
+    public StartNBDServerAnswer(StartNBDServerCommand cmd, boolean success, String details) {
+        super(cmd, success, details);
+    }
+
+    public StartNBDServerAnswer(StartNBDServerCommand cmd, boolean success, String details,
+                                String imageTransferId, String transferUrl) {
+        super(cmd, success, details);
+        this.imageTransferId = imageTransferId;
+        this.transferUrl = transferUrl;
+    }
+
+    public String getImageTransferId() {
+        return imageTransferId;
+    }
+
+    public void setImageTransferId(String imageTransferId) {
+        this.imageTransferId = imageTransferId;
+    }
+
+    public String getTransferUrl() {
+        return transferUrl;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerCommand.java b/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerCommand.java
new file mode 100644
index 000000000000..07e50f11fd37
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StartNBDServerCommand.java
@@ -0,0 +1,78 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+import com.cloud.agent.api.LogLevel;
+
+public class StartNBDServerCommand extends Command {
+    private String transferId;
+    private String exportName;
+    private String volumePath;
+    private String socket;
+    private String direction;
+    private String fromCheckpointId;
+    @LogLevel(LogLevel.Log4jLevel.Off)
+    private byte[] passphrase;
+
+    public StartNBDServerCommand() {
+    }
+
+    protected StartNBDServerCommand(String transferId, String exportName, String volumePath, String socket, String direction, String fromCheckpointId, byte[] passphrase) {
+        this.transferId = transferId;
+        this.socket = socket;
+        this.exportName = exportName;
+        this.volumePath = volumePath;
+        this.direction = direction;
+        this.fromCheckpointId = fromCheckpointId;
+        this.passphrase = passphrase;
+    }
+
+    public String getExportName() {
+        return exportName;
+    }
+
+    public String getSocket() {
+        return socket;
+    }
+
+    public String getTransferId() {
+        return transferId;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+
+    public String getVolumePath() {
+        return volumePath;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    public String getFromCheckpointId() {
+        return fromCheckpointId;
+    }
+
+    public byte[] getPassphrase() {
+        return passphrase;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StopBackupAnswer.java b/core/src/main/java/org/apache/cloudstack/backup/StopBackupAnswer.java
new file mode 100644
index 000000000000..ce977f31e005
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StopBackupAnswer.java
@@ -0,0 +1,30 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Answer;
+
+public class StopBackupAnswer extends Answer {
+
+    public StopBackupAnswer() {
+    }
+
+    public StopBackupAnswer(StopBackupCommand cmd, boolean success, String details) {
+        super(cmd, success, details);
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StopBackupCommand.java b/core/src/main/java/org/apache/cloudstack/backup/StopBackupCommand.java
new file mode 100644
index 000000000000..d3055021e9de
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StopBackupCommand.java
@@ -0,0 +1,52 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+
+public class StopBackupCommand extends Command {
+    private String vmName;
+    private Long vmId;
+    private Long backupId;
+
+    public StopBackupCommand() {
+    }
+
+    public StopBackupCommand(String vmName, Long vmId, Long backupId) {
+        this.vmName = vmName;
+        this.vmId = vmId;
+        this.backupId = backupId;
+    }
+
+    public String getVmName() {
+        return vmName;
+    }
+
+    public Long getVmId() {
+        return vmId;
+    }
+
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/core/src/main/java/org/apache/cloudstack/backup/StopNBDServerCommand.java b/core/src/main/java/org/apache/cloudstack/backup/StopNBDServerCommand.java
new file mode 100644
index 000000000000..d75168a22eb2
--- /dev/null
+++ b/core/src/main/java/org/apache/cloudstack/backup/StopNBDServerCommand.java
@@ -0,0 +1,46 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.agent.api.Command;
+
+public class StopNBDServerCommand extends Command {
+    private String transferId;
+    private String direction;
+
+    public StopNBDServerCommand() {
+    }
+
+    public StopNBDServerCommand(String transferId, String direction) {
+        this.transferId = transferId;
+        this.direction = direction;
+    }
+
+    public String getTransferId() {
+        return transferId;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    @Override
+    public boolean executeInSequence() {
+        return true;
+    }
+}
diff --git a/debian/control b/debian/control
index 2b8ce929c639..cdf663ef8906 100644
--- a/debian/control
+++ b/debian/control
@@ -24,7 +24,7 @@ Description: CloudStack server library
 
 Package: cloudstack-agent
 Architecture: all
-Depends: ${python:Depends}, ${python3:Depends}, openjdk-17-jre-headless | java17-runtime-headless | java17-runtime | zulu-17, cloudstack-common (= ${source:Version}), lsb-base (>= 9), openssh-client, qemu-kvm (>= 2.5) | qemu-system-x86 (>= 5.2), libvirt-bin (>= 1.3) | libvirt-daemon-system (>= 3.0), iproute2, ebtables, vlan, ipset, python3-libvirt, ethtool, iptables, cryptsetup, rng-tools, rsync, ovmf, swtpm, lsb-release, ufw, apparmor, cpu-checker, libvirt-daemon-driver-storage-rbd, sysstat
+Depends: ${python:Depends}, ${python3:Depends}, openjdk-17-jre-headless | java17-runtime-headless | java17-runtime | zulu-17, cloudstack-common (= ${source:Version}), lsb-base (>= 9), openssh-client, qemu-kvm (>= 2.5) | qemu-system-x86 (>= 5.2), libvirt-bin (>= 1.3) | libvirt-daemon-system (>= 3.0), iproute2, ebtables, vlan, ipset, python3-libvirt, ethtool, iptables, cryptsetup, rng-tools, rsync, ovmf, swtpm, lsb-release, ufw, apparmor, cpu-checker, libvirt-daemon-driver-storage-rbd, sysstat, python3-libnbd, socat
 Recommends: init-system-helpers
 Conflicts: cloud-agent, cloud-agent-libs, cloud-agent-deps, cloud-agent-scripts
 Description: CloudStack agent
diff --git a/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java b/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java
index e871bd8672ff..5eca02f33d51 100644
--- a/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java
+++ b/engine/api/src/main/java/com/cloud/vm/VirtualMachineManager.java
@@ -59,6 +59,8 @@
  */
 public interface VirtualMachineManager extends Manager {
 
+    String KVM_BLANK_VM_TEMPLATE_NAME = "kvm-blank-vm-template";
+
     ConfigKey<Boolean> ExecuteInSequence = new ConfigKey<>("Advanced", Boolean.class, "execute.in.sequence.hypervisor.commands", "false",
             "If set to true, start, stop, reboot, copy and migrate commands will be serialized on the agent side. If set to false the commands are executed in parallel. Default value is false.", false);
 
@@ -312,4 +314,8 @@ void checkDeploymentPlan(VirtualMachine virtualMachine, VirtualMachineTemplate t
                 ServiceOffering serviceOffering, Account systemAccount, DeploymentPlan plan)
             throws InsufficientServerCapacityException;
 
+    boolean isBlankInstanceDefaultTemplate(VirtualMachineTemplate template);
+
+    boolean isBlankInstance(VirtualMachineTemplate template);
+
 }
diff --git a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
index ead990b42b86..db50a5134d8d 100755
--- a/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
+++ b/engine/orchestration/src/main/java/com/cloud/vm/VirtualMachineManagerImpl.java
@@ -303,8 +303,8 @@
 import com.cloud.vm.VirtualMachine.State;
 import com.cloud.vm.dao.NicDao;
 import com.cloud.vm.dao.UserVmDao;
-import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.snapshot.VMSnapshotManager;
 import com.cloud.vm.snapshot.VMSnapshotVO;
 import com.cloud.vm.snapshot.dao.VMSnapshotDao;
@@ -576,7 +576,13 @@ public void allocate(final String vmInstanceName, final VirtualMachineTemplate t
 
             logger.debug("Allocating disks for {}",  persistedVm);
 
-            allocateRootVolume(persistedVm, template, rootDiskOfferingInfo, owner, rootDiskSizeFinal, volume, snapshot);
+            if (isBlankInstance(template)) {
+                logger.debug("Template is a dummy template for hypervisor {}, skipping volume allocation", hyperType);
+                return;
+            } else {
+                allocateRootVolume(persistedVm, template, rootDiskOfferingInfo, owner, rootDiskSizeFinal, volume, snapshot);
+            }
+
 
             // Create new Volume context and inject event resource type, id and details to generate VOLUME.CREATE event for the ROOT disk.
             CallContext volumeContext = CallContext.register(CallContext.current(), ApiCommandResourceType.Volume);
@@ -6708,4 +6714,18 @@ public void checkDeploymentPlan(VirtualMachine virtualMachine, VirtualMachineTem
                     vmProfile), DataCenter.class, plan.getDataCenterId(), areAffinityGroupsAssociated(vmProfile));
         }
     }
+
+    @Override
+    public boolean isBlankInstanceDefaultTemplate(VirtualMachineTemplate template) {
+        return KVM_BLANK_VM_TEMPLATE_NAME.equals(template.getUniqueName());
+    }
+
+    @Override
+    public boolean isBlankInstance(VirtualMachineTemplate template) {
+        if (isBlankInstanceDefaultTemplate(template)) {
+            return true;
+        }
+        return Boolean.TRUE.equals(
+                MapUtils.getBoolean(CallContext.current().getContextParameters(), ApiConstants.BLANK_INSTANCE));
+    }
 }
diff --git a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/CloudOrchestrator.java b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/CloudOrchestrator.java
index 8639f006383f..964265cb873e 100644
--- a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/CloudOrchestrator.java
+++ b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/CloudOrchestrator.java
@@ -19,6 +19,7 @@
 package org.apache.cloudstack.engine.orchestration;
 
 import com.cloud.storage.Snapshot;
+import com.cloud.storage.VMTemplateVO;
 import com.cloud.storage.Volume;
 import com.cloud.template.VirtualMachineTemplate;
 import java.net.URL;
@@ -292,9 +293,11 @@ public VirtualMachineEntity createVirtualMachineFromScratch(String id, String ow
 
         ServiceOfferingVO computeOffering = _serviceOfferingDao.findById(vm.getId(), vm.getServiceOfferingId());
 
+        VMTemplateVO iso = _templateDao.findByIdIncludingRemoved(Long.valueOf(isoId));
+
         DiskOfferingInfo rootDiskOfferingInfo = new DiskOfferingInfo();
 
-        if (diskOfferingId == null) {
+        if (diskOfferingId == null && !_itMgr.isBlankInstance(iso)) {
             throw new InvalidParameterValueException("Installing from ISO requires a disk offering to be specified for the root disk.");
         }
         DiskOfferingVO diskOffering = _diskOfferingDao.findById(diskOfferingId);
@@ -345,7 +348,7 @@ public VirtualMachineEntity createVirtualMachineFromScratch(String id, String ow
 
         HypervisorType hypervisorType = HypervisorType.valueOf(hypervisor);
 
-        _itMgr.allocate(vm.getInstanceName(), _templateDao.findByIdIncludingRemoved(new Long(isoId)), computeOffering, rootDiskOfferingInfo, dataDiskOfferings, dataDiskDeviceIds,
+        _itMgr.allocate(vm.getInstanceName(), iso, computeOffering, rootDiskOfferingInfo, dataDiskOfferings, dataDiskDeviceIds,
                 networkIpMap, plan, hypervisorType, extraDhcpOptionMap, null, volume, snapshot);
 
         return vmEntity;
diff --git a/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml b/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml
index 17c5002c718b..49c668f50e8b 100644
--- a/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml
+++ b/engine/orchestration/src/main/resources/META-INF/cloudstack/core/spring-engine-orchestration-core-context.xml
@@ -88,6 +88,7 @@
                 <entry key="VirtualMachineManagerImpl" value-ref="clusteredVirtualMachineManagerImpl" />
                 <entry key="VolumeApiServiceImpl" value-ref="volumeApiServiceImpl" />
                 <entry key="VMSnapshotManagerImpl" value-ref="vMSnapshotManagerImpl" />
+                <entry key="KVMBackupExportServiceImpl" value-ref="kvmBackupExportService" />
             </map>
         </property>
     </bean>
diff --git a/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDao.java b/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDao.java
index 6cfd2608f5de..3d04f6679def 100644
--- a/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDao.java
+++ b/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDao.java
@@ -23,6 +23,7 @@
 import com.cloud.dc.ClusterVO;
 import com.cloud.hypervisor.Hypervisor.HypervisorType;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 
 public interface ClusterDao extends GenericDao<ClusterVO, Long> {
@@ -61,4 +62,6 @@ public interface ClusterDao extends GenericDao<ClusterVO, Long> {
     List<String> listDistinctStorageAccessGroups(String name, String keyword);
 
     List<Long> listEnabledClusterIdsByZoneHypervisorArch(Long zoneId, HypervisorType hypervisorType, CPU.CPUArch arch);
+
+    List<ClusterVO> listByZonesAndHypervisorType(List<Long> zoneIds, HypervisorType hypervisorType, Filter filter);
 }
diff --git a/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDaoImpl.java b/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDaoImpl.java
index c63af0a237ba..9b6f0f7ac3a6 100644
--- a/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/dc/dao/ClusterDaoImpl.java
@@ -20,6 +20,7 @@
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.HashMap;
 import java.util.List;
 import java.util.Map;
@@ -27,6 +28,7 @@
 
 import javax.inject.Inject;
 
+import org.apache.commons.collections.CollectionUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.cpu.CPU;
@@ -38,6 +40,7 @@
 import com.cloud.org.Grouping;
 import com.cloud.org.Managed;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.GenericSearchBuilder;
 import com.cloud.utils.db.JoinBuilder;
@@ -413,4 +416,19 @@ public List<Long> listEnabledClusterIdsByZoneHypervisorArch(Long zoneId, Hypervi
         }
         return customSearch(sc, null);
     }
+
+    @Override
+    public List<ClusterVO> listByZonesAndHypervisorType(List<Long> zoneIds, HypervisorType hypervisorType, Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<ClusterVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        sb.and("hypervisorType", sb.entity().getHypervisorType(), SearchCriteria.Op.EQ);
+        sb.done();
+        SearchCriteria<ClusterVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("hypervisorType", hypervisorType.toString());
+        return listBy(sc, filter);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
index fdca6e43f00f..8406f80ed09d 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDao.java
@@ -24,6 +24,7 @@
 import com.cloud.network.Network.GuestType;
 import com.cloud.network.Network.State;
 import com.cloud.network.Networks.TrafficType;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.fsm.StateDao;
@@ -96,8 +97,13 @@ public interface NetworkDao extends GenericDao<NetworkVO, Long>, StateDao<State,
 
     boolean update(Long networkId, NetworkVO network, Map<String, String> serviceProviderMap);
 
+    List<NetworkVO> listByZoneAndTrafficType(long zoneId, TrafficType trafficType, Filter filter);
+
     List<NetworkVO> listByZoneAndTrafficType(long zoneId, TrafficType trafficType);
 
+    List<NetworkVO> listByZonesTrafficTypeAndOwners(List<Long> zoneIds, final TrafficType trafficType,
+                                                    List<Long> accountIds, List<Long> domainIds, Filter filter);
+
     void setCheckForGc(long networkId);
 
     int getNetworkCountByNetworkOffId(long networkOfferingId);
diff --git a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
index 9f7ffabac930..f3ece4879040 100644
--- a/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/dao/NetworkDaoImpl.java
@@ -19,6 +19,7 @@
 import java.net.URI;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
@@ -29,9 +30,9 @@
 import javax.inject.Inject;
 import javax.persistence.TableGenerator;
 
-import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.cloudstack.acl.ControlledEntity.ACLType;
 import org.apache.cloudstack.api.ApiConstants;
+import org.apache.commons.collections.CollectionUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.network.Network;
@@ -63,6 +64,7 @@
 import com.cloud.utils.db.SearchCriteria.Op;
 import com.cloud.utils.db.SequenceFetcher;
 import com.cloud.utils.db.TransactionLegacy;
+import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.utils.net.NetUtils;
 
 @Component
@@ -632,12 +634,46 @@ public List<NetworkVO> listBy(final long accountId, final long dataCenterId, fin
     }
 
     @Override
-    public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType) {
+    public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType, Filter filter) {
         final SearchCriteria<NetworkVO> sc = AllFieldsSearch.create();
         sc.setParameters("datacenter", zoneId);
         sc.setParameters("trafficType", trafficType);
 
-        return listBy(sc, null);
+        return listBy(sc, filter);
+    }
+
+    @Override
+    public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType) {
+        return listByZoneAndTrafficType(zoneId, trafficType, null);
+    }
+
+    @Override
+    public List<NetworkVO> listByZonesTrafficTypeAndOwners(List<Long> zoneIds, final TrafficType trafficType,
+                                                           List<Long> accountIds, List<Long> domainIds, Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<NetworkVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        sb.and("trafficType", sb.entity().getTrafficType(), Op.EQ);
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainIdsNotEmpty = CollectionUtils.isNotEmpty(domainIds);
+        if (accountIdsNotEmpty || domainIdsNotEmpty) {
+            sb.and().op("account", sb.entity().getAccountId(), SearchCriteria.Op.IN);
+            sb.or("domain", sb.entity().getDomainId(), SearchCriteria.Op.IN);
+            sb.cp();
+        }
+        sb.done();
+        final SearchCriteria<NetworkVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("trafficType", trafficType);
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainIdsNotEmpty) {
+            sc.setParameters("domain", domainIds.toArray());
+        }
+        return listBy(sc, filter);
     }
 
     @Override
diff --git a/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDao.java b/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDao.java
index 793334731095..2b18bcbd87bd 100644
--- a/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDao.java
+++ b/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDao.java
@@ -31,4 +31,6 @@ public interface SecurityGroupDao extends GenericDao<SecurityGroupVO, Long> {
     List<SecurityGroupVO> findByAccountAndNames(Long accountId, String... names);
 
     int removeByAccountId(long accountId);
+
+    List<SecurityGroupVO> listByIds(List<Long> ids);
 }
diff --git a/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDaoImpl.java b/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDaoImpl.java
index 019cf5fec462..ffb45629b625 100644
--- a/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/network/security/dao/SecurityGroupDaoImpl.java
@@ -129,4 +129,14 @@ public boolean expunge(Long id) {
         txn.commit();
         return result;
     }
+
+    @Override
+    public List<SecurityGroupVO> listByIds(List<Long> ids) {
+        SearchBuilder<SecurityGroupVO> idsSearch = createSearchBuilder();
+        idsSearch.and("ids", idsSearch.entity().getId(), SearchCriteria.Op.IN);
+        idsSearch.done();
+        SearchCriteria<SecurityGroupVO> sc = idsSearch.create();
+        sc.setParameters("ids", ids.toArray());
+        return listBy(sc);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDao.java b/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDao.java
index 9beea0037444..ea97f663768f 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDao.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDao.java
@@ -30,7 +30,7 @@ public interface DiskOfferingDao extends GenericDao<DiskOfferingVO, Long> {
 
     List<DiskOfferingVO> listAllBySizeAndProvisioningType(long size, Storage.ProvisioningType provisioningType);
 
-    List<DiskOfferingVO> findCustomDiskOfferings();
+    List<DiskOfferingVO> listCustomDiskOfferings();
 
     List<DiskOfferingVO> listByStorageTag(String tag);
 
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDaoImpl.java b/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDaoImpl.java
index 4ca3fe9f12ac..44e6551da17d 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/DiskOfferingDaoImpl.java
@@ -16,6 +16,8 @@
 // under the License.
 package com.cloud.storage.dao;
 
+import static org.apache.cloudstack.query.QueryService.SortKeyAscending;
+
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
@@ -33,6 +35,7 @@
 import com.cloud.storage.DiskOfferingVO;
 import com.cloud.storage.Storage;
 import com.cloud.utils.db.Attribute;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
@@ -138,13 +141,14 @@ public List<DiskOfferingVO> listAllBySizeAndProvisioningType(long size, Storage.
     }
 
     @Override
-    public List<DiskOfferingVO> findCustomDiskOfferings() {
+    public List<DiskOfferingVO> listCustomDiskOfferings() {
         SearchBuilder<DiskOfferingVO> sb = createSearchBuilder();
         sb.and("customized", sb.entity().isCustomized(), SearchCriteria.Op.EQ);
         sb.done();
         SearchCriteria<DiskOfferingVO> sc = sb.create();
         sc.setParameters("customized", true);
-        return listBy(sc);
+        Filter searchFilter = new Filter(DiskOfferingVO.class, "sortKey", SortKeyAscending.value());
+        return listBy(sc, searchFilter);
     }
 
     @Override
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDao.java b/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDao.java
index 4c9f906b68a9..aec06d6d0003 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDao.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDao.java
@@ -106,4 +106,6 @@ public interface VMTemplateDao extends GenericDao<VMTemplateVO, Long>, StateDao<
 
     VMTemplateVO findActiveSystemTemplateByHypervisorArchAndUrlPath(HypervisorType hypervisorType,
                 CPU.CPUArch arch, String urlPathSuffix);
+
+    VMTemplateVO findByAccountAndName(Long accountId, String templateName);
 }
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDaoImpl.java b/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDaoImpl.java
index 9b5d0edc599d..8c6e3fe0983f 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VMTemplateDaoImpl.java
@@ -945,4 +945,12 @@ public boolean updateState(
         }
         return rows > 0;
     }
+
+    @Override
+    public VMTemplateVO findByAccountAndName(Long accountId, String templateName) {
+        SearchCriteria<VMTemplateVO> sc = NameAccountIdSearch.create();
+        sc.setParameters("name", templateName);
+        sc.setParameters("accountId", accountId);
+        return findOneBy(sc);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java
index 717e3e782f2f..7d566a1ea01e 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDao.java
@@ -46,6 +46,8 @@ public interface VolumeDao extends GenericDao<VolumeVO, Long>, StateDao<Volume.S
 
     List<VolumeVO> findByInstanceAndType(long id, Volume.Type vType);
 
+    List<VolumeVO> findByInstanceAndNotStates(long id, Volume.State...states);
+
     List<VolumeVO> findIncludingRemovedByInstanceAndType(long id, Volume.Type vType);
 
     List<VolumeVO> findNonDestroyedVolumesByInstanceIdAndPoolId(long instanceId, long poolId);
diff --git a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java
index fce4d1f7233d..91f1c7f5eb69 100644
--- a/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/storage/dao/VolumeDaoImpl.java
@@ -208,6 +208,17 @@ public List<VolumeVO> findByInstanceAndType(long id, Type vType) {
         return listBy(sc);
     }
 
+    @Override
+    public List<VolumeVO> findByInstanceAndNotStates(long id, Volume.State...states) {
+        SearchBuilder<VolumeVO> sb = createSearchBuilder();
+        sb.and("instanceId", sb.entity().getInstanceId(), Op.EQ);
+        sb.and("state", sb.entity().getState(), Op.NIN);
+        SearchCriteria<VolumeVO> sc = sb.create();
+        sc.setParameters("instanceId", id);
+        sc.setParameters("state", (Object[]) states);
+        return listBy(sc);
+    }
+
     @Override
     public List<VolumeVO> findIncludingRemovedByInstanceAndType(long id, Type vType) {
         SearchCriteria<VolumeVO> sc = AllFieldsSearch.create();
diff --git a/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagDao.java b/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagDao.java
index bacb09b98793..5efaea40a943 100644
--- a/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagDao.java
+++ b/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagDao.java
@@ -20,11 +20,13 @@
 import java.util.Map;
 import java.util.Set;
 
+import org.apache.cloudstack.api.response.ResourceTagResponse;
+
 import com.cloud.server.ResourceTag;
 import com.cloud.server.ResourceTag.ResourceObjectType;
 import com.cloud.tags.ResourceTagVO;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
-import org.apache.cloudstack.api.response.ResourceTagResponse;
 
 public interface ResourceTagDao extends GenericDao<ResourceTagVO, Long> {
 
@@ -60,4 +62,13 @@ public interface ResourceTagDao extends GenericDao<ResourceTagVO, Long> {
     void removeByResourceIdAndKey(long resourceId, ResourceObjectType resourceType, String key);
 
     List<? extends ResourceTag> listByResourceUuid(String resourceUuid);
+
+    List<String> listByResourceTypeKeyPrefixAndOwners(ResourceObjectType resourceType, String key,
+                                                      List<Long> accountIds, List<Long> domainIds,
+                                                      Filter filter);
+
+    ResourceTagVO findByResourceTypeKeyPrefixAndValue(ResourceObjectType resourceType, String key, String value);
+
+    List<ResourceTagVO> listByResourceTypeIdAndKeyPrefix(ResourceObjectType resourceType, long resourceId, String key);
+
 }
diff --git a/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagsDaoImpl.java b/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagsDaoImpl.java
index cc9d99e6ab16..22c7b7b2ee5b 100644
--- a/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagsDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/tags/dao/ResourceTagsDaoImpl.java
@@ -16,19 +16,22 @@
 // under the License.
 package com.cloud.tags.dao;
 
-import java.util.List;
-import java.util.Set;
-import java.util.Map;
 import java.util.HashMap;
 import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
 
 import org.apache.cloudstack.api.response.ResourceTagResponse;
+import org.apache.commons.collections.CollectionUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.server.ResourceTag;
 import com.cloud.server.ResourceTag.ResourceObjectType;
 import com.cloud.tags.ResourceTagVO;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.GenericSearchBuilder;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
 import com.cloud.utils.db.SearchCriteria.Op;
@@ -120,4 +123,62 @@ public List<? extends ResourceTag> listByResourceUuid(String resourceUuid) {
         sc.setParameters("resourceUuid", resourceUuid);
         return listBy(sc);
     }
+
+    @Override
+    public List<String> listByResourceTypeKeyPrefixAndOwners(ResourceObjectType resourceType, String key,
+                                                             List<Long> accountIds, List<Long> domainIds,
+                                                             Filter filter) {
+        GenericSearchBuilder<ResourceTagVO, String> sb = createSearchBuilder(String.class);
+        sb.select(null, SearchCriteria.Func.DISTINCT, sb.entity().getValue());
+        sb.and("resourceType", sb.entity().getResourceType(), Op.EQ);
+        sb.and("key", sb.entity().getKey(), Op.LIKE);
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainIdsNotEmpty = CollectionUtils.isNotEmpty(domainIds);
+        if (accountIdsNotEmpty || domainIdsNotEmpty) {
+            sb.and().op("account", sb.entity().getAccountId(), SearchCriteria.Op.IN);
+            sb.or("domain", sb.entity().getDomainId(), SearchCriteria.Op.IN);
+            sb.cp();
+        }
+        sb.done();
+        final SearchCriteria<String> sc = sb.create();
+        sc.setParameters("resourceType", resourceType);
+        sc.setParameters("key", key + "%");
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainIdsNotEmpty) {
+            sc.setParameters("domain", domainIds.toArray());
+        }
+        return customSearch(sc, filter);
+    }
+
+    @Override
+    public ResourceTagVO findByResourceTypeKeyPrefixAndValue(ResourceObjectType resourceType, String key,
+                                                             String value) {
+        SearchBuilder<ResourceTagVO> sb = createSearchBuilder();
+        sb.and("resourceType", sb.entity().getResourceType(), Op.EQ);
+        sb.and("key", sb.entity().getKey(), Op.LIKE);
+        sb.and("value", sb.entity().getValue(), Op.EQ);
+        sb.done();
+        final SearchCriteria<ResourceTagVO> sc = sb.create();
+        sc.setParameters("resourceType", resourceType);
+        sc.setParameters("key", key + "%");
+        sc.setParameters("value", value);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public List<ResourceTagVO> listByResourceTypeIdAndKeyPrefix(ResourceObjectType resourceType, long resourceId,
+                                                                String key) {
+        SearchBuilder<ResourceTagVO> sb = createSearchBuilder();
+        sb.and("resourceType", sb.entity().getResourceType(), Op.EQ);
+        sb.and("resourceId", sb.entity().getResourceId(), Op.EQ);
+        sb.and("key", sb.entity().getKey(), Op.LIKE);
+        sb.done();
+        final SearchCriteria<ResourceTagVO> sc = sb.create();
+        sc.setParameters("resourceType", resourceType);
+        sc.setParameters("resourceId", resourceId);
+        sc.setParameters("key", key + "%");
+        return listBy(sc);
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java
index 96a1b6e3bd16..7767b7512b91 100644
--- a/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/NicDao.java
@@ -26,6 +26,8 @@
 public interface NicDao extends GenericDao<NicVO, Long> {
     List<NicVO> listByVmId(long instanceId);
 
+    int countByVmId(long instanceId);
+
     List<NicVO> listByVmIdOrderByDeviceId(long instanceId);
 
     List<String> listIpAddressInNetwork(long networkConfigId);
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java
index 78966a09e97c..6202dabf730e 100644
--- a/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/NicDaoImpl.java
@@ -126,6 +126,13 @@ public List<NicVO> listByVmId(long instanceId) {
         return listBy(sc);
     }
 
+    @Override
+    public int countByVmId(long instanceId) {
+        SearchCriteria<NicVO> sc = AllFieldsSearch.create();
+        sc.setParameters("instance", instanceId);
+        return getCount(sc);
+    }
+
     @Override
     public List<NicVO> listByVmIdOrderByDeviceId(long instanceId) {
         SearchCriteria<NicVO> sc = AllFieldsSearch.create();
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java
index 4fd3e729e0d2..1a5b8cedd9ea 100755
--- a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDao.java
@@ -197,4 +197,6 @@ List<VMInstanceVO> searchRemovedByRemoveDate(final Date startDate, final Date en
     List<VMInstanceVO> listDeleteProtectedVmsByAccountId(long accountId);
 
     List<VMInstanceVO> listDeleteProtectedVmsByDomainIds(Set<Long> domainIds);
+
+    List<Long> listIdsByHostIdForVolumeStats(long hostIds);
 }
diff --git a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
index 019d152ce5c3..ae1e838649ba 100755
--- a/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/vm/dao/VMInstanceDaoImpl.java
@@ -1336,4 +1336,20 @@ public List<VMInstanceVO> listDeleteProtectedVmsByDomainIds(Set<Long> domainIds)
         Filter filter = new Filter(VMInstanceVO.class, null, false, 0L, 10L);
         return listBy(sc, filter);
     }
+
+    @Override
+    public List<Long> listIdsByHostIdForVolumeStats(long hostId) {
+        GenericSearchBuilder<VMInstanceVO, Long> sb = createSearchBuilder(Long.class);
+        sb.selectFields(sb.entity().getId());
+        sb.and().op("host", sb.entity().getHostId(), SearchCriteria.Op.EQ);
+        sb.or().op("hostNull", sb.entity().getHostId(), Op.NULL);
+        sb.and("lastHost", sb.entity().getLastHostId(), SearchCriteria.Op.EQ);
+        sb.cp();
+        sb.cp();
+        sb.done();
+        SearchCriteria<Long> sc = sb.create();
+        sc.setParameters("host", hostId);
+        sc.setParameters("lastHost", hostId);
+        return customSearch(sc, null);
+    }
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
index 0f8a10fb7be6..d589f9e6bef8 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/BackupVO.java
@@ -103,6 +103,18 @@ public class BackupVO implements Backup {
     @Column(name = "backup_schedule_id")
     private Long backupScheduleId;
 
+    @Column(name = "from_checkpoint_id")
+    private String fromCheckpointId;
+
+    @Column(name = "to_checkpoint_id")
+    private String toCheckpointId;
+
+    @Column(name = "checkpoint_create_time")
+    private Long checkpointCreateTime;
+
+    @Column(name = "host_id")
+    private Long hostId;
+
     @Transient
     Map<String, String> details;
 
@@ -288,4 +300,40 @@ public Long getBackupScheduleId() {
     public void setBackupScheduleId(Long backupScheduleId) {
         this.backupScheduleId = backupScheduleId;
     }
+
+    @Override
+    public String getFromCheckpointId() {
+        return fromCheckpointId;
+    }
+
+    public void setFromCheckpointId(String fromCheckpointId) {
+        this.fromCheckpointId = fromCheckpointId;
+    }
+
+    @Override
+    public String getToCheckpointId() {
+        return toCheckpointId;
+    }
+
+    public void setToCheckpointId(String toCheckpointId) {
+        this.toCheckpointId = toCheckpointId;
+    }
+
+    @Override
+    public Long getCheckpointCreateTime() {
+        return checkpointCreateTime;
+    }
+
+    public void setCheckpointCreateTime(Long checkpointCreateTime) {
+        this.checkpointCreateTime = checkpointCreateTime;
+    }
+
+    @Override
+    public Long getHostId() {
+        return hostId;
+    }
+
+    public void setHostId(Long hostId) {
+        this.hostId = hostId;
+    }
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/ImageTransferVO.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/ImageTransferVO.java
new file mode 100644
index 000000000000..ec9b927b63e4
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/ImageTransferVO.java
@@ -0,0 +1,242 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import java.util.Date;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.EnumType;
+import javax.persistence.Enumerated;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+import javax.persistence.Temporal;
+import javax.persistence.TemporalType;
+
+@Entity
+@Table(name = "image_transfer")
+public class ImageTransferVO implements ImageTransfer {
+
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    private long id;
+
+    @Column(name = "uuid")
+    private String uuid;
+
+    @Column(name = "backup_id")
+    private Long backupId;
+
+    @Column(name = "volume_id")
+    private long volumeId;
+
+    @Column(name = "host_id")
+    private long hostId;
+
+    @Column(name = "socket")
+    private String socket;
+
+    @Column(name = "file")
+    private String file;
+
+    @Column(name = "transfer_url")
+    private String transferUrl;
+
+    @Enumerated(value = EnumType.STRING)
+    @Column(name = "phase")
+    private Phase phase;
+
+    @Enumerated(value = EnumType.STRING)
+    @Column(name = "direction")
+    private Direction direction;
+
+    @Enumerated(value = EnumType.STRING)
+    @Column(name = "backend")
+    private Backend backend;
+
+    @Column(name = "signed_ticket_id")
+    private String signedTicketId;
+
+    @Column(name = "account_id")
+    Long accountId;
+
+    @Column(name = "domain_id")
+    Long domainId;
+
+    @Column(name = "data_center_id")
+    Long dataCenterId;
+
+    @Column(name = "created")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date created;
+
+    @Column(name = "updated")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date updated;
+
+    @Column(name = "removed")
+    @Temporal(value = TemporalType.TIMESTAMP)
+    private Date removed;
+
+    public ImageTransferVO() {
+    }
+
+    private ImageTransferVO(String uuid, long volumeId, long hostId, Phase phase, Direction direction, Long accountId, Long domainId, Long dataCenterId) {
+        this.uuid = uuid;
+        this.volumeId = volumeId;
+        this.hostId = hostId;
+        this.phase = phase;
+        this.direction = direction;
+        this.accountId = accountId;
+        this.domainId = domainId;
+        this.dataCenterId = dataCenterId;
+        this.created = new Date();
+    }
+
+    public ImageTransferVO(String uuid, Long backupId, long volumeId, long hostId, String socket, Phase phase, Direction direction, Long accountId, Long domainId, Long dataCenterId) {
+        this(uuid, volumeId, hostId, phase, direction, accountId, domainId, dataCenterId);
+        this.backupId = backupId;
+        this.socket = socket;
+        this.backend = Backend.nbd;
+    }
+
+    public ImageTransferVO(String uuid, long volumeId, long hostId, String file, Phase phase, Direction direction, Long accountId, Long domainId, Long dataCenterId) {
+        this(uuid, volumeId, hostId, phase, direction, accountId, domainId, dataCenterId);
+        this.file = file;
+        this.backend = Backend.file;
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public String getUuid() {
+        return uuid;
+    }
+
+    @Override
+    public Long getBackupId() {
+        return backupId;
+    }
+
+    public void setBackupId(long backupId) {
+        this.backupId = backupId;
+    }
+
+    @Override
+    public long getVolumeId() {
+        return volumeId;
+    }
+
+    public void setVolumeId(long volumeId) {
+        this.volumeId = volumeId;
+    }
+
+    @Override
+    public long getHostId() {
+        return hostId;
+    }
+
+    public void setHostId(long hostId) {
+        this.hostId = hostId;
+    }
+
+    public void setSocket(String socket) {
+        this.socket = socket;
+    }
+
+    @Override
+    public String getTransferUrl() {
+        return transferUrl;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+    @Override
+    public Phase getPhase() {
+        return phase;
+    }
+
+    public void setPhase(Phase phase) {
+        this.phase = phase;
+        this.updated = new Date();
+    }
+
+    @Override
+    public Direction getDirection() {
+        return direction;
+    }
+
+    public void setDirection(Direction direction) {
+        this.direction = direction;
+    }
+
+    @Override
+    public Backend getBackend() {
+        return backend;
+    }
+
+    @Override
+    public String getSignedTicketId() {
+        return signedTicketId;
+    }
+
+    public void setSignedTicketId(String signedTicketId) {
+        this.signedTicketId = signedTicketId;
+    }
+
+    @Override
+    public Class<?> getEntityType() {
+        return ImageTransfer.class;
+    }
+
+    @Override
+    public String getName() {
+        return null;
+    }
+
+    @Override
+    public long getDomainId() {
+        return domainId;
+    }
+
+    @Override
+    public long getAccountId() {
+        return accountId;
+    }
+
+    @Override
+    public long getDataCenterId() {
+        return dataCenterId;
+    }
+
+    public Date getCreated() {
+        return created;
+    }
+
+    public Date getUpdated() {
+        return updated;
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDao.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDao.java
new file mode 100644
index 000000000000..9a9fbeb8814e
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDao.java
@@ -0,0 +1,36 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup.dao;
+
+import java.util.List;
+
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.ImageTransferVO;
+
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.GenericDao;
+
+public interface ImageTransferDao extends GenericDao<ImageTransferVO, Long> {
+    List<ImageTransferVO> listByBackupId(Long backupId);
+    ImageTransferVO findByUuid(String uuid);
+    ImageTransferVO findByVolume(Long volumeId);
+    ImageTransferVO findUnfinishedByVolume(Long volumeId);
+    List<ImageTransferVO> listByPhaseAndDirection(ImageTransfer.Phase phase, ImageTransfer.Direction direction);
+    List<ImageTransferVO> listByZonesAndOwners(List<Long> zoneIds, List<Long> accountIds, List<Long> domainIds,
+                                               Filter filter);
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDaoImpl.java
new file mode 100644
index 000000000000..2e36f924e4ef
--- /dev/null
+++ b/engine/schema/src/main/java/org/apache/cloudstack/backup/dao/ImageTransferDaoImpl.java
@@ -0,0 +1,136 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup.dao;
+
+import java.util.Collections;
+import java.util.List;
+
+import javax.annotation.PostConstruct;
+
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.backup.ImageTransferVO;
+import org.apache.commons.collections.CollectionUtils;
+import org.springframework.stereotype.Component;
+
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.GenericDaoBase;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+
+@Component
+public class ImageTransferDaoImpl extends GenericDaoBase<ImageTransferVO, Long> implements ImageTransferDao {
+
+    private SearchBuilder<ImageTransferVO> backupIdSearch;
+    private SearchBuilder<ImageTransferVO> uuidSearch;
+    private SearchBuilder<ImageTransferVO> volumeSearch;
+    private SearchBuilder<ImageTransferVO> volumeUnfinishedSearch;
+    private SearchBuilder<ImageTransferVO> phaseDirectionSearch;
+
+    public ImageTransferDaoImpl() {
+    }
+
+    @PostConstruct
+    protected void init() {
+        backupIdSearch = createSearchBuilder();
+        backupIdSearch.and("backupId", backupIdSearch.entity().getBackupId(), SearchCriteria.Op.EQ);
+        backupIdSearch.done();
+
+        uuidSearch = createSearchBuilder();
+        uuidSearch.and("uuid", uuidSearch.entity().getUuid(), SearchCriteria.Op.EQ);
+        uuidSearch.done();
+
+        volumeSearch = createSearchBuilder();
+        volumeSearch.and("volumeId", volumeSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        volumeSearch.done();
+
+        volumeUnfinishedSearch = createSearchBuilder();
+        volumeUnfinishedSearch.and("volumeId", volumeUnfinishedSearch.entity().getVolumeId(), SearchCriteria.Op.EQ);
+        volumeUnfinishedSearch.and("phase", volumeUnfinishedSearch.entity().getPhase(), SearchCriteria.Op.NEQ);
+        volumeUnfinishedSearch.done();
+
+        phaseDirectionSearch = createSearchBuilder();
+        phaseDirectionSearch.and("phase", phaseDirectionSearch.entity().getPhase(), SearchCriteria.Op.EQ);
+        phaseDirectionSearch.and("direction", phaseDirectionSearch.entity().getDirection(), SearchCriteria.Op.EQ);
+        phaseDirectionSearch.done();
+    }
+
+    @Override
+    public List<ImageTransferVO> listByBackupId(Long backupId) {
+        SearchCriteria<ImageTransferVO> sc = backupIdSearch.create();
+        sc.setParameters("backupId", backupId);
+        return listBy(sc);
+    }
+
+    @Override
+    public ImageTransferVO findByUuid(String uuid) {
+        SearchCriteria<ImageTransferVO> sc = uuidSearch.create();
+        sc.setParameters("uuid", uuid);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public ImageTransferVO findByVolume(Long volumeId) {
+        SearchCriteria<ImageTransferVO> sc = volumeSearch.create();
+        sc.setParameters("volumeId", volumeId);
+        return findOneBy(sc);
+    }
+
+    @Override
+    public ImageTransferVO findUnfinishedByVolume(Long volumeId) {
+        SearchCriteria<ImageTransferVO> sc = volumeUnfinishedSearch.create();
+        sc.setParameters("volumeId", volumeId);
+        sc.setParameters("phase", ImageTransferVO.Phase.finished.toString());
+        return findOneBy(sc);
+    }
+
+    @Override
+    public List<ImageTransferVO> listByPhaseAndDirection(ImageTransfer.Phase phase, ImageTransfer.Direction direction) {
+        SearchCriteria<ImageTransferVO> sc = phaseDirectionSearch.create();
+        sc.setParameters("phase", phase);
+        sc.setParameters("direction", direction);
+        return listBy(sc);
+    }
+
+    @Override
+    public List<ImageTransferVO> listByZonesAndOwners(List<Long> zoneIds, List<Long> accountIds, List<Long> domainIds,
+                                                      Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<ImageTransferVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainIdsNotEmpty = CollectionUtils.isNotEmpty(domainIds);
+        if (accountIdsNotEmpty || domainIdsNotEmpty) {
+            sb.and().op("account", sb.entity().getAccountId(), SearchCriteria.Op.IN);
+            sb.or("domain", sb.entity().getDomainId(), SearchCriteria.Op.IN);
+            sb.cp();
+        }
+        sb.done();
+        final SearchCriteria<ImageTransferVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainIdsNotEmpty) {
+            sc.setParameters("domain", domainIds.toArray());
+        }
+
+        return listBy(sc, filter);
+    }
+}
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDao.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDao.java
index 4735202a7623..82ba9445b25c 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDao.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDao.java
@@ -29,4 +29,6 @@ public interface SharedFSDao extends GenericDao<SharedFSVO, Long>, StateDao<Shar
     List<SharedFSVO> listSharedFSToBeDestroyed(Date date);
 
     SharedFSVO findSharedFSByNameAccountDomain(String name, Long accountId, Long domainId);
+
+    SharedFSVO findByVm(long vmId);
 }
diff --git a/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDaoImpl.java b/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDaoImpl.java
index da6220716715..dd23787f982f 100644
--- a/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDaoImpl.java
+++ b/engine/schema/src/main/java/org/apache/cloudstack/storage/sharedfs/dao/SharedFSDaoImpl.java
@@ -114,4 +114,14 @@ public SharedFSVO findSharedFSByNameAccountDomain(String name, Long accountId, L
         sc.setParameters("domainId", domainId);
         return findOneBy(sc);
     }
+
+    @Override
+    public SharedFSVO findByVm(long vmId) {
+        SearchBuilder<SharedFSVO> sb = createSearchBuilder();
+        sb.and("vmId", sb.entity().getVmId(), SearchCriteria.Op.EQ);
+        sb.done();
+        SearchCriteria<SharedFSVO> sc = sb.create();
+        sc.setParameters("vmId", vmId);
+        return findOneBy(sc);
+    }
 }
diff --git a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
index ad3722577c27..26181d3fce0d 100644
--- a/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
+++ b/engine/schema/src/main/resources/META-INF/cloudstack/core/spring-engine-schema-core-daos-context.xml
@@ -116,6 +116,7 @@
   <bean id="loadBalancerVMMapDaoImpl" class="com.cloud.network.dao.LoadBalancerVMMapDaoImpl" />
   <bean id="loadBalancerCertMapDaoImpl" class="com.cloud.network.dao.LoadBalancerCertMapDaoImpl" />
   <bean id="managementServerHostDaoImpl" class="com.cloud.cluster.dao.ManagementServerHostDaoImpl" />
+  <bean id="managementServerHostDetailsDaoImpl" class="com.cloud.cluster.dao.ManagementServerHostDetailsDaoImpl" />
   <bean id="managementServerHostPeerDaoImpl" class="com.cloud.cluster.dao.ManagementServerHostPeerDaoImpl" />
   <bean id="managementServerHostPeerJoinDaoImpl" class="com.cloud.cluster.dao.ManagementServerHostPeerJoinDaoImpl" />
   <bean id="managementServerStatusDaoImpl" class="com.cloud.cluster.dao.ManagementServerStatusDaoImpl" />
@@ -271,6 +272,7 @@
   <bean id="backupDaoImpl" class="org.apache.cloudstack.backup.dao.BackupDaoImpl" />
   <bean id="backupDetailsDaoImpl" class="org.apache.cloudstack.backup.dao.BackupDetailsDaoImpl" />
   <bean id="backupRepositoryDaoImpl" class="org.apache.cloudstack.backup.dao.BackupRepositoryDaoImpl" />
+  <bean id="imageTransferDaoImpl" class="org.apache.cloudstack.backup.dao.ImageTransferDaoImpl" />
   <bean id="directDownloadCertificateDaoImpl" class="org.apache.cloudstack.direct.download.DirectDownloadCertificateDaoImpl" />
   <bean id="directDownloadCertificateHostMapDaoImpl" class="org.apache.cloudstack.direct.download.DirectDownloadCertificateHostMapDaoImpl" />
   <bean id="routerHealthCheckResultsDaoImpl" class="com.cloud.network.dao.RouterHealthCheckResultDaoImpl" />
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql b/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql
index 858c46a7c1ee..fbb2fd079f9c 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42100to42200.sql
@@ -19,7 +19,6 @@
 -- Schema upgrade from 4.21.0.0 to 4.22.0.0
 --;
 
-
 -- health check status as enum
 CALL `cloud`.`IDEMPOTENT_CHANGE_COLUMN`('router_health_check', 'check_result', 'check_result', 'varchar(16) NOT NULL COMMENT "check executions result: SUCCESS, FAILURE, WARNING, UNKNOWN"');
 
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
index dfa5fa8f3a14..478125335e70 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
@@ -149,3 +149,50 @@ SELECT 'Advanced', 'DEFAULT', 'CapacityManager', 'kvm.cpu.dynamic.scaling.capaci
 FROM `cloud`.`configuration` `cfg`
 WHERE NOT EXISTS (SELECT 1 FROM `cloud`.`configuration` WHERE `name` = 'kvm.cpu.dynamic.scaling.capacity')
   AND `cfg`.`name` = 'vm.serviceoffering.cpu.cores.max';
+
+-- Add management_server_details table to allow ManagementServer scope configs
+CREATE TABLE IF NOT EXISTS `management_server_details` (
+                                                           `id` bigint unsigned NOT NULL AUTO_INCREMENT COMMENT 'id',
+                                                           `management_server_id` bigint unsigned NOT NULL COMMENT 'management server the detail is related to',
+                                                           `name` varchar(255) NOT NULL COMMENT 'name of the detail',
+    `value` varchar(255) NOT NULL,
+    `display` tinyint(1) NOT NULL DEFAULT '1' COMMENT 'True if the detail can be displayed to the end user',
+    PRIMARY KEY (`id`),
+    CONSTRAINT `fk_management_server_details__management_server_id` FOREIGN KEY `fk_management_server_details__management_server_id`(`management_server_id`) REFERENCES `mshost`(`id`) ON DELETE CASCADE,
+    KEY `i_management_server_details__name__value` (`name`(128),`value`(128))
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+-- Add checkpoint tracking fields to backups table for incremental backup support
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'from_checkpoint_id', 'VARCHAR(255) DEFAULT NULL COMMENT "Previous active checkpoint id for incremental backups"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'to_checkpoint_id', 'VARCHAR(255) DEFAULT NULL COMMENT "New checkpoint id created for the next incremental backup"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'checkpoint_create_time', 'BIGINT DEFAULT NULL COMMENT "Checkpoint creation timestamp from libvirt"');
+CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.backups', 'host_id', 'BIGINT UNSIGNED DEFAULT NULL COMMENT "Host where backup is running"');
+
+-- Create image_transfer table for per-disk image transfers
+CREATE TABLE IF NOT EXISTS `cloud`.`image_transfer`(
+    `id` bigint unsigned NOT NULL auto_increment COMMENT 'id',
+    `uuid` varchar(40) NOT NULL COMMENT 'uuid',
+    `account_id` bigint unsigned NOT NULL COMMENT 'Account ID',
+    `domain_id` bigint unsigned NOT NULL COMMENT 'Domain ID',
+    `data_center_id` bigint unsigned NOT NULL COMMENT 'Data Center ID',
+    `backup_id` bigint unsigned COMMENT 'Backup ID',
+    `volume_id` bigint unsigned NOT NULL COMMENT 'Volume ID',
+    `host_id` bigint unsigned NOT NULL COMMENT 'Host ID',
+    `transfer_url` varchar(255) COMMENT 'ImageIO transfer URL',
+    `file` varchar(255) COMMENT 'File for the file backend',
+    `phase` varchar(20) NOT NULL COMMENT 'Transfer phase: initializing, transferring, finished, failed',
+    `socket` varchar(255) COMMENT 'Unix socket for nbd backend',
+    `direction` varchar(20) NOT NULL COMMENT 'Direction: upload, download',
+    `backend` varchar(20) NOT NULL COMMENT 'Backend: nbd, file',
+    `progress` int COMMENT 'Transfer progress percentage (0-100)',
+    `signed_ticket_id` varchar(255) COMMENT 'Signed ticket ID from ImageIO',
+    `created` datetime NOT NULL COMMENT 'date created',
+    `updated` datetime COMMENT 'date updated if not null',
+    `removed` datetime COMMENT 'date removed if not null',
+    PRIMARY KEY (`id`),
+    UNIQUE KEY `uuid` (`uuid`),
+    CONSTRAINT `fk_image_transfer__backup_id` FOREIGN KEY (`backup_id`) REFERENCES `backups`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_image_transfer__volume_id` FOREIGN KEY (`volume_id`) REFERENCES `volumes`(`id`) ON DELETE CASCADE,
+    CONSTRAINT `fk_image_transfer__host_id` FOREIGN KEY (`host_id`) REFERENCES `host`(`id`) ON DELETE CASCADE,
+    INDEX `i_image_transfer__backup_id`(`backup_id`)
+    ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
diff --git a/engine/schema/src/main/resources/META-INF/db/views/cloud.user_vm_view.sql b/engine/schema/src/main/resources/META-INF/db/views/cloud.user_vm_view.sql
index c169cbce2170..d77ba27689be 100644
--- a/engine/schema/src/main/resources/META-INF/db/views/cloud.user_vm_view.sql
+++ b/engine/schema/src/main/resources/META-INF/db/views/cloud.user_vm_view.sql
@@ -56,6 +56,7 @@ SELECT
     `vm_instance`.`display_vm` AS `display_vm`,
     `vm_instance`.`delete_protection` AS `delete_protection`,
     `guest_os`.`uuid` AS `guest_os_uuid`,
+    `guest_os`.`display_name` AS `guest_os_display_name`,
     `vm_instance`.`pod_id` AS `pod_id`,
     `host_pod_ref`.`uuid` AS `pod_uuid`,
     `vm_instance`.`private_ip_address` AS `private_ip_address`,
diff --git a/engine/schema/src/test/java/com/cloud/storage/dao/VolumeDaoImplTest.java b/engine/schema/src/test/java/com/cloud/storage/dao/VolumeDaoImplTest.java
index 9445efeb089c..6f153727ab76 100644
--- a/engine/schema/src/test/java/com/cloud/storage/dao/VolumeDaoImplTest.java
+++ b/engine/schema/src/test/java/com/cloud/storage/dao/VolumeDaoImplTest.java
@@ -41,6 +41,7 @@
 import org.mockito.Spy;
 import org.mockito.junit.MockitoJUnitRunner;
 
+import com.cloud.storage.Volume;
 import com.cloud.storage.VolumeVO;
 import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
@@ -113,6 +114,69 @@ public void testListPoolIdsByVolumeCount_without_cluster_details() throws SQLExc
         verify(preparedStatementMock, times(1)).executeQuery();
     }
 
+    @Test
+    public void findByInstanceAndNotState_queriesWithInstanceIdAndExcludedStates() {
+        SearchBuilder<VolumeVO> sb = Mockito.mock(SearchBuilder.class);
+        SearchCriteria<VolumeVO> sc = Mockito.mock(SearchCriteria.class);
+        Mockito.when(sb.create()).thenReturn(sc);
+        Mockito.doReturn(new ArrayList<>()).when(volumeDao).listBy(sc);
+        Mockito.when(volumeDao.createSearchBuilder()).thenReturn(sb);
+        VolumeVO mockedVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(sb.entity()).thenReturn(mockedVO);
+
+        volumeDao.findByInstanceAndNotStates(42L, Volume.State.Ready);
+
+        Mockito.verify(sc).setParameters("instanceId", 42L);
+        Mockito.verify(sc).setParameters("state", (Object[]) new Volume.State[]{Volume.State.Ready});
+    }
+
+    @Test
+    public void findByInstanceAndNotStates_withMultipleExcludedStates_passesAllStatesToCriteria() {
+        SearchBuilder<VolumeVO> sb = Mockito.mock(SearchBuilder.class);
+        SearchCriteria<VolumeVO> sc = Mockito.mock(SearchCriteria.class);
+        Mockito.when(sb.create()).thenReturn(sc);
+        Mockito.doReturn(new ArrayList<>()).when(volumeDao).listBy(sc);
+        Mockito.when(volumeDao.createSearchBuilder()).thenReturn(sb);
+        VolumeVO mockedVO = Mockito.mock(VolumeVO.class);
+        Mockito.when(sb.entity()).thenReturn(mockedVO);
+
+        volumeDao.findByInstanceAndNotStates(7L, Volume.State.Destroy, Volume.State.Expunged);
+
+        Mockito.verify(sc).setParameters("instanceId", 7L);
+        Mockito.verify(sc).setParameters("state",
+                (Object[]) new Volume.State[]{Volume.State.Destroy, Volume.State.Expunged});
+    }
+
+    @Test
+    public void findByInstanceAndNotStates_returnsResultFromDao() {
+        SearchBuilder<VolumeVO> sb = Mockito.mock(SearchBuilder.class);
+        SearchCriteria<VolumeVO> sc = Mockito.mock(SearchCriteria.class);
+        Mockito.when(sb.create()).thenReturn(sc);
+        VolumeVO vol = Mockito.mock(VolumeVO.class);
+        Mockito.doReturn(List.of(vol)).when(volumeDao).listBy(sc);
+        Mockito.when(volumeDao.createSearchBuilder()).thenReturn(sb);
+        Mockito.when(sb.entity()).thenReturn(Mockito.mock(VolumeVO.class));
+
+        List<VolumeVO> result = volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready);
+
+        Assert.assertEquals(1, result.size());
+        Assert.assertSame(vol, result.get(0));
+    }
+
+    @Test
+    public void findByInstanceAndNotStates_noMatchingVolumes_returnsEmptyList() {
+        SearchBuilder<VolumeVO> sb = Mockito.mock(SearchBuilder.class);
+        SearchCriteria<VolumeVO> sc = Mockito.mock(SearchCriteria.class);
+        Mockito.when(sb.create()).thenReturn(sc);
+        Mockito.doReturn(new ArrayList<>()).when(volumeDao).listBy(sc);
+        Mockito.when(volumeDao.createSearchBuilder()).thenReturn(sb);
+        Mockito.when(sb.entity()).thenReturn(Mockito.mock(VolumeVO.class));
+
+        List<VolumeVO> result = volumeDao.findByInstanceAndNotStates(99L, Volume.State.Ready);
+
+        Assert.assertTrue(result.isEmpty());
+    }
+
     @Test
     public void testSearchRemovedByVmsNoVms() {
         Assert.assertTrue(CollectionUtils.isEmpty(volumeDao.searchRemovedByVms(
@@ -141,5 +205,4 @@ public void testSearchRemovedByVms() {
                 Mockito.any(SearchCriteria.class), Mockito.any(Filter.class), Mockito.eq(null),
                 Mockito.eq(false));
     }
-
 }
diff --git a/engine/userdata/src/main/java/org/apache/cloudstack/userdata/UserDataManagerImpl.java b/engine/userdata/src/main/java/org/apache/cloudstack/userdata/UserDataManagerImpl.java
index 7c5692564c99..c9c48dbb179f 100644
--- a/engine/userdata/src/main/java/org/apache/cloudstack/userdata/UserDataManagerImpl.java
+++ b/engine/userdata/src/main/java/org/apache/cloudstack/userdata/UserDataManagerImpl.java
@@ -119,10 +119,10 @@ public String validateUserData(String userData, BaseCmd.HTTPMethod httpmethod) {
         byte[] decodedUserData = null;
 
         // If GET, use 4K. If POST, support up to 1M.
-        if (httpmethod.equals(BaseCmd.HTTPMethod.GET)) {
-            decodedUserData = validateAndDecodeByHTTPMethod(userData, MAX_HTTP_GET_LENGTH, BaseCmd.HTTPMethod.GET);
-        } else if (httpmethod.equals(BaseCmd.HTTPMethod.POST)) {
+        if (BaseCmd.HTTPMethod.POST.equals(httpmethod)) {
             decodedUserData = validateAndDecodeByHTTPMethod(userData, MAX_HTTP_POST_LENGTH, BaseCmd.HTTPMethod.POST);
+        } else {
+            decodedUserData = validateAndDecodeByHTTPMethod(userData, MAX_HTTP_GET_LENGTH, BaseCmd.HTTPMethod.GET);
         }
 
         // Re-encode so that the '=' paddings are added if necessary since 'isBase64' does not require it, but python does on the VR.
diff --git a/framework/cluster/pom.xml b/framework/cluster/pom.xml
index 2dd28e8e628f..75bcaf9a7ddf 100644
--- a/framework/cluster/pom.xml
+++ b/framework/cluster/pom.xml
@@ -48,6 +48,12 @@
             <artifactId>cloud-api</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-engine-schema</artifactId>
+            <version>${project.version}</version>
+            <scope>compile</scope>
+        </dependency>
     </dependencies>
 
 </project>
diff --git a/framework/cluster/src/main/java/com/cloud/cluster/ManagementServerHostDetailVO.java b/framework/cluster/src/main/java/com/cloud/cluster/ManagementServerHostDetailVO.java
new file mode 100644
index 000000000000..fcaa2a22e341
--- /dev/null
+++ b/framework/cluster/src/main/java/com/cloud/cluster/ManagementServerHostDetailVO.java
@@ -0,0 +1,87 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.cluster;
+
+import javax.persistence.Column;
+import javax.persistence.Entity;
+import javax.persistence.GeneratedValue;
+import javax.persistence.GenerationType;
+import javax.persistence.Id;
+import javax.persistence.Table;
+
+import org.apache.cloudstack.api.ResourceDetail;
+
+@Entity
+@Table(name = "management_server_details")
+public class ManagementServerHostDetailVO implements ResourceDetail {
+    @Id
+    @GeneratedValue(strategy = GenerationType.IDENTITY)
+    @Column(name = "id")
+    long id;
+
+    @Column(name = "management_server_id")
+    long resourceId;
+
+    @Column(name = "name")
+    String name;
+
+    @Column(name = "value")
+    String value;
+
+    @Column(name = "display")
+    private boolean display = true;
+
+    public ManagementServerHostDetailVO(long poolId, String name, String value, boolean display) {
+        this.resourceId = poolId;
+        this.name = name;
+        this.value = value;
+        this.display = display;
+    }
+
+    public ManagementServerHostDetailVO() {
+    }
+
+    @Override
+    public long getId() {
+        return id;
+    }
+
+    @Override
+    public long getResourceId() {
+        return resourceId;
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    public void setValue(String value) {
+        this.value = value;
+    }
+
+    @Override
+    public String getValue() {
+        return value;
+    }
+
+    @Override
+    public boolean isDisplay() {
+        return display;
+    }
+}
diff --git a/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDao.java b/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDao.java
new file mode 100644
index 000000000000..24fd60d21b3c
--- /dev/null
+++ b/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDao.java
@@ -0,0 +1,26 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.cluster.dao;
+
+import org.apache.cloudstack.resourcedetail.ResourceDetailsDao;
+
+import com.cloud.cluster.ManagementServerHostDetailVO;
+import com.cloud.utils.db.GenericDao;
+
+public interface ManagementServerHostDetailsDao extends GenericDao<ManagementServerHostDetailVO, Long>, ResourceDetailsDao<ManagementServerHostDetailVO> {
+}
diff --git a/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDaoImpl.java b/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDaoImpl.java
new file mode 100644
index 000000000000..5865bee0926b
--- /dev/null
+++ b/framework/cluster/src/main/java/com/cloud/cluster/dao/ManagementServerHostDetailsDaoImpl.java
@@ -0,0 +1,46 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package com.cloud.cluster.dao;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.ScopedConfigStorage;
+import org.apache.cloudstack.resourcedetail.ResourceDetailsDaoBase;
+
+import com.cloud.cluster.ManagementServerHostDetailVO;
+
+public class ManagementServerHostDetailsDaoImpl extends ResourceDetailsDaoBase<ManagementServerHostDetailVO> implements ManagementServerHostDetailsDao, ScopedConfigStorage {
+
+    public ManagementServerHostDetailsDaoImpl() {
+    }
+
+    @Override
+    public ConfigKey.Scope getScope() {
+        return ConfigKey.Scope.ManagementServer;
+    }
+
+    @Override
+    public String getConfigValue(long id, String key) {
+        ManagementServerHostDetailVO vo = findDetail(id, key);
+        return vo == null ? null : vo.getValue();
+    }
+
+    @Override
+    public void addDetail(long resourceId, String key, String value, boolean display) {
+        super.addDetail(new ManagementServerHostDetailVO(resourceId, key, value, display));
+    }
+}
diff --git a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDao.java b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDao.java
index 926280bfeade..c334e91feb84 100644
--- a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDao.java
+++ b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDao.java
@@ -68,4 +68,6 @@ public interface AsyncJobDao extends GenericDao<AsyncJobVO, Long> {
     // Returns the number of pending jobs for the given Management server msids.
     // NOTE: This is the msid and NOT the id
     long countPendingNonPseudoJobs(Long... msIds);
+
+    List<Long> listPendingJobIdsForAccount(long accountId);
 }
diff --git a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDaoImpl.java b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDaoImpl.java
index 81cc5d4f2a8c..d8385e9aecd1 100644
--- a/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDaoImpl.java
+++ b/framework/jobs/src/main/java/org/apache/cloudstack/framework/jobs/dao/AsyncJobDaoImpl.java
@@ -299,4 +299,14 @@ public long countPendingJobs(String havingInfo, String... cmds) {
         List<Long> results = customSearch(sc, null);
         return results.get(0);
     }
+
+    @Override
+    public List<Long> listPendingJobIdsForAccount(long accountId) {
+        GenericSearchBuilder<AsyncJobVO, Long> sb = createSearchBuilder(Long.class);
+        sb.and("accountId", sb.entity().getAccountId(), SearchCriteria.Op.EQ);
+        sb.selectFields(sb.entity().getId());
+        SearchCriteria<Long> sc = sb.create();
+        sc.setParameters("accountId", accountId);
+        return customSearch(sc, null);
+    }
 }
diff --git a/packaging/el8/cloud.spec b/packaging/el8/cloud.spec
index 13c0a36cb106..3ba2e4d5789e 100644
--- a/packaging/el8/cloud.spec
+++ b/packaging/el8/cloud.spec
@@ -127,6 +127,8 @@ Requires: rng-tools
 Requires: (libgcrypt > 1.8.3 or libgcrypt20)
 Requires: (selinux-tools if selinux-tools)
 Requires: sysstat
+Requires: python3-libnbd
+Requires: socat
 Provides: cloud-agent
 Group: System Environment/Libraries
 %description agent
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/ImageServerControlSocket.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/ImageServerControlSocket.java
new file mode 100644
index 000000000000..2e9852f7bc1e
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/ImageServerControlSocket.java
@@ -0,0 +1,123 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource;
+
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.utils.script.OutputInterpreter;
+import com.cloud.utils.script.Script;
+import com.google.gson.Gson;
+import com.google.gson.GsonBuilder;
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+
+/**
+ * Communicates with the cloudstack-image-server control socket via socat.
+ *
+ * Protocol: newline-delimited JSON over a Unix domain socket.
+ * Actions: register, unregister, status.
+ */
+public class ImageServerControlSocket {
+    private static final Logger LOGGER = LogManager.getLogger(ImageServerControlSocket.class);
+    static final String CONTROL_SOCKET_PATH = "/var/run/cloudstack/image-server.sock";
+    private static final Gson GSON = new GsonBuilder().create();
+
+    private ImageServerControlSocket() {
+    }
+
+    /**
+     * Send a JSON message to the image server control socket and return the
+     * parsed response, or null on communication failure.
+     */
+    static JsonObject sendMessage(Map<String, Object> message) {
+        String json = GSON.toJson(message);
+        Script script = new Script("/bin/bash", LOGGER);
+        script.add("-c");
+        script.add(String.format("echo '%s' | socat -t5 - UNIX-CONNECT:%s",
+                json.replace("'", "'\\''"), CONTROL_SOCKET_PATH));
+        OutputInterpreter.AllLinesParser parser = new OutputInterpreter.AllLinesParser();
+        String result = script.execute(parser);
+        if (result != null) {
+            LOGGER.error("Control socket communication failed: {}", result);
+            return null;
+        }
+        String output = parser.getLines();
+        if (output == null || output.trim().isEmpty()) {
+            LOGGER.error("Empty response from control socket");
+            return null;
+        }
+        try {
+            return JsonParser.parseString(output.trim()).getAsJsonObject();
+        } catch (Exception e) {
+            LOGGER.error("Failed to parse control socket response: {}", output, e);
+            return null;
+        }
+    }
+
+    /**
+     * Register a transfer config with the image server.
+     * @return true if the server accepted the registration.
+     */
+    public static boolean registerTransfer(String transferId, Map<String, Object> config) {
+        Map<String, Object> msg = new HashMap<>();
+        msg.put("action", "register");
+        msg.put("transfer_id", transferId);
+        msg.put("config", config);
+        JsonObject resp = sendMessage(msg);
+        if (resp == null) {
+            return false;
+        }
+        return "ok".equals(resp.has("status") ? resp.get("status").getAsString() : null);
+    }
+
+    /**
+     * Unregister a transfer from the image server.
+     * @return the number of remaining active transfers, or -1 on error.
+     */
+    public static int unregisterTransfer(String transferId) {
+        Map<String, Object> msg = new HashMap<>();
+        msg.put("action", "unregister");
+        msg.put("transfer_id", transferId);
+        JsonObject resp = sendMessage(msg);
+        if (resp == null) {
+            return -1;
+        }
+        if (!"ok".equals(resp.has("status") ? resp.get("status").getAsString() : null)) {
+            return -1;
+        }
+        return resp.has("active_transfers") ? resp.get("active_transfers").getAsInt() : -1;
+    }
+
+    /**
+     * Check whether the image server control socket is responsive.
+     * @return true if the server responded with status "ok".
+     */
+    public static boolean isReady() {
+        Map<String, Object> msg = new HashMap<>();
+        msg.put("action", "status");
+        JsonObject resp = sendMessage(msg);
+        if (resp == null) {
+            return false;
+        }
+        return "ok".equals(resp.has("status") ? resp.get("status").getAsString() : null);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
index 06b668b801d3..d0a162e0f6ff 100644
--- a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/LibvirtComputingResource.java
@@ -387,6 +387,9 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
 
     public static final String CHECKPOINT_DELETE_COMMAND = "virsh checkpoint-delete --domain %s --checkpointname %s  --metadata";
 
+    public static final int IMAGE_SERVER_DEFAULT_PORT = 54322;
+    public static final String IMAGE_SERVER_SYSTEMD_UNIT_NAME = "cloudstack-image-server";
+
     protected int qcow2DeltaMergeTimeout;
 
     private String modifyVlanPath;
@@ -400,6 +403,9 @@ public class LibvirtComputingResource extends ServerResourceBase implements Serv
     private String heartBeatPath;
     private String vmActivityCheckPath;
     private String nasBackupPath;
+    private String imageServerPath;
+    private boolean imageServerTlsEnabled = false;
+    private String imageServerListenAddress;
     private String securityGroupPath;
     private String ovsPvlanDhcpHostPath;
     private String ovsPvlanVmPath;
@@ -814,6 +820,18 @@ public String getNasBackupPath() {
         return nasBackupPath;
     }
 
+    public String getImageServerPath() {
+        return imageServerPath;
+    }
+
+    public boolean isImageServerTlsEnabled() {
+        return imageServerTlsEnabled;
+    }
+
+    public String getImageServerListenAddress() {
+        return imageServerListenAddress;
+    }
+
     public String getOvsPvlanDhcpHostPath() {
         return ovsPvlanDhcpHostPath;
     }
@@ -1077,6 +1095,9 @@ public boolean configure(final String name, final Map<String, Object> params) th
 
         cachePath = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.HOST_CACHE_LOCATION);
 
+        imageServerTlsEnabled = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.IMAGE_SERVER_TLS_ENABLED);
+        imageServerListenAddress = AgentPropertiesFileHandler.getPropertyValue(AgentProperties.IMAGE_SERVER_LISTEN_ADDRESS);
+
         params.put("domr.scripts.dir", domrScriptsDir);
 
         virtRouterResource = new VirtualRoutingResource(this);
@@ -1140,6 +1161,12 @@ public boolean configure(final String name, final Map<String, Object> params) th
             throw new ConfigurationException("Unable to find nasbackup.sh");
         }
 
+        String imageServerMain = Script.findScript(kvmScriptsDir, "imageserver/__main__.py");
+        if (imageServerMain == null) {
+            throw new ConfigurationException("Unable to find imageserver package");
+        }
+        imageServerPath = new File(imageServerMain).getParent();
+
         createTmplPath = Script.findScript(storageScriptsDir, "createtmplt.sh");
         if (createTmplPath == null) {
             throw new ConfigurationException("Unable to find the createtmplt.sh");
@@ -5349,6 +5376,24 @@ public void removeCheckpointsOnVm(String vmName, String volumeUuid, List<String>
         logger.debug("Removed all checkpoints of volume [{}] on VM [{}].", volumeUuid, vmName);
     }
 
+    public Map<String, String> getDiskPathLabelMap(String vmName) {
+        try {
+            Connect conn = LibvirtConnection.getConnectionByVmName(vmName);
+            List<DiskDef> disks = getDisks(conn, vmName);
+            Map<String, String> diskPathLabelMap = new HashMap<>();
+            for (DiskDef disk : disks) {
+                if (disk.getDeviceType() != DeviceType.DISK) {
+                    continue;
+                }
+                diskPathLabelMap.put(disk.getDiskPath(), disk.getDiskLabel());
+            }
+            return diskPathLabelMap;
+        } catch (LibvirtException e) {
+            logger.error("Failed to get disk path label map for VM [{}] due to: [{}].", vmName, e.getMessage(), e);
+            throw new CloudRuntimeException(e);
+        }
+    }
+
     public boolean recreateCheckpointsOnVm(List<VolumeObjectTO> volumes, String vmName, Connect conn) {
         logger.debug("Trying to recreate checkpoints on VM [{}] with volumes [{}].", vmName, volumes);
         try {
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapper.java
new file mode 100644
index 000000000000..7cf05da9b211
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapper.java
@@ -0,0 +1,178 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.File;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.backup.CreateImageTransferAnswer;
+import org.apache.cloudstack.backup.CreateImageTransferCommand;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.apache.cloudstack.storage.resource.IpTablesHelper;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.ImageServerControlSocket;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.StringUtils;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = CreateImageTransferCommand.class)
+public class LibvirtCreateImageTransferCommandWrapper extends CommandWrapper<CreateImageTransferCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    private static final String IMAGE_SERVER_TLS_CERT_FILE = "/etc/cloudstack/agent/cloud.crt";
+    private static final String IMAGE_SERVER_TLS_KEY_FILE = "/etc/cloudstack/agent/cloud.key";
+
+    private void resetService(String unitName) {
+        Script resetScript = new Script("/bin/bash", logger);
+        resetScript.add("-c");
+        resetScript.add(String.format("systemctl reset-failed %s || true", unitName));
+        resetScript.execute();
+    }
+
+    private static String shellQuote(String value) {
+        return "'" + value.replace("'", "'\\''") + "'";
+    }
+
+    private boolean startImageServerIfNotRunning(int imageServerPort, String listenAddress, LibvirtComputingResource resource) {
+        final String imageServerPackageDir = resource.getImageServerPath();
+        final String imageServerParentDir = new File(imageServerPackageDir).getParent();
+        final String imageServerModuleName = new File(imageServerPackageDir).getName();
+        final boolean tlsEnabled = resource.isImageServerTlsEnabled();
+        String unitName = resource.IMAGE_SERVER_SYSTEMD_UNIT_NAME;
+
+        Script checkScript = new Script("/bin/bash", logger);
+        checkScript.add("-c");
+        checkScript.add(String.format("systemctl is-active --quiet %s", unitName));
+        String checkResult = checkScript.execute();
+        if (checkResult == null && ImageServerControlSocket.isReady()) {
+            return true;
+        }
+
+        resetService(unitName);
+        if (checkResult != null) {
+            StringBuilder systemdRunCmd = new StringBuilder(String.format(
+                    "systemd-run --unit=%s --property=Restart=no --property=WorkingDirectory=%s /usr/bin/python3 -m %s --listen %s --port %d",
+                    unitName, shellQuote(imageServerParentDir), imageServerModuleName, shellQuote(listenAddress), imageServerPort));
+
+            if (tlsEnabled) {
+                systemdRunCmd.append(" --tls-enabled");
+                systemdRunCmd.append(" --tls-cert-file ").append(IMAGE_SERVER_TLS_CERT_FILE);
+                systemdRunCmd.append(" --tls-key-file ").append(IMAGE_SERVER_TLS_KEY_FILE);
+            }
+
+            Script startScript = new Script("/bin/bash", logger);
+            startScript.add("-c");
+            startScript.add(systemdRunCmd.toString());
+            String startResult = startScript.execute();
+
+            if (startResult != null) {
+                logger.error(String.format("Failed to start the Image server: %s", startResult));
+                return false;
+            }
+        }
+
+        int maxWaitSeconds = 10;
+        int pollIntervalMs = 1000;
+        int maxAttempts = (maxWaitSeconds * 1000) / pollIntervalMs;
+        boolean serverReady = false;
+
+        for (int attempt = 0; attempt < maxAttempts; attempt++) {
+            if (ImageServerControlSocket.isReady()) {
+                serverReady = true;
+                logger.info(String.format("Image server control socket is ready (attempt %d)", attempt + 1));
+                break;
+            }
+            try {
+                Thread.sleep(pollIntervalMs);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                return false;
+            }
+        }
+
+        if (!serverReady) {
+            logger.error(String.format("Image server control socket not ready within %d seconds", maxWaitSeconds));
+            return false;
+        }
+
+        String rule = String.format("-p tcp -m state --state NEW -m tcp --dport %d -j ACCEPT", imageServerPort);
+        IpTablesHelper.addConditionally(IpTablesHelper.INPUT_CHAIN, true, rule,
+                String.format("Error in opening up image server port %d", imageServerPort));
+
+        return true;
+    }
+
+    public Answer execute(CreateImageTransferCommand cmd, LibvirtComputingResource resource) {
+        final String transferId = cmd.getTransferId();
+        ImageTransfer.Backend backend = cmd.getBackend();
+
+        if (StringUtils.isBlank(transferId)) {
+            return new CreateImageTransferAnswer(cmd, false, "transferId is empty.");
+        }
+
+        final Map<String, Object> payload = new HashMap<>();
+        payload.put("backend", backend.toString());
+        payload.put("idle_timeout_seconds", cmd.getIdleTimeoutSeconds());
+
+        if (backend == ImageTransfer.Backend.file) {
+            final String filePath = cmd.getFile();
+            if (StringUtils.isBlank(filePath)) {
+                return new CreateImageTransferAnswer(cmd, false, "file path is empty for file backend.");
+            }
+            payload.put("file", filePath);
+        } else {
+            String socket = cmd.getSocket();
+            final String exportName = cmd.getExportName();
+            if (StringUtils.isBlank(socket)) {
+                return new CreateImageTransferAnswer(cmd, false, "Empty socket.");
+            }
+            if (StringUtils.isBlank(exportName)) {
+                return new CreateImageTransferAnswer(cmd, false, "exportName is empty.");
+            }
+            payload.put("socket", "/tmp/imagetransfer/" + socket + ".sock");
+            payload.put("export", exportName);
+            String checkpointId = cmd.getCheckpointId();
+            if (checkpointId != null) {
+                payload.put("export_bitmap", cmd.getCheckpointId());
+            }
+        }
+
+        final int imageServerPort = LibvirtComputingResource.IMAGE_SERVER_DEFAULT_PORT;
+        String listenAddress = resource.getImageServerListenAddress();
+        if (StringUtils.isBlank(listenAddress)) {
+            listenAddress = resource.getPrivateIp();
+        }
+        if (!startImageServerIfNotRunning(imageServerPort, listenAddress, resource)) {
+            return new CreateImageTransferAnswer(cmd, false, "Failed to start image server.");
+        }
+
+        if (!ImageServerControlSocket.registerTransfer(transferId, payload)) {
+            return new CreateImageTransferAnswer(cmd, false, "Failed to register transfer with image server.");
+        }
+
+        final String transferScheme = resource.isImageServerTlsEnabled() ? "https" : "http";
+        final String transferUrl = String.format("%s://%s:%d/images/%s", transferScheme, listenAddress, imageServerPort, transferId);
+        return new CreateImageTransferAnswer(cmd, true, "Image transfer prepared on KVM host.", transferId, transferUrl);
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapper.java
new file mode 100644
index 000000000000..ddb84ab29cb3
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapper.java
@@ -0,0 +1,79 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.Map;
+
+import org.apache.cloudstack.backup.DeleteVmCheckpointCommand;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = DeleteVmCheckpointCommand.class)
+public class LibvirtDeleteVmCheckpointCommandWrapper extends CommandWrapper<DeleteVmCheckpointCommand, Answer, LibvirtComputingResource> {
+
+    @Override
+    public Answer execute(DeleteVmCheckpointCommand cmd, LibvirtComputingResource resource) {
+        if (cmd.isStoppedVM()) {
+            return deleteBitmapsOnDisks(cmd);
+        }
+        return deleteDomainCheckpoint(cmd);
+    }
+
+    private Answer deleteDomainCheckpoint(DeleteVmCheckpointCommand cmd) {
+        String vmName = cmd.getVmName();
+        String checkpointId = cmd.getCheckpointId();
+        String virshCmd = String.format("virsh checkpoint-delete %s %s", vmName, checkpointId);
+        Script script = new Script("/bin/bash");
+        script.add("-c");
+        script.add(virshCmd);
+        String result = script.execute();
+        if (result != null) {
+            return new Answer(cmd, false, "Failed to delete checkpoint: " + result);
+        }
+        return new Answer(cmd, true, "Checkpoint deleted");
+    }
+
+    /**
+     * Stopped VM: persistent bitmaps on disk images ({@code qemu-img bitmap --remove}), matching {@link LibvirtStartBackupCommandWrapper} bitmap --add.
+     */
+    private Answer deleteBitmapsOnDisks(DeleteVmCheckpointCommand cmd) {
+        String checkpointId = cmd.getCheckpointId();
+        Map<String, String> diskPathUuidMap = cmd.getDiskPathUuidMap();
+        if (diskPathUuidMap == null || diskPathUuidMap.isEmpty()) {
+            return new Answer(cmd, false, "No disks provided for bitmap removal");
+        }
+        for (Map.Entry<String, String> entry : diskPathUuidMap.entrySet()) {
+            String diskPath = entry.getKey();
+            Script script = new Script("qemu-img");
+            script.add("bitmap");
+            script.add("--remove");
+            script.add(diskPath);
+            script.add(checkpointId);
+            String result = script.execute();
+            if (result != null) {
+                return new Answer(cmd, false,
+                        "Failed to remove bitmap " + checkpointId + " from disk " + diskPath + ": " + result);
+            }
+        }
+        return new Answer(cmd, true, "Checkpoint bitmap removed from disks");
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapper.java
new file mode 100644
index 000000000000..3d9f6563d5eb
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapper.java
@@ -0,0 +1,101 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.FinalizeImageTransferCommand;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.ImageServerControlSocket;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.StringUtils;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = FinalizeImageTransferCommand.class)
+public class LibvirtFinalizeImageTransferCommandWrapper extends CommandWrapper<FinalizeImageTransferCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+    private void resetService(String unitName) {
+        Script resetScript = new Script("/bin/bash", logger);
+        resetScript.add("-c");
+        resetScript.add(String.format("systemctl reset-failed %s || true", unitName));
+        resetScript.execute();
+    }
+
+    private boolean stopImageServer(int imageServerPort, LibvirtComputingResource resource) {
+        String unitName = resource.IMAGE_SERVER_SYSTEMD_UNIT_NAME;
+
+        Script checkScript = new Script("/bin/bash", logger);
+        checkScript.add("-c");
+        checkScript.add(String.format("systemctl is-active --quiet %s", unitName));
+        String checkResult = checkScript.execute();
+        if (checkResult != null) {
+            logger.info("Image server not running, resetting failed state");
+            resetService(unitName);
+            removeFirewallRule(imageServerPort);
+            return true;
+        }
+
+        Script stopScript = new Script("/bin/bash", logger);
+        stopScript.add("-c");
+        stopScript.add(String.format("systemctl stop %s", unitName));
+        stopScript.execute();
+        resetService(unitName);
+        logger.info("Image server {} stopped", unitName);
+
+        removeFirewallRule(imageServerPort);
+
+        return true;
+    }
+
+    private void removeFirewallRule(int port) {
+        String rule = String.format("-p tcp -m state --state NEW -m tcp --dport %d -j ACCEPT", port);
+        Script removeScript = new Script("/bin/bash", logger);
+        removeScript.add("-c");
+        removeScript.add(String.format("iptables -D INPUT %s || true", rule));
+        String result = removeScript.execute();
+        if (result != null && !result.isEmpty() && !result.contains("iptables: Bad rule")) {
+            logger.debug("Firewall rule removal result for port {}: {}", port, result);
+        } else {
+            logger.info("Firewall rule removed for port {} (or did not exist)", port);
+        }
+    }
+
+    public Answer execute(FinalizeImageTransferCommand cmd, LibvirtComputingResource resource) {
+        final String transferId = cmd.getTransferId();
+        final int imageServerPort = LibvirtComputingResource.IMAGE_SERVER_DEFAULT_PORT;
+        if (StringUtils.isBlank(transferId)) {
+            return new Answer(cmd, false, "transferId is empty.");
+        }
+
+        int activeTransfers = ImageServerControlSocket.unregisterTransfer(transferId);
+        if (activeTransfers < 0) {
+            logger.warn("Could not reach image server to unregister transfer {}; assuming server is down", transferId);
+            stopImageServer(imageServerPort, resource);
+            return new Answer(cmd, true, "Image transfer finalized (server unreachable, forced stop).");
+        }
+
+        if (activeTransfers == 0) {
+            stopImageServer(imageServerPort, resource);
+        }
+
+        return new Answer(cmd, true, "Image transfer finalized.");
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapper.java
new file mode 100644
index 000000000000..629fd179afb2
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapper.java
@@ -0,0 +1,300 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.File;
+import java.io.FileWriter;
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.Map;
+
+import org.apache.cloudstack.backup.StartBackupAnswer;
+import org.apache.cloudstack.backup.StartBackupCommand;
+import org.apache.cloudstack.utils.cryptsetup.KeyFile;
+import org.apache.cloudstack.utils.qemu.QemuCommand;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.json.JSONArray;
+import org.json.JSONObject;
+import org.libvirt.Domain;
+import org.libvirt.LibvirtException;
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.StringUtils;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = StartBackupCommand.class)
+public class LibvirtStartBackupCommandWrapper extends CommandWrapper<StartBackupCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    @Override
+    public Answer execute(StartBackupCommand cmd, LibvirtComputingResource resource) {
+        if (cmd.isStoppedVM()) {
+            return handleStoppedVmBackup(cmd, cmd.getToCheckpointId());
+        }
+        return handleRunningVmBackup(cmd, resource);
+    }
+
+    public Answer handleRunningVmBackup(StartBackupCommand cmd, LibvirtComputingResource resource) {
+        String vmName = cmd.getVmName();
+        String toCheckpointId = cmd.getToCheckpointId();
+        String fromCheckpointId = cmd.getFromCheckpointId();
+        Long fromCheckpointCreateTime = cmd.getFromCheckpointCreateTime();
+        String socket = cmd.getSocket();
+
+        try {
+            if (StringUtils.isNotBlank(fromCheckpointId)) {
+                Answer redefineAnswer = ensureFromCheckpointExists(cmd, fromCheckpointId, fromCheckpointCreateTime);
+                if (redefineAnswer != null) {
+                    return redefineAnswer;
+                }
+            }
+
+            File dir = new File("/tmp/imagetransfer");
+            if (!dir.exists()) {
+                dir.mkdirs();
+            }
+
+            // Create backup XML
+            String backupXml = createBackupXml(cmd, fromCheckpointId, socket, resource);
+            String checkpointXml = createCheckpointXml(toCheckpointId);
+
+            // Write XMLs to temp files
+            File backupXmlFile = File.createTempFile("backup-", ".xml");
+            File checkpointXmlFile = File.createTempFile("checkpoint-", ".xml");
+
+            try (FileWriter writer = new FileWriter(backupXmlFile)) {
+                writer.write(backupXml);
+            }
+            try (FileWriter writer = new FileWriter(checkpointXmlFile)) {
+                writer.write(checkpointXml);
+            }
+
+            // Execute virsh backup-begin
+            String backupCmd = String.format("virsh backup-begin %s %s --checkpointxml %s",
+                vmName, backupXmlFile.getAbsolutePath(), checkpointXmlFile.getAbsolutePath());
+
+            Script script = new Script("/bin/bash");
+            script.add("-c");
+            script.add(backupCmd);
+            String result = script.execute();
+
+            backupXmlFile.delete();
+            checkpointXmlFile.delete();
+
+            if (result != null) {
+                return new StartBackupAnswer(cmd, false, "Backup begin failed: " + result);
+            }
+
+            long checkpointCreateTime = getCheckpointCreateTime();
+            return new StartBackupAnswer(cmd, true, "Backup started successfully", checkpointCreateTime);
+
+        } catch (Exception e) {
+            return new StartBackupAnswer(cmd, false, "Error starting backup: " + e.getMessage());
+        }
+    }
+
+    private Answer ensureFromCheckpointExists(StartBackupCommand cmd, String fromCheckpointId, Long fromCheckpointCreateTime) {
+        String vmName = cmd.getVmName();
+        Script dumpScript = new Script("/bin/bash");
+        dumpScript.add("-c");
+        dumpScript.add(String.format("virsh checkpoint-dumpxml --domain %s --checkpointname %s --no-domain",
+            vmName, fromCheckpointId));
+        if (dumpScript.execute() == null) {
+            return null;
+        }
+        if (fromCheckpointCreateTime == null) {
+            return new StartBackupAnswer(cmd, false, "From checkpoint create time is null for checkpoint " + fromCheckpointId);
+        }
+
+        String redefineXml = createCheckpointXmlForRedefine(fromCheckpointId, fromCheckpointCreateTime);
+        File redefineFile;
+        try {
+            redefineFile = File.createTempFile("checkpoint-redefine-", ".xml");
+        } catch (Exception e) {
+            return new StartBackupAnswer(cmd, false, "Failed to create temp file for checkpoint redefine: " + e.getMessage());
+        }
+        try (FileWriter writer = new FileWriter(redefineFile)) {
+            writer.write(redefineXml);
+        } catch (Exception e) {
+            redefineFile.delete();
+            return new StartBackupAnswer(cmd, false, "Failed to write checkpoint redefine XML: " + e.getMessage());
+        }
+        String createCmd = String.format(LibvirtComputingResource.CHECKPOINT_CREATE_COMMAND, vmName, redefineFile.getAbsolutePath());
+        Script createScript = new Script("/bin/bash");
+        createScript.add("-c");
+        createScript.add(createCmd);
+        String result = createScript.execute();
+        redefineFile.delete();
+        if (result != null) {
+            return new StartBackupAnswer(cmd, false, "Failed to redefine from-checkpoint " + fromCheckpointId + ": " + result);
+        }
+        return null;
+    }
+
+    private String createCheckpointXmlForRedefine(String checkpointName, Long createTime) {
+        StringBuilder xml = new StringBuilder();
+        xml.append("<domaincheckpoint>\n");
+        xml.append("  <name>").append(checkpointName).append("</name>\n");
+        xml.append("  <creationTime>").append(createTime).append("</creationTime>\n");
+        xml.append("</domaincheckpoint>");
+        return xml.toString();
+    }
+
+    private String createBackupXml(StartBackupCommand cmd, String fromCheckpointId, String socket, LibvirtComputingResource resource) throws LibvirtException {
+        StringBuilder xml = new StringBuilder();
+        xml.append("<domainbackup mode=\"pull\">\n");
+
+        xml.append(String.format("  <server transport=\"unix\" socket=\"/tmp/imagetransfer/%s.sock\"/>\n", socket));
+
+        xml.append("  <disks>\n");
+
+        Map<String, String> diskPathUuidMap = cmd.getDiskPathUuidMap();
+        Map<String, String> diskPathLabelMap = resource.getDiskPathLabelMap(cmd.getVmName());
+        Map<String, Boolean> diskPathHasFromCheckpointMap = new HashMap<>();
+        if (StringUtils.isNotBlank(fromCheckpointId)) {
+            Domain vm = null;
+            try {
+                vm = resource.getDomain(resource.getLibvirtUtilitiesHelper().getConnection(), cmd.getVmName());
+                if (vm != null) {
+                    diskPathHasFromCheckpointMap = getVmDiskPathHasFromCheckpointMap(vm, fromCheckpointId);
+                } else {
+                    logger.warn("Failed to get domain for VM [{}] while evaluating export bitmap [{}]. Falling back to full Backup",
+                            cmd.getVmName(), fromCheckpointId);
+                }
+            } finally {
+                if (vm != null) {
+                   vm.free();
+                }
+            }
+        }
+
+        for (Map.Entry<String, String> entry : diskPathLabelMap.entrySet()) {
+            String diskPath = entry.getKey();
+            if (!diskPathUuidMap.containsKey(diskPath)) {
+                continue;
+            }
+            String diskName = entry.getValue();
+            String export = diskPathUuidMap.get(diskPath);
+            String scratchFile = "/var/tmp/scratch-" + export + ".qcow2";
+            xml.append("    <disk name=\"").append(diskName).append("\" type=\"file\" exportname=\"").append(export);
+            if (StringUtils.isNotBlank(fromCheckpointId) && Boolean.TRUE.equals(diskPathHasFromCheckpointMap.get(diskPath))) {
+                xml.append("\" backupmode=\"incremental\"")
+                        .append(" incremental=\"").append(fromCheckpointId)
+                        .append("\" exportbitmap=\"").append(fromCheckpointId);
+            }
+            xml.append("\">\n");
+            xml.append("      <scratch file=\"").append(scratchFile).append("\"/>\n");
+            xml.append("    </disk>\n");
+        }
+
+        xml.append("  </disks>\n");
+        xml.append("</domainbackup>");
+
+        return xml.toString();
+    }
+
+    private String createCheckpointXml(String checkpointId) {
+        return "<domaincheckpoint>\n" +
+               "  <name>" + checkpointId + "</name>\n" +
+               "</domaincheckpoint>";
+    }
+
+    private Answer handleStoppedVmBackup(StartBackupCommand cmd, String toCheckpointId) {
+        Map<String, String> diskPathUuidMap = cmd.getDiskPathUuidMap();
+        Map<String, byte[]> diskPathPassphraseMap = cmd.getDiskPathPassphraseMap();
+        for (Map.Entry<String, String> entry : diskPathUuidMap.entrySet()) {
+            String diskPath = entry.getKey();
+            Script script = new Script("qemu-img");
+            byte[] passphrase = diskPathPassphraseMap.get(diskPath);
+
+            script.add("bitmap");
+            script.add("--add");
+
+            if (passphrase != null && passphrase.length > 0) {
+                KeyFile srcKey;
+                try {
+                    srcKey = new KeyFile(passphrase);
+                } catch (IOException ex) {
+                    return new StartBackupAnswer(cmd, false, "Failed to create KeyFile while adding bitmap " + toCheckpointId + " to disk " + diskPath);
+                }
+                script.add("--object");
+                script.add(String.format("secret,id=sec0,file=%s", srcKey));
+                script.add("--image-opts");
+                script.add(String.format("driver=qcow2,file.driver=file,file.filename=%s,encrypt.key-secret=sec0", diskPath));
+            } else {
+                script.add(diskPath);
+            }
+
+            script.add(toCheckpointId);
+            String result = script.execute();
+            if (result != null) {
+                return new StartBackupAnswer(cmd, false,
+                    "Failed to add bitmap " + toCheckpointId + " to disk " + diskPath + ": " + result);
+            }
+        }
+        long checkpointCreateTime = getCheckpointCreateTime();
+        return new StartBackupAnswer(cmd, true, "Stopped VM backup: checkpoint bitmap added successfully",
+            checkpointCreateTime);
+    }
+
+    private long getCheckpointCreateTime() {
+        return System.currentTimeMillis() / 1000;
+    }
+
+    private Map<String, Boolean> getVmDiskPathHasFromCheckpointMap(Domain vm, String fromCheckpointId) throws LibvirtException {
+        Map<String, Boolean> diskPathHasFromCheckpointMap = new HashMap<>();
+        String queryBlock = vm.qemuMonitorCommand(QemuCommand.buildQemuCommand("query-block", null), 0);
+        JSONObject response = new JSONObject(queryBlock);
+        JSONArray blocks = response.optJSONArray("return");
+        if (blocks == null) {
+            logger.warn("Couldn't get bitmap information for the VM [{}]. Falling back to full Backup", vm.getName());
+            return diskPathHasFromCheckpointMap;
+        }
+        for (int i = 0; i < blocks.length(); i++) {
+            JSONObject block = blocks.getJSONObject(i);
+            JSONObject inserted = block.optJSONObject("inserted");
+            if (inserted == null) {
+                continue;
+            }
+            String file = inserted.optString("file");
+            if (StringUtils.isBlank(file)) {
+                continue;
+            }
+            JSONArray dirtyBitmaps = inserted.optJSONArray("dirty-bitmaps");
+            boolean hasFromCheckpointBitmap = false;
+            if (dirtyBitmaps != null) {
+                for (int j = 0; j < dirtyBitmaps.length(); j++) {
+                    JSONObject dirtyBitmap = dirtyBitmaps.optJSONObject(j);
+                    if (dirtyBitmap == null) {
+                        continue;
+                    }
+                    String bitmapName = dirtyBitmap.optString("name");
+                    if (fromCheckpointId.equals(bitmapName)) {
+                        hasFromCheckpointBitmap = true;
+                        break;
+                    }
+                }
+            }
+            diskPathHasFromCheckpointMap.put(file, hasFromCheckpointBitmap);
+        }
+        return diskPathHasFromCheckpointMap;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapper.java
new file mode 100644
index 000000000000..661344677640
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapper.java
@@ -0,0 +1,197 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.apache.cloudstack.backup.StartNBDServerAnswer;
+import org.apache.cloudstack.backup.StartNBDServerCommand;
+import org.apache.cloudstack.utils.cryptsetup.KeyFile;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.json.JSONArray;
+import org.json.JSONObject;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.StringUtils;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = StartNBDServerCommand.class)
+public class LibvirtStartNBDServerCommandWrapper extends CommandWrapper<StartNBDServerCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    private String createSystemdRunCmd(StartNBDServerCommand cmd, String unitName, String volumePath, String exportName, String socket) throws IOException {
+        String socketName = "/tmp/imagetransfer/" + socket + ".sock";
+
+        String bitmapArg = "";
+        if (StringUtils.isNotBlank(cmd.getFromCheckpointId())
+                && isBitmapPresentOnDisk(volumePath, cmd.getFromCheckpointId())) {
+            bitmapArg = "-B " + cmd.getFromCheckpointId();
+        }
+
+        byte[] passphrase = cmd.getPassphrase(); // may be null
+        String readOnlyArg = cmd.getDirection().equals("download") ? "--read-only" : "";
+        String imageArg = volumePath;
+        String secretArg = "";
+        if (passphrase != null && passphrase.length > 0) {
+            KeyFile srcKey = new KeyFile(passphrase);
+            secretArg = String.format("--object secret,id=sec0,file=%s", srcKey);
+            imageArg = String.format("--image-opts driver=qcow2,file.driver=file,file.filename=%s,encrypt.key-secret=sec0", volumePath);
+        }
+
+        // --persistent: Don't stop the service when the last client disconnects.
+        // --shared=NUM: Allow up to NUM clients to share the device (default 1), 0 for unlimited. Number of parallel connections is managed by the image server.
+        String systemdRunCmd = String.format(
+                "systemd-run --unit=%s --property=Restart=no qemu-nbd %s " +
+                        "--export-name %s --socket %s --persistent --shared=0 %s %s %s",
+                unitName,
+                secretArg,
+                exportName,
+                socketName,
+                bitmapArg,
+                readOnlyArg,
+                imageArg
+        );
+        return systemdRunCmd;
+    }
+
+    @Override
+    public Answer execute(StartNBDServerCommand cmd, LibvirtComputingResource resource) {
+        String volumePath = cmd.getVolumePath();
+        String socket = cmd.getSocket();
+        String exportName = cmd.getExportName();
+        String transferId = cmd.getTransferId();
+
+        if (StringUtils.isBlank(volumePath)) {
+            return new StartNBDServerAnswer(cmd, false, "Volume path is required for the nbd server");
+        }
+        if (StringUtils.isBlank(exportName)) {
+            return new StartNBDServerAnswer(cmd, false, "Export name is required for the nbd server");
+        }
+        if (StringUtils.isBlank(socket)) {
+            return new StartNBDServerAnswer(cmd, false, "Socket is required for the nbd server");
+        }
+
+        String unitName = "qemu-nbd-" + transferId.hashCode();
+
+        Script checkScript = new Script("/bin/bash", logger);
+        checkScript.add("-c");
+        checkScript.add(String.format("systemctl is-active --quiet %s", unitName));
+        String checkResult = checkScript.execute();
+        if (checkResult == null) {
+            return new StartNBDServerAnswer(cmd, false, "A qemu-nbd service is already running on the port.");
+        }
+
+        File dir = new File("/tmp/imagetransfer");
+        if (!dir.exists()) {
+            dir.mkdirs();
+        }
+
+        String systemdRunCmd = "";
+        try {
+            systemdRunCmd = createSystemdRunCmd(cmd, unitName, volumePath, exportName, socket);
+        } catch (IOException e) {
+            logger.error("Failed to create the KeyFile for qemu-nbd service", e);
+            return new StartNBDServerAnswer(cmd, false, "Failed to create systemd run command for qemu-nbd service: " + e.getMessage());
+        }
+
+        Script startScript = new Script("/bin/bash", logger);
+        startScript.add("-c");
+        startScript.add(systemdRunCmd);
+        String startResult = startScript.execute();
+
+        if (startResult != null) {
+            logger.error(String.format("Failed to start qemu-nbd service: %s", startResult));
+            return new StartNBDServerAnswer(cmd, false, "Failed to start qemu-nbd service: " + startResult);
+        }
+
+        // Wait with timeout until the service is up
+        int maxWaitSeconds = 20;
+        int pollIntervalMs = 5000;
+        int maxAttempts = (maxWaitSeconds * 1000) / pollIntervalMs;
+        boolean serviceActive = false;
+
+        for (int attempt = 0; attempt < maxAttempts; attempt++) {
+            try {
+                Thread.sleep(pollIntervalMs);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                return new StartNBDServerAnswer(cmd, false, "Interrupted while waiting for qemu-nbd service to start");
+            }
+            Script verifyScript = new Script("/bin/bash", logger);
+            verifyScript.add("-c");
+            verifyScript.add(String.format("systemctl is-active --quiet %s", unitName));
+            String verifyResult = verifyScript.execute();
+            if (verifyResult == null) {
+                serviceActive = true;
+                logger.info(String.format("qemu-nbd service %s is now active (attempt %d)", unitName, attempt + 1));
+                break;
+            }
+        }
+
+        if (!serviceActive) {
+            logger.error(String.format("qemu-nbd service %s failed to become active within %d seconds", unitName, maxWaitSeconds));
+            return new StartNBDServerAnswer(cmd, false,
+                    String.format("qemu-nbd service failed to start within %d seconds", maxWaitSeconds));
+        }
+
+        String transferUrl = String.format("nbd+unix:///%s", cmd.getSocket());
+        return new StartNBDServerAnswer(cmd, true, "qemu-nbd service started for upload",
+                    transferId, transferUrl);
+    }
+
+    private boolean isBitmapPresentOnDisk(String volumePath, String fromCheckpointId) {
+        String qemuImgInfo = Script.runBashScriptIgnoreExitValue(
+                String.format("qemu-img info --output=json %s", volumePath), 0);
+        if (StringUtils.isBlank(qemuImgInfo)) {
+            logger.warn("Unable to read qemu-img info output for disk path [{}].", volumePath);
+            return false;
+        }
+        try {
+            JSONObject info = new JSONObject(qemuImgInfo);
+            JSONObject formatSpecific = info.optJSONObject("format-specific");
+            if (formatSpecific == null) {
+                return false;
+            }
+            JSONObject formatData = formatSpecific.optJSONObject("data");
+            if (formatData == null) {
+                return false;
+            }
+            JSONArray bitmaps = formatData.optJSONArray("bitmaps");
+            if (bitmaps == null) {
+                return false;
+            }
+            for (int i = 0; i < bitmaps.length(); i++) {
+                JSONObject bitmap = bitmaps.optJSONObject(i);
+                if (bitmap == null) {
+                    continue;
+                }
+                if (fromCheckpointId.equals(bitmap.optString("name"))) {
+                    return true;
+                }
+            }
+        } catch (Exception e) {
+            logger.warn("Failed to parse qemu-img info output for disk path [{}].", volumePath, e);
+        }
+        return false;
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapper.java
new file mode 100644
index 000000000000..1185d89bc0b3
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapper.java
@@ -0,0 +1,69 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.StopBackupAnswer;
+import org.apache.cloudstack.backup.StopBackupCommand;
+import org.apache.logging.log4j.Logger;
+import org.apache.logging.log4j.LogManager;
+import org.libvirt.Connect;
+import org.libvirt.Domain;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtConnection;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = StopBackupCommand.class)
+public class LibvirtStopBackupCommandWrapper extends CommandWrapper<StopBackupCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    @Override
+    public Answer execute(StopBackupCommand cmd, LibvirtComputingResource resource) {
+        String vmName = cmd.getVmName();
+
+        try {
+            Connect conn = LibvirtConnection.getConnection();
+            Domain dm = conn.domainLookupByName(vmName);
+
+            if (dm == null) {
+                return new StopBackupAnswer(cmd, false, "Domain not found: " + vmName);
+            }
+
+            // Execute virsh domjobabort
+            String abortCmd = String.format("virsh domjobabort %s", vmName);
+
+            Script script = new Script("/bin/bash");
+            script.add("-c");
+            script.add(abortCmd);
+            String result = script.execute();
+
+            if (result != null && !result.isEmpty()) {
+                // Job abort may fail if no job is running, which is acceptable
+                logger.debug("domjobabort result: " + result);
+            }
+
+            return new StopBackupAnswer(cmd, true, "Backup stopped successfully");
+
+        } catch (Exception e) {
+            return new StopBackupAnswer(cmd, false, "Error stopping backup: " + e.getMessage());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopNBDServerCommandWrapper.java b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopNBDServerCommandWrapper.java
new file mode 100644
index 000000000000..57c7ebb706bc
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/main/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopNBDServerCommandWrapper.java
@@ -0,0 +1,72 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.StopNBDServerCommand;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.resource.CommandWrapper;
+import com.cloud.resource.ResourceWrapper;
+import com.cloud.utils.script.Script;
+
+@ResourceWrapper(handles = StopNBDServerCommand.class)
+public class LibvirtStopNBDServerCommandWrapper extends CommandWrapper<StopNBDServerCommand, Answer, LibvirtComputingResource> {
+    protected Logger logger = LogManager.getLogger(getClass());
+
+    private void resetService(String unitName) {
+        Script resetScript = new Script("/bin/bash", logger);
+        resetScript.add("-c");
+        resetScript.add(String.format("systemctl reset-failed %s || true", unitName));
+        resetScript.execute();
+    }
+
+    @Override
+    public Answer execute(StopNBDServerCommand cmd, LibvirtComputingResource resource) {
+        try {
+            String unitName = "qemu-nbd-" + cmd.getTransferId().hashCode();
+
+            // Check if the service is running
+            Script checkScript = new Script("/bin/bash", logger);
+            checkScript.add("-c");
+            checkScript.add(String.format("systemctl is-active --quiet %s", unitName));
+            String checkResult = checkScript.execute();
+            if (checkResult != null) {
+                // Service is not running, but still reset-failed to clear any stale state
+                logger.info(String.format("qemu-nbd service %s is not running, resetting failed state", unitName));
+                resetService(unitName);
+                return new Answer(cmd, true, "Image transfer finalized");
+            }
+
+            // Stop the systemd service
+            Script stopScript = new Script("/bin/bash", logger);
+            stopScript.add("-c");
+            stopScript.add(String.format("systemctl stop %s", unitName));
+            stopScript.execute();
+            resetService(unitName);
+
+            return new Answer(cmd, true, "Image transfer finalized");
+
+        } catch (Exception e) {
+            logger.error("Error finalizing image transfer for upload", e);
+            return new Answer(cmd, false, "Error finalizing image transfer: " + e.getMessage());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapperTest.java
new file mode 100644
index 000000000000..8782f592aed3
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtCreateImageTransferCommandWrapperTest.java
@@ -0,0 +1,121 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import static org.mockito.ArgumentMatchers.anyMap;
+import static org.mockito.ArgumentMatchers.eq;
+
+import org.apache.cloudstack.backup.CreateImageTransferAnswer;
+import org.apache.cloudstack.backup.CreateImageTransferCommand;
+import org.apache.cloudstack.backup.ImageTransfer;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.ImageServerControlSocket;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtCreateImageTransferCommandWrapperTest {
+
+    private LibvirtCreateImageTransferCommandWrapper wrapper;
+    private CreateImageTransferCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtCreateImageTransferCommandWrapper();
+        command = Mockito.mock(CreateImageTransferCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+    }
+
+    @Test
+    public void testExecuteBlankTransferIdReturnsFailure() {
+        Mockito.when(command.getTransferId()).thenReturn("");
+        Mockito.when(command.getBackend()).thenReturn(ImageTransfer.Backend.nbd);
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("transferId is empty.", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteNbdBackendSuccessReturnsUrl() {
+        Mockito.when(command.getTransferId()).thenReturn("tr-1");
+        Mockito.when(command.getBackend()).thenReturn(ImageTransfer.Backend.nbd);
+        Mockito.when(command.getIdleTimeoutSeconds()).thenReturn(120);
+        Mockito.when(command.getSocket()).thenReturn("sock-1");
+        Mockito.when(command.getExportName()).thenReturn("vol-1");
+        Mockito.when(command.getCheckpointId()).thenReturn("cp-1");
+
+        Mockito.when(resource.getImageServerPath()).thenReturn("/opt/cloudstack/image/server.py");
+        Mockito.when(resource.getImageServerListenAddress()).thenReturn("");
+        Mockito.when(resource.getPrivateIp()).thenReturn("10.0.0.10");
+        Mockito.when(resource.isImageServerTlsEnabled()).thenReturn(false);
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null));
+             MockedStatic<ImageServerControlSocket> imageServerControlMock = Mockito.mockStatic(ImageServerControlSocket.class)) {
+            imageServerControlMock.when(ImageServerControlSocket::isReady).thenReturn(true);
+            imageServerControlMock.when(() -> ImageServerControlSocket.registerTransfer(eq("tr-1"), anyMap())).thenReturn(true);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertTrue(answer instanceof CreateImageTransferAnswer);
+            CreateImageTransferAnswer transferAnswer = (CreateImageTransferAnswer) answer;
+            Assert.assertEquals("tr-1", transferAnswer.getImageTransferId());
+            Assert.assertEquals(
+                    "http://10.0.0.10:" + LibvirtComputingResource.IMAGE_SERVER_DEFAULT_PORT + "/images/tr-1",
+                    transferAnswer.getTransferUrl());
+        }
+    }
+
+    @Test
+    public void testExecuteRegisterTransferFailureReturnsFailure() {
+        Mockito.when(command.getTransferId()).thenReturn("tr-2");
+        Mockito.when(command.getBackend()).thenReturn(ImageTransfer.Backend.nbd);
+        Mockito.when(command.getIdleTimeoutSeconds()).thenReturn(120);
+        Mockito.when(command.getSocket()).thenReturn("sock-2");
+        Mockito.when(command.getExportName()).thenReturn("vol-2");
+        Mockito.when(command.getCheckpointId()).thenReturn(null);
+
+        Mockito.when(resource.getImageServerPath()).thenReturn("/opt/cloudstack/image/server.py");
+        Mockito.when(resource.getImageServerListenAddress()).thenReturn("192.168.10.10");
+        Mockito.when(resource.isImageServerTlsEnabled()).thenReturn(true);
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null));
+             MockedStatic<ImageServerControlSocket> imageServerControlMock = Mockito.mockStatic(ImageServerControlSocket.class)) {
+            imageServerControlMock.when(ImageServerControlSocket::isReady).thenReturn(true);
+            imageServerControlMock.when(() -> ImageServerControlSocket.registerTransfer(eq("tr-2"), anyMap())).thenReturn(false);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertEquals("Failed to register transfer with image server.", answer.getDetails());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapperTest.java
new file mode 100644
index 000000000000..769fdc9aa7b6
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtDeleteVmCheckpointCommandWrapperTest.java
@@ -0,0 +1,88 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.Collections;
+import java.util.Map;
+
+import org.apache.cloudstack.backup.DeleteVmCheckpointCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtDeleteVmCheckpointCommandWrapperTest {
+
+    private LibvirtDeleteVmCheckpointCommandWrapper wrapper;
+    private DeleteVmCheckpointCommand command;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtDeleteVmCheckpointCommandWrapper();
+        command = Mockito.mock(DeleteVmCheckpointCommand.class);
+    }
+
+    @Test
+    public void testExecuteStoppedVmWithoutDisksReturnsFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(true);
+        Mockito.when(command.getCheckpointId()).thenReturn("cp-1");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Collections.emptyMap());
+
+        Answer answer = wrapper.execute(command, Mockito.mock(LibvirtComputingResource.class));
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("No disks provided for bitmap removal", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteStoppedVmBitmapRemovalFailureReturnsFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(true);
+        Mockito.when(command.getCheckpointId()).thenReturn("cp-2");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn("bitmap remove error"))) {
+            Answer answer = wrapper.execute(command, Mockito.mock(LibvirtComputingResource.class));
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Failed to remove bitmap cp-2"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmDeleteCheckpointSuccess() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getCheckpointId()).thenReturn("cp-3");
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null))) {
+            Answer answer = wrapper.execute(command, Mockito.mock(LibvirtComputingResource.class));
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertEquals("Checkpoint deleted", answer.getDetails());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapperTest.java
new file mode 100644
index 000000000000..df6e21bdd6e1
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtFinalizeImageTransferCommandWrapperTest.java
@@ -0,0 +1,87 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.FinalizeImageTransferCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.ImageServerControlSocket;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtFinalizeImageTransferCommandWrapperTest {
+
+    private LibvirtFinalizeImageTransferCommandWrapper wrapper;
+    private FinalizeImageTransferCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtFinalizeImageTransferCommandWrapper();
+        command = Mockito.mock(FinalizeImageTransferCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+    }
+
+    @Test
+    public void testExecuteBlankTransferIdReturnsFailure() {
+        Mockito.when(command.getTransferId()).thenReturn("");
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("transferId is empty.", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteWithActiveTransfersReturnsSuccessWithoutStoppingServer() {
+        Mockito.when(command.getTransferId()).thenReturn("tr-1");
+
+        try (MockedStatic<ImageServerControlSocket> imageServerControlMock = Mockito.mockStatic(ImageServerControlSocket.class)) {
+            imageServerControlMock.when(() -> ImageServerControlSocket.unregisterTransfer("tr-1")).thenReturn(2);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertEquals("Image transfer finalized.", answer.getDetails());
+        }
+    }
+
+    @Test
+    public void testExecuteServerUnreachableReturnsSuccessAndForcesStop() {
+        Mockito.when(command.getTransferId()).thenReturn("tr-2");
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn("inactive"));
+             MockedStatic<ImageServerControlSocket> imageServerControlMock = Mockito.mockStatic(ImageServerControlSocket.class)) {
+            imageServerControlMock.when(() -> ImageServerControlSocket.unregisterTransfer("tr-2")).thenReturn(-1);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertEquals("Image transfer finalized (server unreachable, forced stop).", answer.getDetails());
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapperTest.java
new file mode 100644
index 000000000000..7932e90f47a0
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartBackupCommandWrapperTest.java
@@ -0,0 +1,182 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import java.util.Map;
+
+import org.apache.cloudstack.backup.StartBackupAnswer;
+import org.apache.cloudstack.backup.StartBackupCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtStartBackupCommandWrapperTest {
+
+    private LibvirtStartBackupCommandWrapper wrapper;
+    private StartBackupCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtStartBackupCommandWrapper();
+        command = Mockito.mock(StartBackupCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+    }
+
+    @Test
+    public void testExecuteStoppedVmBitmapAddSuccess() {
+        Mockito.when(command.isStoppedVM()).thenReturn(true);
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-stopped-1");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertTrue(answer instanceof StartBackupAnswer);
+            Assert.assertTrue(answer.getDetails().contains("checkpoint bitmap added successfully"));
+        }
+    }
+
+    @Test
+    public void testExecuteStoppedVmBitmapAddFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(true);
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-stopped-2");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn("bitmap add error"))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Failed to add bitmap cp-stopped-2"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmMissingFromCheckpointCreateTimeReturnsFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-1");
+        Mockito.when(command.getFromCheckpointId()).thenReturn("cp-running-0");
+        Mockito.when(command.getFromCheckpointCreateTime()).thenReturn(null);
+        Mockito.when(command.getSocket()).thenReturn("sock-1");
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn("not found"))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("From checkpoint create time is null"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmBackupBeginSuccess() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-2");
+        Mockito.when(command.getFromCheckpointId()).thenReturn(null);
+        Mockito.when(command.getSocket()).thenReturn("sock-2");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+        Mockito.when(resource.getDiskPathLabelMap("i-2-3-VM")).thenReturn(Map.of("/path/disk1.qcow2", "vda"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Backup started successfully"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmCheckpointRedefineFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-3");
+        Mockito.when(command.getFromCheckpointId()).thenReturn("cp-running-missing");
+        Mockito.when(command.getFromCheckpointCreateTime()).thenReturn(12345L);
+        Mockito.when(command.getSocket()).thenReturn("sock-3");
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            int constructionIndex = context.getCount();
+            if (constructionIndex == 1) {
+                Mockito.when(mock.execute()).thenReturn("checkpoint missing");
+            } else if (constructionIndex == 2) {
+                Mockito.when(mock.execute()).thenReturn("checkpoint redefine failed");
+            } else {
+                Mockito.when(mock.execute()).thenReturn(null);
+            }
+        })) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Failed to redefine from-checkpoint cp-running-missing"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmBackupBeginFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-4");
+        Mockito.when(command.getFromCheckpointId()).thenReturn(null);
+        Mockito.when(command.getSocket()).thenReturn("sock-4");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+        Mockito.when(resource.getDiskPathLabelMap("i-2-3-VM")).thenReturn(Map.of("/path/disk1.qcow2", "vda"));
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            if (context.getCount() == 1) {
+                Mockito.when(mock.execute()).thenReturn("backup begin failed");
+            } else {
+                Mockito.when(mock.execute()).thenReturn(null);
+            }
+        })) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Backup begin failed: backup begin failed"));
+        }
+    }
+
+    @Test
+    public void testExecuteRunningVmCreateBackupXmlExceptionReturnsFailure() {
+        Mockito.when(command.isStoppedVM()).thenReturn(false);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+        Mockito.when(command.getToCheckpointId()).thenReturn("cp-running-5");
+        Mockito.when(command.getFromCheckpointId()).thenReturn(null);
+        Mockito.when(command.getSocket()).thenReturn("sock-5");
+        Mockito.when(command.getDiskPathUuidMap()).thenReturn(Map.of("/path/disk1.qcow2", "vol-1"));
+        Mockito.when(resource.getDiskPathLabelMap("i-2-3-VM")).thenThrow(new RuntimeException("disk labels unavailable"));
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertTrue(answer.getDetails().contains("Error starting backup: disk labels unavailable"));
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapperTest.java
new file mode 100644
index 000000000000..7853a0d3efa6
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStartNBDServerCommandWrapperTest.java
@@ -0,0 +1,179 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.StartNBDServerAnswer;
+import org.apache.cloudstack.backup.StartNBDServerCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtStartNBDServerCommandWrapperTest {
+
+    private LibvirtStartNBDServerCommandWrapper wrapper;
+    private StartNBDServerCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtStartNBDServerCommandWrapper();
+        command = Mockito.mock(StartNBDServerCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+        Mockito.when(command.getVolumePath()).thenReturn("/path/disk.qcow2");
+        Mockito.when(command.getExportName()).thenReturn("vol-1");
+        Mockito.when(command.getSocket()).thenReturn("sock-1");
+        Mockito.when(command.getTransferId()).thenReturn("transfer-1");
+        Mockito.when(command.getDirection()).thenReturn("upload");
+        Mockito.when(command.getFromCheckpointId()).thenReturn(null);
+    }
+
+    @Test
+    public void testExecuteMissingVolumePathReturnsFailure() {
+        Mockito.when(command.getVolumePath()).thenReturn(null);
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("Volume path is required for the nbd server", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteMissingExportNameReturnsFailure() {
+        Mockito.when(command.getExportName()).thenReturn(" ");
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("Export name is required for the nbd server", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteMissingSocketReturnsFailure() {
+        Mockito.when(command.getSocket()).thenReturn("");
+
+        Answer answer = wrapper.execute(command, resource);
+
+        Assert.assertFalse(answer.getResult());
+        Assert.assertEquals("Socket is required for the nbd server", answer.getDetails());
+    }
+
+    @Test
+    public void testExecuteAlreadyActiveServiceReturnsFailure() {
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) ->
+                Mockito.when(mock.execute()).thenReturn(null))) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("already running"));
+        }
+    }
+
+    @Test
+    public void testExecuteStartScriptFailureReturnsFailure() {
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            if (context.getCount() == 1) {
+                Mockito.when(mock.execute()).thenReturn("inactive");
+            } else if (context.getCount() == 2) {
+                Mockito.when(mock.execute()).thenReturn("start failed");
+            } else {
+                Mockito.when(mock.execute()).thenReturn(null);
+            }
+        })) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Failed to start qemu-nbd service: start failed"));
+        }
+    }
+
+    @Test
+    public void testExecuteInterruptedWhileWaitingReturnsFailure() {
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            if (context.getCount() <= 2) {
+                Mockito.when(mock.execute()).thenReturn(context.getCount() == 1 ? "inactive" : null);
+            } else {
+                Mockito.when(mock.execute()).thenReturn("inactive");
+            }
+        })) {
+            Thread.currentThread().interrupt();
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Interrupted while waiting"));
+            Assert.assertTrue(Thread.currentThread().isInterrupted());
+            Thread.interrupted();
+        }
+    }
+
+    @Test
+    public void testExecuteSuccessReturnsTransferDetails() {
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class, (mock, context) -> {
+            if (context.getCount() == 1) {
+                Mockito.when(mock.execute()).thenReturn("inactive");
+            } else {
+                Mockito.when(mock.execute()).thenReturn(null);
+            }
+        })) {
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertTrue(answer instanceof StartNBDServerAnswer);
+            StartNBDServerAnswer startNBDServerAnswer = (StartNBDServerAnswer) answer;
+            Assert.assertEquals("transfer-1", startNBDServerAnswer.getImageTransferId());
+            Assert.assertEquals("nbd+unix:///sock-1", startNBDServerAnswer.getTransferUrl());
+        }
+    }
+
+    @Test
+    public void testExecuteAddsBitmapOptionWhenBitmapExists() {
+        Mockito.when(command.getFromCheckpointId()).thenReturn("cp-1");
+
+        try (MockedStatic<Script> scriptStaticMock = Mockito.mockStatic(Script.class);
+                MockedConstruction<Script> scriptConstruction = Mockito.mockConstruction(Script.class, (mock, context) -> {
+                    if (context.getCount() == 1) {
+                        Mockito.when(mock.execute()).thenReturn("inactive");
+                    } else {
+                        Mockito.when(mock.execute()).thenReturn(null);
+                    }
+                })) {
+            scriptStaticMock.when(() -> Script.runBashScriptIgnoreExitValue(
+                    Mockito.anyString(), Mockito.anyInt())).thenReturn(
+                    "{\"format-specific\":{\"data\":{\"bitmaps\":[{\"name\":\"cp-1\"}]}}}");
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Script startScript = scriptConstruction.constructed().get(1);
+            boolean bitmapOptionAdded = Mockito.mockingDetails(startScript).getInvocations().stream().anyMatch(invocation ->
+                    invocation.getMethod().getName().equals("add")
+                            && invocation.getArguments().length > 0
+                            && invocation.getArguments()[0] instanceof String
+                            && ((String) invocation.getArguments()[0]).contains("-B cp-1"));
+            Assert.assertTrue(bitmapOptionAdded);
+        }
+    }
+}
diff --git a/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapperTest.java b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapperTest.java
new file mode 100644
index 000000000000..33e5ccf55ba0
--- /dev/null
+++ b/plugins/hypervisors/kvm/src/test/java/com/cloud/hypervisor/kvm/resource/wrapper/LibvirtStopBackupCommandWrapperTest.java
@@ -0,0 +1,95 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.hypervisor.kvm.resource.wrapper;
+
+import org.apache.cloudstack.backup.StopBackupCommand;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.libvirt.Connect;
+import org.libvirt.Domain;
+import org.mockito.MockedConstruction;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.agent.api.Answer;
+import com.cloud.hypervisor.kvm.resource.LibvirtComputingResource;
+import com.cloud.hypervisor.kvm.resource.LibvirtConnection;
+import com.cloud.utils.script.Script;
+
+@RunWith(MockitoJUnitRunner.class)
+public class LibvirtStopBackupCommandWrapperTest {
+
+    private LibvirtStopBackupCommandWrapper wrapper;
+    private StopBackupCommand command;
+    private LibvirtComputingResource resource;
+
+    @Before
+    public void setUp() {
+        wrapper = new LibvirtStopBackupCommandWrapper();
+        command = Mockito.mock(StopBackupCommand.class);
+        resource = Mockito.mock(LibvirtComputingResource.class);
+        Mockito.when(command.getVmName()).thenReturn("i-2-3-VM");
+    }
+
+    @Test
+    public void testExecuteDomainNotFoundReturnsFailure() throws Exception {
+        Connect connect = Mockito.mock(Connect.class);
+
+        try (MockedStatic<LibvirtConnection> libvirtConnectionMock = Mockito.mockStatic(LibvirtConnection.class)) {
+            libvirtConnectionMock.when(LibvirtConnection::getConnection).thenReturn(connect);
+            Mockito.when(connect.domainLookupByName("i-2-3-VM")).thenReturn(null);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertEquals("Domain not found: i-2-3-VM", answer.getDetails());
+        }
+    }
+
+    @Test
+    public void testExecuteDomainFoundReturnsSuccess() throws Exception {
+        Connect connect = Mockito.mock(Connect.class);
+        Domain domain = Mockito.mock(Domain.class);
+
+        try (MockedConstruction<Script> ignored = Mockito.mockConstruction(Script.class,
+                (mock, context) -> Mockito.when(mock.execute()).thenReturn(null));
+             MockedStatic<LibvirtConnection> libvirtConnectionMock = Mockito.mockStatic(LibvirtConnection.class)) {
+            libvirtConnectionMock.when(LibvirtConnection::getConnection).thenReturn(connect);
+            Mockito.when(connect.domainLookupByName("i-2-3-VM")).thenReturn(domain);
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertTrue(answer.getResult());
+            Assert.assertEquals("Backup stopped successfully", answer.getDetails());
+        }
+    }
+
+    @Test
+    public void testExecuteLibvirtConnectionFailureReturnsFailure() {
+        try (MockedStatic<LibvirtConnection> libvirtConnectionMock = Mockito.mockStatic(LibvirtConnection.class)) {
+            libvirtConnectionMock.when(LibvirtConnection::getConnection).thenThrow(new RuntimeException("libvirt unavailable"));
+
+            Answer answer = wrapper.execute(command, resource);
+
+            Assert.assertFalse(answer.getResult());
+            Assert.assertTrue(answer.getDetails().contains("Error stopping backup: libvirt unavailable"));
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/pom.xml b/plugins/integrations/veeam-control-service/pom.xml
new file mode 100644
index 000000000000..ea9235c4b9a4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/pom.xml
@@ -0,0 +1,66 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <artifactId>cloud-plugin-integrations-veeam-control-service</artifactId>
+    <name>Apache CloudStack Plugin - Veeam Control Service</name>
+    <parent>
+        <groupId>org.apache.cloudstack</groupId>
+        <artifactId>cloudstack-plugins</artifactId>
+        <version>4.23.0.0-SNAPSHOT</version>
+        <relativePath>../../pom.xml</relativePath>
+    </parent>
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-utils</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-api</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.cloudstack</groupId>
+            <artifactId>cloud-engine-schema</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-server</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.eclipse.jetty</groupId>
+            <artifactId>jetty-servlet</artifactId>
+            <version>${cs.jetty.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-xml</artifactId>
+            <version>${cs.jackson.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.dataformat</groupId>
+            <artifactId>jackson-dataformat-yaml</artifactId>
+            <version>${cs.jackson.version}</version>
+        </dependency>
+    </dependencies>
+</project>
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/RouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/RouteHandler.java
new file mode 100644
index 000000000000..375222f47680
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/RouteHandler.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.utils.component.Adapter;
+
+public interface RouteHandler extends Adapter {
+    default int priority() { return 0; }
+    boolean canHandle(String method, String path) throws IOException;
+    void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io)
+            throws IOException;
+
+    default String getSanitizedPath(String path) {
+        // remove query params if exists
+        int qIdx = path.indexOf('?');
+        if (qIdx != -1) {
+            return path.substring(0, qIdx);
+        }
+        return path;
+    }
+
+    static String getRequestData(HttpServletRequest req, Logger logger) {
+        String data = RouteHandler.getRequestData(req);
+        if (VeeamControlService.DeveloperLogs.value()) {
+            logger.debug("Received method: {} request. Request-data: {}", req.getMethod(), data);
+        }
+        return data;
+    }
+
+    static String getRequestData(HttpServletRequest req) {
+        String contentType = req.getContentType();
+        if (contentType == null) {
+            return null;
+        }
+        String mime = contentType.split(";")[0].trim().toLowerCase();
+        if (!"application/json".equals(mime) && !"application/x-www-form-urlencoded".equals(mime)) {
+            return null;
+        }
+        try {
+            StringBuilder data = new StringBuilder();
+            String line;
+            try (BufferedReader reader = req.getReader()) {
+                while ((line = reader.readLine()) != null) {
+                    data.append(line);
+                }
+            }
+            return data.toString();
+        } catch (IOException ignored) {
+            return null;
+        }
+    }
+
+    static boolean isRequestAsync(HttpServletRequest req) {
+        String asyncStr = req.getParameter("async");
+        return Boolean.TRUE.toString().equals(asyncStr);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServer.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServer.java
new file mode 100644
index 000000000000..a3bf87dbaf99
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServer.java
@@ -0,0 +1,221 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import java.nio.file.Files;
+import java.nio.file.Paths;
+import java.util.ArrayList;
+import java.util.EnumSet;
+import java.util.Enumeration;
+import java.util.List;
+
+import javax.servlet.DispatcherType;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.utils.server.ServerPropertiesUtil;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.filter.AllowedClientCidrsFilter;
+import org.apache.cloudstack.veeam.filter.BearerOrBasicAuthFilter;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+import org.eclipse.jetty.server.Handler;
+import org.eclipse.jetty.server.HttpConfiguration;
+import org.eclipse.jetty.server.HttpConnectionFactory;
+import org.eclipse.jetty.server.RequestLog;
+import org.eclipse.jetty.server.SecureRequestCustomizer;
+import org.eclipse.jetty.server.Server;
+import org.eclipse.jetty.server.ServerConnector;
+import org.eclipse.jetty.server.SslConnectionFactory;
+import org.eclipse.jetty.server.handler.HandlerList;
+import org.eclipse.jetty.server.handler.RequestLogHandler;
+import org.eclipse.jetty.servlet.FilterHolder;
+import org.eclipse.jetty.servlet.ServletContextHandler;
+import org.eclipse.jetty.servlet.ServletHolder;
+import org.eclipse.jetty.util.ssl.SslContextFactory;
+import org.jetbrains.annotations.NotNull;
+
+public class VeeamControlServer {
+    private static final Logger LOGGER = LogManager.getLogger(VeeamControlServer.class);
+
+    private final VeeamControlService veeamControlService;
+    private Server server;
+    private List<RouteHandler> routeHandlers;
+
+    public VeeamControlServer(List<RouteHandler> routeHandlers, VeeamControlService veeamControlService) {
+        this.routeHandlers = new ArrayList<>(routeHandlers);
+        this.routeHandlers.sort((a, b) -> Integer.compare(b.priority(), a.priority()));
+        this.veeamControlService = veeamControlService;
+    }
+
+    public void startIfEnabled() throws Exception {
+        final boolean enabled = VeeamControlService.Enabled.value();
+        if (!enabled) {
+            LOGGER.info("Veeam Control API server is disabled");
+            return;
+        }
+
+        final String keystorePath = ServerPropertiesUtil.getKeystoreFile();
+        final String keystorePassword = ServerPropertiesUtil.getKeystorePassword();
+        final String keyManagerPassword = ServerPropertiesUtil.getKeystorePassword();
+        final boolean sslConfigured = StringUtils.isNotEmpty(keystorePath) &&
+                StringUtils.isNotEmpty(keystorePassword) &&
+                StringUtils.isNotEmpty(keyManagerPassword) &&
+                Files.exists(Paths.get(keystorePath));
+        long managementServerHostId = veeamControlService.getCurrentManagementServerHostId();
+        final String bindAddress = VeeamControlService.BindAddress.valueIn(managementServerHostId);
+        final String bindHost = StringUtils.trimToNull(bindAddress);
+        final int port = VeeamControlService.Port.value();
+        final String bindDisplay = bindHost == null ?
+                String.format("all interfaces, port: %d", port) :
+                String.format("host: %s, port: %d", bindHost, port);
+        String ctxPath = VeeamControlService.ContextPath.value();
+        LOGGER.info("Veeam Control server - {}, context: {} with {} handlers",
+                bindDisplay,
+                ctxPath,
+                routeHandlers != null ? routeHandlers.size() : 0);
+
+
+        server = new Server();
+
+        if (sslConfigured) {
+            final SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
+            sslContextFactory.setKeyStorePath(keystorePath);
+            sslContextFactory.setKeyStorePassword(keystorePassword);
+            sslContextFactory.setKeyManagerPassword(keyManagerPassword);
+
+            final HttpConfiguration https = new HttpConfiguration();
+            https.setSecureScheme("https");
+            https.setSecurePort(port);
+            https.addCustomizer(new SecureRequestCustomizer());
+
+            final ServerConnector httpsConnector = new ServerConnector(
+                    server,
+                    new SslConnectionFactory(sslContextFactory, "http/1.1"),
+                    new HttpConnectionFactory(https)
+            );
+            httpsConnector.setHost(bindHost);
+            httpsConnector.setPort(port);
+            server.addConnector(httpsConnector);
+
+            LOGGER.info("Veeam Control API server HTTPS enabled on {}", bindDisplay);
+        } else {
+            final HttpConfiguration http = new HttpConfiguration();
+            final ServerConnector httpConnector = new ServerConnector(server, new HttpConnectionFactory(http));
+            httpConnector.setHost(bindHost);
+            httpConnector.setPort(port);
+            server.addConnector(httpConnector);
+
+            LOGGER.warn("Veeam Control API server HTTPS is NOT configured (missing keystore path/passwords). " +
+                    "Starting HTTP on {} instead.", bindDisplay);
+        }
+
+        final ServletContextHandler ctx =
+                new ServletContextHandler(ServletContextHandler.NO_SESSIONS);
+        ctx.setContextPath(ctxPath);
+
+        // CIDR filter for all routes
+        AllowedClientCidrsFilter cidrFilter = new AllowedClientCidrsFilter(veeamControlService);
+        FilterHolder cidrHolder = new FilterHolder(cidrFilter);
+        ctx.addFilter(cidrHolder, ApiRouteHandler.BASE_ROUTE + "/*", EnumSet.of(DispatcherType.REQUEST));
+
+        // Bearer or Basic Auth for all routes
+        BearerOrBasicAuthFilter authFilter = new BearerOrBasicAuthFilter(veeamControlService);
+        FilterHolder authHolder = new FilterHolder(authFilter);
+        ctx.addFilter(authHolder, ApiRouteHandler.BASE_ROUTE + "/*", EnumSet.of(DispatcherType.REQUEST));
+
+        // Front controller servlet
+        ctx.addServlet(new ServletHolder(new VeeamControlServlet(routeHandlers)), "/*");
+
+        // Create a RequestLog that logs every request handled by the server (all contexts/paths)
+        server.setHandler(buildContextHandler(ctx));
+
+        server.start();
+
+        LOGGER.info("Started Veeam Control API server on {}:{} with context {}", bindDisplay, port, ctxPath);
+    }
+
+    @NotNull
+    private static Handler buildContextHandler(ServletContextHandler ctx) {
+        // Handler for root ('/') path
+        final ServletContextHandler root = new ServletContextHandler(ServletContextHandler.NO_SESSIONS);
+        root.setContextPath("/");
+        root.addServlet(new ServletHolder(new HttpServlet() {
+            private static final long serialVersionUID = 1L;
+
+            @Override
+            protected void doGet(HttpServletRequest req, HttpServletResponse resp)
+                    throws java.io.IOException {
+                resp.setContentType("text/plain");
+                resp.setStatus(HttpServletResponse.SC_OK);
+                resp.getWriter().println("Veeam Control API");
+            }
+
+            @Override
+            protected void doPost(HttpServletRequest req, HttpServletResponse resp)
+                    throws java.io.IOException {
+                doGet(req, resp);
+            }
+        }), "/*");
+
+        final RequestLog requestLog = (request, response) -> {
+            LOGGER.debug("Handled request - {}",
+                    () -> getRequestResponseMetadata(request, response));
+        };
+
+        final RequestLogHandler requestLogHandler = new RequestLogHandler();
+        requestLogHandler.setRequestLog(requestLog);
+
+        // Attach both the configured context and the root handler; keep ctx first so contextPath has priority
+        final HandlerList handlers = new HandlerList();
+        handlers.setHandlers(new Handler[] { ctx, root });
+        requestLogHandler.setHandler(handlers);
+        return requestLogHandler;
+    }
+
+    public void stop() throws Exception {
+    if (server != null) {
+            server.stop();
+            server = null;
+        }
+    }
+
+    private static String getRequestResponseMetadata(HttpServletRequest request, HttpServletResponse response) {
+        final StringBuilder sb = new StringBuilder();
+        sb.append("remote address: ").append(request.getRemoteAddr()).append(", ");
+        sb.append("method: ").append(request.getMethod()).append(", ");
+        sb.append("uri: ").append(request.getRequestURI())
+                .append(request.getQueryString() != null ? "?" + request.getQueryString() : "").append(", ");
+        if (VeeamControlService.DeveloperLogs.value()) {
+            sb.append("headers: [");
+            final Enumeration<String> headerNames = request.getHeaderNames();
+            while (headerNames.hasMoreElements()) {
+                final String name = headerNames.nextElement();
+                final Enumeration<String> values = request.getHeaders(name);
+                while (values.hasMoreElements()) {
+                    sb.append(name).append("=").append(values.nextElement()).append("; ");
+                }
+            }
+            sb.append("], ");
+        }
+        sb.append("status: ").append(response.getStatus());
+        return sb.toString();
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlService.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlService.java
new file mode 100644
index 000000000000..9255ab34aed2
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlService.java
@@ -0,0 +1,89 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import java.util.List;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.cloudstack.utils.CloudStackVersion;
+
+import com.cloud.utils.component.PluggableService;
+
+public interface VeeamControlService extends PluggableService, Configurable {
+    String PLUGIN_NAME = "CloudStack Veeam Control Service";
+
+    ConfigKey<Boolean> Enabled = new ConfigKey<>("Advanced", Boolean.class, "integration.veeam.control.enabled",
+            "false", "Enable the Veeam Integration REST API server", false);
+    ConfigKey<String> BindAddress = new ConfigKey<>("Advanced", String.class, "integration.veeam.control.bind.address",
+            "", "Bind address for Veeam Integration REST API server", false,
+            ConfigKey.Scope.ManagementServer);
+    ConfigKey<Integer> Port = new ConfigKey<>("Advanced", Integer.class, "integration.veeam.control.port",
+            "8090", "Port for Veeam Integration REST API server", false);
+    ConfigKey<String> ContextPath = new ConfigKey<>("Advanced", String.class, "integration.veeam.control.context.path",
+            "/ovirt-engine", "Context path for Veeam Integration REST API server", false);
+    ConfigKey<String> Username = new ConfigKey<>("Secure", String.class, "integration.veeam.control.api.username",
+            "veeam", "Username for Basic Auth on Veeam Integration REST API server", true);
+    ConfigKey<String> Password = new ConfigKey<>("Secure", String.class, "integration.veeam.control.api.password",
+            "change-me", "Password for Basic Auth on Veeam Integration REST API server", true);
+    ConfigKey<String> ServiceAccountId = new ConfigKey<>("Advanced", String.class,
+            "integration.veeam.control.service.account", "",
+            "ID of the service account that the Veeam Control Service uses to perform operations on " +
+                    "resources.This account should be a Root-Admin.",
+            true);
+    ConfigKey<Boolean> InstanceRestoreAssignOwner = new ConfigKey<>("Advanced", Boolean.class,
+            "integration.veeam.control.instance.restore.assign.owner",
+            "false", "Attempt to assign restored Instance to the owner based on OVF and network " +
+            "details. If the assignment fails or set to false then the Instance will remain owned by the service " +
+            "account", true);
+    ConfigKey<Boolean> InstanceEncryptVolumes = new ConfigKey<>("Advanced", Boolean.class,
+            "integration.veeam.control.instance.encrypt.volumes",
+            "false", "Whether to always use offerings with encryption enabled when creating volumes " +
+            "and Instances. If false, offerings will be selected without explicitly considering encryption based on " +
+            "backup metadata, availability and order.", true, ConfigKey.Scope.Zone);
+    ConfigKey<String> AllowedClientCidrs = new ConfigKey<>("Advanced", String.class,
+            "integration.veeam.control.allowed.client.cidrs",
+            "", "Comma-separated list of CIDR blocks representing clients allowed to access the API. " +
+                    "If empty, all clients will be allowed. Example: '192.168.1.1/24,192.168.2.100/32", true);
+
+    ConfigKey<Boolean> DeveloperLogs = new ConfigKey<>("Developer", Boolean.class, "integration.veeam.control.developer.logs",
+            "false", "Enable verbose logging for development and troubleshooting purposes. " +
+            "Logs will include detailed information about API requests, responses, and internal operations.", false);
+
+    long getCurrentManagementServerHostId();
+
+    List<String> getAllowedClientCidrs();
+
+    String getInstanceId();
+
+    boolean validateCredentials(String username, String password);
+
+    String getHmacSecret();
+
+    static String getPackageVersion() {
+        return VeeamControlService.class.getPackage().getImplementationVersion();
+    }
+
+    static CloudStackVersion getCSVersion() {
+        try {
+            return CloudStackVersion.parse(getPackageVersion());
+        } catch (Exception e) {
+            return null;
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServiceImpl.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServiceImpl.java
new file mode 100644
index 000000000000..3ad5d2390978
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServiceImpl.java
@@ -0,0 +1,157 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.utils.cache.SingleCache;
+import org.apache.cloudstack.utils.identity.ManagementServerNode;
+import org.apache.cloudstack.veeam.utils.DataUtil;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.cluster.ManagementServerHostVO;
+import com.cloud.cluster.dao.ManagementServerHostDao;
+import com.cloud.user.AccountService;
+import com.cloud.utils.UuidUtils;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.net.NetUtils;
+
+public class VeeamControlServiceImpl extends ManagerBase implements VeeamControlService {
+
+    @Inject
+    ManagementServerHostDao managementServerHostDao;
+
+    @Inject
+    AccountService accountService;
+
+    private List<RouteHandler> routeHandlers;
+    private VeeamControlServer veeamControlServer;
+    private SingleCache<List<String>> allowedClientCidrsCache;
+
+    protected List<String> getAllowedClientCidrsInternal() {
+        String allowedClientCidrsStr = AllowedClientCidrs.value();
+        if (StringUtils.isBlank(allowedClientCidrsStr)) {
+            return Collections.emptyList();
+        }
+        List<String> allowedClientCidrs = List.of(allowedClientCidrsStr.split(","));
+        // Sanitize and remove any incorrect CIDR entries
+        allowedClientCidrs = allowedClientCidrs.stream()
+                .map(String::trim)
+                .filter(StringUtils::isNotBlank)
+                .filter(cidr -> {
+                    boolean valid = NetUtils.isValidIp4Cidr(cidr);
+                    if (!valid) {
+                        logger.warn("Invalid CIDR entry '{}' in allowed client CIDRs, ignoring", cidr);
+                    }
+                    return valid;
+                }).collect(Collectors.toList());
+        return allowedClientCidrs;
+    }
+
+    public List<RouteHandler> getRouteHandlers() {
+        return routeHandlers;
+    }
+
+    public void setRouteHandlers(final List<RouteHandler> routeHandlers) {
+        this.routeHandlers = routeHandlers;
+    }
+
+    @Override
+    public long getCurrentManagementServerHostId() {
+        ManagementServerHostVO hostVO =
+                managementServerHostDao.findByMsid(ManagementServerNode.getManagementServerId());
+        return hostVO.getId();
+    }
+
+    @Override
+    public List<String> getAllowedClientCidrs() {
+        return allowedClientCidrsCache.get();
+    }
+
+    @Override
+    public String getInstanceId() {
+        return accountService.getSystemAccount().getUuid();
+    }
+
+    @Override
+    public boolean validateCredentials(String username, String password) {
+        return DataUtil.constantTimeEquals(Username.value(), username) &&
+                DataUtil.constantTimeEquals(Password.value(), password);
+    }
+
+    @Override
+    public String getHmacSecret() {
+        String base = getInstanceId() + ":" + Port.value() + ":" + Username.value() + Password.value();
+        return UuidUtils.nameUUIDFromBytes(base.getBytes(StandardCharsets.UTF_8)).toString();
+    }
+
+    @Override
+    public boolean start() {
+        allowedClientCidrsCache = new SingleCache<>(30, this::getAllowedClientCidrsInternal);
+        veeamControlServer = new VeeamControlServer(getRouteHandlers(), this);
+        try {
+            veeamControlServer.startIfEnabled();
+        } catch (Exception e) {
+            logger.error("Failed to start Veeam Control API server, continuing without it", e);
+        }
+        return true;
+    }
+
+    @Override
+    public boolean stop() {
+        try {
+            veeamControlServer.stop();
+        } catch (Exception e) {
+            logger.error("Failed to stop Veeam Control API server cleanly", e);
+        }
+        return true;
+    }
+
+    @Override
+    public List<Class<?>> getCommands() {
+        return List.of();
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return VeeamControlService.class.getSimpleName();
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey[] {
+                Enabled,
+                BindAddress,
+                Port,
+                ContextPath,
+                Username,
+                Password,
+                ServiceAccountId,
+                InstanceRestoreAssignOwner,
+                InstanceEncryptVolumes,
+                AllowedClientCidrs,
+                DeveloperLogs
+        };
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServlet.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServlet.java
new file mode 100644
index 000000000000..493fb00ebe7e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/VeeamControlServlet.java
@@ -0,0 +1,161 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+
+import java.io.IOException;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServlet;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.ResponseWriter;
+import org.apache.commons.collections4.CollectionUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+public class VeeamControlServlet extends HttpServlet {
+    private static final Logger LOGGER = LogManager.getLogger(VeeamControlServlet.class);
+    private static final boolean LOG_REQUESTS = false;
+
+    private final ResponseWriter writer;
+    private final Mapper mapper;
+    private final List<RouteHandler> routeHandlers;
+
+    public VeeamControlServlet(List<RouteHandler> routeHandlers) {
+        this.routeHandlers = routeHandlers;
+        mapper = new Mapper();
+        writer = new ResponseWriter(mapper);
+    }
+
+    public ResponseWriter getWriter() {
+        return writer;
+    }
+
+    public Mapper getMapper() {
+        return mapper;
+    }
+
+    @Override
+    protected void service(HttpServletRequest req, HttpServletResponse resp) throws IOException, ServletException {
+        String method = req.getMethod();
+        String path = normalize(req);
+        Negotiation.OutFormat outFormat = Negotiation.responseFormat(req);
+
+        LOGGER.info("Received {} request for {} with out format: {}", method, path, outFormat);
+
+        logRequest(req, method, path);
+
+        try {
+            if ("/".equals(path)) {
+                handleRoot(req, resp, outFormat);
+                return;
+            }
+
+            if (CollectionUtils.isNotEmpty(this.routeHandlers)) {
+                for (RouteHandler handler : this.routeHandlers) {
+                    if (handler.canHandle(method, path)) {
+                        handler.handle(req, resp, path, outFormat, this);
+                        return;
+                    }
+                }
+            }
+            notFound(resp, null, outFormat);
+        } catch (Error e) {
+            writer.writeFault(resp, e.status, e.message, null, outFormat);
+        }
+    }
+
+    private static void logRequest(HttpServletRequest req, String method, String path) {
+        if (!LOG_REQUESTS) {
+            return;
+        }
+        // Add a log to give all info about the request
+        try {
+            StringBuilder details = new StringBuilder();
+            details.append("Request details: Method: ").append(method).append(", Path: ").append(path);
+            details.append(", Query: ").append(req.getQueryString() == null ? "" : req.getQueryString());
+            details.append(", Headers: ");
+            java.util.Enumeration<String> headerNames = req.getHeaderNames();
+            while (headerNames != null && headerNames.hasMoreElements()) {
+                String name = headerNames.nextElement();
+                details.append(name).append("=").append(req.getHeader(name)).append("; ");
+            }
+            LOGGER.debug(details.toString());
+        } catch (Exception e) {
+            LOGGER.debug("Failed to capture request details", e);
+        }
+    }
+
+    private String normalize(HttpServletRequest req) {
+        String path = req.getPathInfo();
+        if (path == null || path.isBlank()) {
+            path = req.getRequestURI();
+        }
+        if (path == null || path.isBlank()) {
+            return "/";
+        }
+        return path;
+    }
+
+    protected void handleRoot(HttpServletRequest req, HttpServletResponse resp, Negotiation.OutFormat outFormat)
+            throws IOException {
+
+        String method = req.getMethod();
+        if (!"GET".equals(method) && !"POST".equals(method)) {
+            throw Error.badRequest("Unsupported method for root: " + method);
+        }
+        Map<String, String> responseData = new HashMap<>();
+        responseData.put("name", VeeamControlService.PLUGIN_NAME);
+        responseData.put("pluginVersion", this.getClass().getPackage().getImplementationVersion());
+
+        writer.write(resp, 200, responseData, outFormat);
+    }
+
+    public void methodNotAllowed(final HttpServletResponse resp, final String allow, final Negotiation.OutFormat outFormat) throws IOException {
+        resp.setHeader("Allow", allow);
+        writer.writeFault(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED, "Method Not Allowed", "Allowed methods: " + allow, outFormat);
+    }
+
+    public void badRequest(final HttpServletResponse resp, String detail, Negotiation.OutFormat outFormat) throws IOException {
+        writer.writeFault(resp, HttpServletResponse.SC_BAD_REQUEST, "Bad request", detail, outFormat);
+    }
+
+
+    public void notFound(final HttpServletResponse resp, String detail, Negotiation.OutFormat outFormat) throws IOException {
+        writer.writeFault(resp, HttpServletResponse.SC_NOT_FOUND, "Not found", detail, outFormat);
+    }
+
+    public static class Error extends RuntimeException {
+        final int status;
+        final String message;
+        public Error(int status, String message) {
+            super(message);
+            this.status = status;
+            this.message = message;
+        }
+        public static Error badRequest(String msg) { return new Error(400, msg); }
+        public static Error unauthorized(String msg) { return new Error(401, msg); }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccess.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccess.java
new file mode 100644
index 000000000000..4bb6de06e47e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccess.java
@@ -0,0 +1,31 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import java.lang.annotation.ElementType;
+import java.lang.annotation.Retention;
+import java.lang.annotation.RetentionPolicy;
+import java.lang.annotation.Target;
+
+import org.apache.cloudstack.api.BaseCmd;
+
+@Retention(RetentionPolicy.RUNTIME)
+@Target(ElementType.METHOD)
+public @interface ApiAccess {
+    Class<? extends BaseCmd> command();
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptor.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptor.java
new file mode 100644
index 000000000000..b0cd0cd33781
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptor.java
@@ -0,0 +1,68 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import java.lang.reflect.Method;
+
+import javax.inject.Inject;
+
+import org.aopalliance.intercept.MethodInterceptor;
+import org.aopalliance.intercept.MethodInvocation;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.context.CallContext;
+
+import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+
+public class ApiAccessInterceptor implements MethodInterceptor {
+    @Inject
+    AccountManager accountManager;
+
+    @Override
+    public Object invoke(MethodInvocation invocation) throws Throwable {
+        Method m = invocation.getMethod();
+        Object target = invocation.getThis();
+        if (target == null) {
+            return invocation.proceed();
+        }
+
+        ApiAccess access = m.getAnnotation(ApiAccess.class);
+        if (access == null) {
+            m = target.getClass().getMethod(m.getName(), m.getParameterTypes());
+            access = m.getAnnotation(ApiAccess.class);
+        }
+        if (access == null) {
+            return invocation.proceed();
+        }
+
+        ServerAdapter adapter = (ServerAdapter) target;
+        Pair<User, Account> serviceUserAccount = adapter.getServiceAccount();
+        String apiName = BaseCmd.getCommandNameByClass(access.command());
+
+        accountManager.checkApiAccess(serviceUserAccount.second(), apiName);
+
+        CallContext.register(serviceUserAccount.first(), serviceUserAccount.second());
+        try {
+            return invocation.proceed();
+        } finally {
+            CallContext.unregister();
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java
new file mode 100644
index 000000000000..510ad74d1558
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/adapter/ServerAdapter.java
@@ -0,0 +1,2188 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import java.nio.charset.StandardCharsets;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.Optional;
+import java.util.Set;
+import java.util.UUID;
+import java.util.concurrent.TimeUnit;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import org.apache.cloudstack.acl.SecurityChecker;
+import org.apache.cloudstack.affinity.AffinityGroupVO;
+import org.apache.cloudstack.affinity.dao.AffinityGroupDao;
+import org.apache.cloudstack.api.ApiCommandResourceType;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.ApiServerService;
+import org.apache.cloudstack.api.BaseAsyncCmd;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.command.admin.backup.CreateImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.DeleteVmCheckpointCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeBackupCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListImageTransfersCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListVmCheckpointsCmd;
+import org.apache.cloudstack.api.command.admin.backup.StartBackupCmd;
+import org.apache.cloudstack.api.command.admin.cluster.ListClustersCmd;
+import org.apache.cloudstack.api.command.admin.host.ListHostsCmd;
+import org.apache.cloudstack.api.command.admin.storage.ListStoragePoolsCmd;
+import org.apache.cloudstack.api.command.admin.vm.AssignVMCmd;
+import org.apache.cloudstack.api.command.admin.vm.DeployVMCmdByAdmin;
+import org.apache.cloudstack.api.command.admin.vm.DestroyVMCmdByAdmin;
+import org.apache.cloudstack.api.command.user.backup.ListBackupsCmd;
+import org.apache.cloudstack.api.command.user.job.ListAsyncJobsCmd;
+import org.apache.cloudstack.api.command.user.network.ListNetworksCmd;
+import org.apache.cloudstack.api.command.user.offering.ListServiceOfferingsCmd;
+import org.apache.cloudstack.api.command.user.tag.CreateTagsCmd;
+import org.apache.cloudstack.api.command.user.tag.ListTagsCmd;
+import org.apache.cloudstack.api.command.user.vm.AddNicToVMCmd;
+import org.apache.cloudstack.api.command.user.vm.DeployVMCmd;
+import org.apache.cloudstack.api.command.user.vm.DestroyVMCmd;
+import org.apache.cloudstack.api.command.user.vm.ListNicsCmd;
+import org.apache.cloudstack.api.command.user.vm.ListVMsCmd;
+import org.apache.cloudstack.api.command.user.vm.StartVMCmd;
+import org.apache.cloudstack.api.command.user.vm.StopVMCmd;
+import org.apache.cloudstack.api.command.user.vm.UpdateVMCmd;
+import org.apache.cloudstack.api.command.user.vmsnapshot.CreateVMSnapshotCmd;
+import org.apache.cloudstack.api.command.user.vmsnapshot.DeleteVMSnapshotCmd;
+import org.apache.cloudstack.api.command.user.vmsnapshot.ListVMSnapshotCmd;
+import org.apache.cloudstack.api.command.user.vmsnapshot.RevertToVMSnapshotCmd;
+import org.apache.cloudstack.api.command.user.volume.AssignVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.AttachVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.CreateVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.DestroyVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.DetachVolumeCmd;
+import org.apache.cloudstack.api.command.user.volume.ListVolumesCmd;
+import org.apache.cloudstack.api.command.user.volume.UpdateVolumeCmd;
+import org.apache.cloudstack.api.command.user.zone.ListZonesCmd;
+import org.apache.cloudstack.api.response.ListResponse;
+import org.apache.cloudstack.api.response.ServiceOfferingResponse;
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.backup.ImageTransfer.Direction;
+import org.apache.cloudstack.backup.ImageTransfer.Format;
+import org.apache.cloudstack.backup.ImageTransferVO;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.ImageTransferDao;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.jobs.dao.AsyncJobDao;
+import org.apache.cloudstack.framework.jobs.impl.AsyncJobVO;
+import org.apache.cloudstack.query.QueryService;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.cloudstack.storage.sharedfs.SharedFS;
+import org.apache.cloudstack.storage.sharedfs.SharedFSService;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.converter.AsyncJobJoinVOToJobConverter;
+import org.apache.cloudstack.veeam.api.converter.BackupVOToBackupConverter;
+import org.apache.cloudstack.veeam.api.converter.ClusterVOToClusterConverter;
+import org.apache.cloudstack.veeam.api.converter.DataCenterJoinVOToDataCenterConverter;
+import org.apache.cloudstack.veeam.api.converter.HostJoinVOToHostConverter;
+import org.apache.cloudstack.veeam.api.converter.ImageTransferVOToImageTransferConverter;
+import org.apache.cloudstack.veeam.api.converter.NetworkVOToNetworkConverter;
+import org.apache.cloudstack.veeam.api.converter.NetworkVOToVnicProfileConverter;
+import org.apache.cloudstack.veeam.api.converter.NicVOToNicConverter;
+import org.apache.cloudstack.veeam.api.converter.ResourceTagVOToTagConverter;
+import org.apache.cloudstack.veeam.api.converter.StoreVOToStorageDomainConverter;
+import org.apache.cloudstack.veeam.api.converter.UserVmJoinVOToVmConverter;
+import org.apache.cloudstack.veeam.api.converter.UserVmVOToCheckpointConverter;
+import org.apache.cloudstack.veeam.api.converter.VmSnapshotVOToSnapshotConverter;
+import org.apache.cloudstack.veeam.api.converter.VolumeJoinVOToDiskConverter;
+import org.apache.cloudstack.veeam.api.dto.Backup;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.OvfXmlUtil;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.cloudstack.veeam.api.dto.VmAction;
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+import org.apache.cloudstack.veeam.utils.CloudConfigUtil;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.jetbrains.annotations.NotNull;
+
+import com.cloud.api.query.dao.AsyncJobJoinDao;
+import com.cloud.api.query.dao.DataCenterJoinDao;
+import com.cloud.api.query.dao.HostJoinDao;
+import com.cloud.api.query.dao.StoragePoolJoinDao;
+import com.cloud.api.query.dao.UserVmJoinDao;
+import com.cloud.api.query.dao.VolumeJoinDao;
+import com.cloud.api.query.vo.AsyncJobJoinVO;
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.dao.ClusterDao;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.domain.Domain;
+import com.cloud.domain.dao.DomainDao;
+import com.cloud.exception.InsufficientCapacityException;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.exception.ResourceAllocationException;
+import com.cloud.exception.ResourceUnavailableException;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.network.NetworkModel;
+import com.cloud.network.Networks;
+import com.cloud.network.as.AutoScaleVmGroupVmMapVO;
+import com.cloud.network.as.dao.AutoScaleVmGroupVmMapDao;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.network.security.SecurityGroupVMMapVO;
+import com.cloud.network.security.SecurityGroupVO;
+import com.cloud.network.security.dao.SecurityGroupDao;
+import com.cloud.network.security.dao.SecurityGroupVMMapDao;
+import com.cloud.offering.ServiceOffering;
+import com.cloud.org.Grouping;
+import com.cloud.projects.Project;
+import com.cloud.projects.ProjectManager;
+import com.cloud.server.ResourceTag;
+import com.cloud.server.TaggedResourceService;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.service.dao.ServiceOfferingDao;
+import com.cloud.storage.DiskOfferingVO;
+import com.cloud.storage.GuestOS;
+import com.cloud.storage.Storage;
+import com.cloud.storage.VMTemplateVO;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeApiService;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.DiskOfferingDao;
+import com.cloud.storage.dao.GuestOSDao;
+import com.cloud.storage.dao.VMTemplateDao;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.storage.dao.VolumeDetailsDao;
+import com.cloud.tags.ResourceTagVO;
+import com.cloud.tags.dao.ResourceTagDao;
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+import com.cloud.user.DomainService;
+import com.cloud.user.SSHKeyPairVO;
+import com.cloud.user.User;
+import com.cloud.user.UserDataVO;
+import com.cloud.user.dao.SSHKeyPairDao;
+import com.cloud.user.dao.UserDataDao;
+import com.cloud.uservm.UserVm;
+import com.cloud.utils.EnumUtils;
+import com.cloud.utils.Pair;
+import com.cloud.utils.Ternary;
+import com.cloud.utils.UuidUtils;
+import com.cloud.utils.component.ComponentContext;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallbackWithException;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.UserVmManager;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VMInstanceDetailVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+import com.cloud.vm.snapshot.VMSnapshotVO;
+import com.cloud.vm.snapshot.dao.VMSnapshotDao;
+
+public class ServerAdapter extends ManagerBase {
+    private static final List<Storage.StoragePoolType> SUPPORTED_STORAGE_TYPES = Arrays.asList(
+            Storage.StoragePoolType.Filesystem,
+            Storage.StoragePoolType.NetworkFilesystem,
+            Storage.StoragePoolType.SharedMountPoint
+    );
+    private static final String VM_TAG_KEY = "veeam_tag";
+    private static final String WORKER_VM_GUEST_CPU_MODE = "host-passthrough";
+    private static final String WORKER_VM_GUEST_OS = "Rocky Linux 9";
+    private static final String WORKER_VM_IP_DETAIL = "worker.vm.ip";
+    private static final String RESTORE_CONFIG = "restore.config";
+
+    @Inject
+    AccountService accountService;
+
+    @Inject
+    DataCenterDao dataCenterDao;
+
+    @Inject
+    DataCenterJoinDao dataCenterJoinDao;
+
+    @Inject
+    StoragePoolJoinDao storagePoolJoinDao;
+
+    @Inject
+    ClusterDao clusterDao;
+
+    @Inject
+    HostJoinDao hostJoinDao;
+
+    @Inject
+    NetworkDao networkDao;
+
+    @Inject
+    UserVmDao userVmDao;
+
+    @Inject
+    UserVmJoinDao userVmJoinDao;
+
+    @Inject
+    VMInstanceDetailsDao vmInstanceDetailsDao;
+
+    @Inject
+    VolumeDao volumeDao;
+
+    @Inject
+    VolumeJoinDao volumeJoinDao;
+
+    @Inject
+    VolumeDetailsDao volumeDetailsDao;
+
+    @Inject
+    VolumeApiService volumeApiService;
+
+    @Inject
+    PrimaryDataStoreDao primaryDataStoreDao;
+
+    @Inject
+    ImageTransferDao imageTransferDao;
+
+    @Inject
+    KVMBackupExportService kvmBackupExportService;
+
+    @Inject
+    QueryService queryService;
+
+    @Inject
+    ServiceOfferingDao serviceOfferingDao;
+
+    @Inject
+    VMTemplateDao templateDao;
+
+    @Inject
+    UserVmManager userVmManager;
+
+    @Inject
+    NicDao nicDao;
+
+    @Inject
+    ApiServerService apiServerService;
+
+    @Inject
+    AsyncJobDao asyncJobDao;
+
+    @Inject
+    AsyncJobJoinDao asyncJobJoinDao;
+
+    @Inject
+    VMSnapshotDao vmSnapshotDao;
+
+    @Inject
+    BackupDao backupDao;
+
+    @Inject
+    ResourceTagDao resourceTagDao;
+
+    @Inject
+    NetworkModel networkModel;
+
+    @Inject
+    ProjectManager projectManager;
+
+    @Inject
+    AffinityGroupDao affinityGroupDao;
+
+    @Inject
+    UserDataDao userDataDao;
+
+    @Inject
+    DomainService domainService;
+
+    @Inject
+    DomainDao domainDao;
+
+    @Inject
+    TaggedResourceService taggedResourceService;
+
+    @Inject
+    SSHKeyPairDao sshKeyPairDao;
+
+    @Inject
+    GuestOSDao guestOSDao;
+
+    @Inject
+    SecurityGroupDao securityGroupDao;
+
+    @Inject
+    SecurityGroupVMMapDao securityGroupVMMapDao;
+
+    @Inject
+    SharedFSService sharedFSService;
+
+    @Inject
+    AutoScaleVmGroupVmMapDao autoScaleVmGroupVmMapDao;
+
+    @Inject
+    DiskOfferingDao diskOfferingDao;
+
+    protected static Map<String, Tag> getDummyTags() {
+        Map<String, Tag> tags = new HashMap<>();
+        Tag rootTag = ResourceTagVOToTagConverter.getRootTag();
+        tags.put(rootTag.getId(), rootTag);
+        return tags;
+    }
+
+    protected void waitForJobCompletion(long jobId) {
+        long timeoutNanos = TimeUnit.MINUTES.toNanos(5);
+        final long deadline = System.nanoTime() + timeoutNanos;
+        long sleepMillis = 500;
+        while (true) {
+            AsyncJobVO job = asyncJobDao.findByIdIncludingRemoved(jobId);
+            if (job == null) {
+                logger.warn("Async job with ID {} not found", jobId);
+                return;
+            }
+            if (job.getStatus() == AsyncJobVO.Status.SUCCEEDED || job.getStatus() == AsyncJobVO.Status.FAILED) {
+                return;
+            }
+            if (System.nanoTime() > deadline) {
+                logger.warn("Timed out waiting for {} completion", job);
+            }
+            try {
+                Thread.sleep(sleepMillis);
+                // back off gradually to reduce DB pressure
+                sleepMillis = Math.min(5000, sleepMillis + 500);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                logger.warn("Interrupted while waiting for async job completion");
+            }
+        }
+    }
+
+    protected void waitForJobCompletion(AsyncJobJoinVO job) {
+        if (job == null) {
+            logger.warn("Async job not found");
+            return;
+        }
+        if (job.getStatus() == AsyncJobVO.Status.SUCCEEDED.ordinal() ||
+                job.getStatus() == AsyncJobVO.Status.FAILED.ordinal()) {
+            logger.warn("Async job with ID {} already completed with status {}", job.getId(), job.getStatus());
+        }
+        waitForJobCompletion(job.getId());
+    }
+
+    protected ApiServerService.AsyncCmdResult processAsyncCmdWithContext(BaseAsyncCmd cmd, Map<String, String> params)
+            throws Exception {
+        final CallContext ctx = CallContext.current();
+        final long callerUserId = ctx.getCallingUserId();
+        final Account caller = ctx.getCallingAccount();
+        return apiServerService.processAsyncCmd(cmd, params, ctx, callerUserId, caller);
+    }
+
+    protected Account getOwnerForInstanceCreation(Vm request) {
+        if (!VeeamControlService.InstanceRestoreAssignOwner.value()) {
+            return null;
+        }
+        String accountUuid = request.getAccountId();
+        if (StringUtils.isBlank(accountUuid)) {
+            return null;
+        }
+        Account account = accountService.getActiveAccountByUuid(accountUuid);
+        if (account == null) {
+            logger.warn("Account with ID {} not found, unable to determine owner for VM creation request", accountUuid);
+            return null;
+        }
+        return account;
+    }
+
+    protected Ternary<Long, String, Long> getOwnerDetailsForInstanceCreation(Account account) {
+        if (account == null) {
+            return new Ternary<>(null, null, null);
+        }
+        String accountName = account.getAccountName();
+        Long projectId = null;
+        if (Account.Type.PROJECT.equals(account.getType())) {
+            Project project = projectManager.findByProjectAccountId(account.getId());
+            if (project == null) {
+                logger.warn("Project for {} not found, unable to determine owner for VM creation request", account);
+                return new Ternary<>(null, null, null);
+            }
+            projectId = project.getId();
+            accountName = null;
+        }
+        return new Ternary<>(account.getDomainId(), accountName, projectId);
+    }
+
+    protected Pair<List<Long>, String> getResourceOwnerFilters() {
+        final Account caller = CallContext.current().getCallingAccount();
+        final Account.Type type = caller.getType();
+        if (Account.Type.ADMIN.equals(type)) {
+            return new Pair<>(null, null);
+        }
+        List<Long> permittedAccountIds = null;
+        String domainPath = null;
+        if (Account.Type.DOMAIN_ADMIN.equals(type) || Account.Type.NORMAL.equals(type)) {
+            permittedAccountIds = projectManager.listPermittedProjectAccounts(caller.getId());
+            permittedAccountIds.add(caller.getId());
+        }
+        if (Account.Type.DOMAIN_ADMIN.equals(type)) {
+            Domain domain = domainService.getDomain(caller.getDomainId());
+            if (domain == null) {
+                throw new InvalidParameterValueException("Invalid service account specified");
+            }
+            domainPath = domain.getPath();
+        }
+        if (Account.Type.PROJECT.equals(type)) {
+            Project project = projectManager.findByProjectAccountId(caller.getId());
+            if (project == null) {
+                throw new InvalidParameterValueException("Invalid service account specified");
+            }
+            permittedAccountIds = new ArrayList<>();
+            permittedAccountIds.add(caller.getId());
+        }
+        return new Pair<>(permittedAccountIds, domainPath);
+    }
+
+    protected Pair<List<Long>, List<Long>> getResourceOwnerFiltersWithDomainIds() {
+        Pair<List<Long>, String> filters = getResourceOwnerFilters();
+        if (StringUtils.isNotBlank(filters.second())) {
+            return new Pair<>(filters.first(), domainDao.getDomainChildrenIds(filters.second()));
+        }
+        return new Pair<>(filters.first(), null);
+    }
+
+    protected ServiceOfferingVO getServiceOfferingFromRequest(com.cloud.dc.DataCenter zone, Account account,
+                      String uuid, int cpu, int memory) {
+        if (StringUtils.isBlank(uuid)) {
+            return null;
+        }
+        ServiceOfferingVO offering = serviceOfferingDao.findByUuid(uuid);
+        if (offering == null) {
+            logger.warn("Service offering with ID {} linked with the VM request not found", uuid);
+            return null;
+        }
+        try {
+            accountService.checkAccess(account, offering, zone);
+        } catch (PermissionDeniedException e) {
+            logger.warn("{} linked with the VM request is not accessible for the account {} in zone: {}",
+                    offering, account, zone);
+            return null;
+        }
+        if (!offering.isCustomized() && (offering.getCpu() != cpu || offering.getRamSize() != memory)) {
+            logger.warn("{} linked with the VM request has different CPU or memory than requested. Requested CPU: {}, requested memory: {}",
+                    offering, cpu, memory);
+            return null;
+        }
+        if (offering.isCustomized()) {
+            Map<String, String> params = Map.of(
+                    VmDetailConstants.CPU_NUMBER, String.valueOf(cpu),
+                    VmDetailConstants.MEMORY, String.valueOf(memory)
+            );
+            try {
+                userVmManager.validateCustomParameters(offering, params);
+                offering.setCpu(cpu);
+                offering.setRamSize(memory);
+            } catch (InvalidParameterValueException e) {
+                logger.warn("{} linked with the VM request is customized but does not support requested CPU or memory. Requested CPU: {}, requested memory: {}",
+                        offering, cpu, memory);
+                return null;
+            }
+        }
+        if (VeeamControlService.InstanceEncryptVolumes.valueIn(zone.getId())) {
+            DiskOfferingVO diskOfferingVO = diskOfferingDao.findById(offering.getDiskOfferingId());
+            if (!diskOfferingVO.getEncrypt()) {
+                logger.warn("{} is set to true, but {} linked with the VM request does not support encrypted volumes.",
+                        VeeamControlService.InstanceEncryptVolumes.key(), offering);
+                return null;
+            }
+        }
+        return offering;
+    }
+
+    protected ServiceOffering getServiceOfferingIdForVmCreation(com.cloud.dc.DataCenter zone, Account account,
+                    String serviceOfferingUuid, int cpu, int memory) {
+        ServiceOfferingVO offering = getServiceOfferingFromRequest(zone, account, serviceOfferingUuid, cpu, memory);
+        if (offering != null) {
+            return offering;
+        }
+        ListServiceOfferingsCmd cmd = new ListServiceOfferingsCmd();
+        ComponentContext.inject(cmd);
+        cmd.setZoneId(zone.getId());
+        cmd.setCpuNumber(cpu);
+        cmd.setMemory(memory);
+        if (VeeamControlService.InstanceEncryptVolumes.valueIn(zone.getId())) {
+            logger.debug("{} is set to true, filtering service offerings that support encrypted volumes",
+                    VeeamControlService.InstanceEncryptVolumes.key());
+            cmd.setEncryptRoot(true);
+        }
+        ListResponse<ServiceOfferingResponse> offerings = queryService.searchForServiceOfferings(cmd);
+        if (offerings.getResponses().isEmpty()) {
+            return null;
+        }
+        String uuid = offerings.getResponses().get(0).getId();
+        offering = serviceOfferingDao.findByUuid(uuid);
+        if (offering.isCustomized()) {
+            offering.setCpu(cpu);
+            offering.setRamSize(memory);
+        }
+        return offering;
+    }
+
+    protected GuestOS getGuestOsForInstance(Vm request) {
+        if (request.isWorkerVm()) {
+            GuestOS os = guestOSDao.findOneByDisplayName(WORKER_VM_GUEST_OS);
+            if (os == null) {
+                logger.warn("Guest OS with name {} for worker VM not found, VM will be created with default guest OS",
+                        WORKER_VM_GUEST_OS);
+            }
+            return os;
+        }
+        final String guestOsId = request.getGuestOsId();
+        final String guestOsName = request.getGuestOsName();
+        if (StringUtils.isAllBlank(guestOsId, guestOsName)) {
+            return null;
+        }
+        GuestOS os = null;
+        if (StringUtils.isNotBlank(guestOsId)) {
+            os = guestOSDao.findByUuid(guestOsId);
+        }
+        if (os == null && StringUtils.isNotBlank(guestOsName)) {
+            os = guestOSDao.findOneByDisplayName(guestOsName);
+        }
+        if (os == null) {
+            logger.debug("Guest OS could not be identified with ID: {} and name: {} for the VM request",
+                    guestOsId, guestOsName);
+        }
+        return os;
+    }
+
+    protected VMTemplateVO getTemplateForInstanceCreation(String templateUuid, GuestOS guestOs) {
+        if (StringUtils.isBlank(templateUuid)) {
+            return null;
+        }
+        VMTemplateVO template = templateDao.findByUuid(templateUuid);
+        if (template == null) {
+            logger.warn("Template with ID {} not found, guest OS: {}, VM will be created with default template",
+                    guestOs, templateUuid);
+            return null;
+        }
+        return template;
+    }
+
+    protected List<String> getValidatedSshKeyPairNames(String sshKeyPairNames, Account owner) {
+        if (StringUtils.isBlank(sshKeyPairNames)) {
+            return null;
+        }
+        List<String> sshKeys = Arrays.stream(sshKeyPairNames.split(","))
+                .map(String::trim)
+                .filter(StringUtils::isNotEmpty)
+                .collect(Collectors.toList());
+        Account account = owner != null ? owner : CallContext.current().getCallingAccount();
+        List<SSHKeyPairVO> keyPairs = sshKeyPairDao.findByNames(account.getId(), account.getDomainId(), sshKeys);
+        List<String> validatedNames = keyPairs.stream().map(SSHKeyPairVO::getName).collect(Collectors.toList());
+        if (sshKeys.size() != validatedNames.size()) {
+            logger.warn("Some SSH key pairs specified in the VM creation request were not found for {}. " +
+                            "Specified SSH key pairs: [{}], valid SSH key pairs: [{}]",
+                    account, StringUtils.join(sshKeys, ","), StringUtils.join(validatedNames, ","));
+        }
+        return validatedNames;
+    }
+
+    protected AffinityGroupVO getValidatedAffinityGroup(String affinityGroupUuid) {
+        if (StringUtils.isBlank(affinityGroupUuid)) {
+            return null;
+        }
+        AffinityGroupVO group = affinityGroupDao.findByUuid(affinityGroupUuid);
+        if (group == null) {
+            logger.warn("Failed to find affinity group with ID {} specified in Instance creation request, " +
+                    "skipping affinity group assignment", affinityGroupUuid);
+            return null;
+        }
+        return group;
+    }
+
+    protected UserDataVO getValidatedUserdata(String userdataUuid) {
+        if (StringUtils.isBlank(userdataUuid)) {
+            return null;
+        }
+        UserDataVO userDataVO = userDataDao.findByUuid(userdataUuid);
+        if (userDataVO == null) {
+            logger.warn("Failed to find userdata with ID {} specified in Instance creation request, " +
+                    "skipping userdata assignment", userdataUuid);
+            return null;
+        }
+        return userDataVO;
+    }
+
+    protected SecurityGroupVO getValidatedSecurityGroup(String securityGroupUuid) {
+        if (StringUtils.isBlank(securityGroupUuid)) {
+            return null;
+        }
+        SecurityGroupVO group = securityGroupDao.findByUuid(securityGroupUuid);
+        if (group == null) {
+            logger.warn("Failed to find security group with ID {} specified in Instance creation request, " +
+                    "skipping its assignment", securityGroupUuid);
+            return null;
+        }
+        return group;
+    }
+
+    protected List<Long> getValidatedSecurityGroups(List<String> uuids, long vmId) {
+        if (CollectionUtils.isEmpty(uuids)) {
+            return null;
+        }
+        List<SecurityGroupVO> instanceGroups = getSecurityGroupsForInstance(vmId);
+        Set<Long> existingIds = CollectionUtils.isNotEmpty(instanceGroups)
+                ? instanceGroups.stream().map(SecurityGroupVO::getId).collect(Collectors.toSet())
+                : new HashSet<>();
+        Set<Long> requestedIds = uuids.stream()
+                .map(uuid -> {
+                    SecurityGroupVO group = getValidatedSecurityGroup(uuid);
+                    return group != null ? group.getId() : null;
+                })
+                .filter(Objects::nonNull)
+                .collect(Collectors.toSet());
+        if (CollectionUtils.isEmpty(requestedIds)) {
+            return null;
+        }
+        Set<Long> mergedIds = new HashSet<>(existingIds);
+        mergedIds.addAll(requestedIds);
+        if (mergedIds.equals(existingIds)) {
+            return null;
+        }
+        return new ArrayList<>(mergedIds);
+    }
+
+    protected String getValidatedInstanceType(Vm request) {
+        String instanceType = StringUtils.trimToNull(request.getInstanceType());
+        if (StringUtils.isEmpty(request.getInstanceType())) {
+            return null;
+        }
+        if (!UserVmManager.SHAREDFSVM.equals(instanceType)) {
+            logger.warn("{} is not supported for restore, returning null Instance type");
+            return null;
+        }
+        if (StringUtils.isBlank(request.getSharedFSId())) {
+            logger.warn("Shared Filesystem ID not available, returning null Instance type");
+            return null;
+        }
+        SharedFS sharedFS = sharedFSService.getSharedFSByUuid(request.getSharedFSId());
+        if (sharedFS == null) {
+            logger.warn("Shared Filesystem for ID: {} not found, returning null Instance type", request.getSharedFSId());
+            return null;
+        }
+        UserVmVO existingVm = userVmDao.findById(sharedFS.getVmId());
+        if (existingVm != null) {
+            logger.error("{} already has a {}, returning null Instance type", sharedFS, existingVm);
+            return null;
+        }
+        return instanceType;
+    }
+
+    protected UserVm createVmWithForRestoreIfNeeded(DeployVMCmdByAdmin cmd, Vm request) {
+        return Transaction.execute((TransactionCallbackWithException<UserVm, CloudRuntimeException>) status -> {
+            final String uuid = request.getInstanceId();
+            if (StringUtils.isNotBlank(uuid)) {
+                logger.debug("UUID for new VM needs to be {}", uuid);
+                updateOldInstanceUuid(uuid);
+                cmd.setCustomId(uuid);
+            }
+            try {
+                return userVmManager.createVirtualMachine(cmd);
+            } catch (InsufficientCapacityException | ResourceUnavailableException |
+                     ResourceAllocationException | CloudRuntimeException e) {
+                throw new CloudRuntimeException("Failed to create VM: " + e.getMessage(), e);
+            }
+        });
+    }
+
+    private void updateOldInstanceUuid(String uuid) {
+        UserVmVO oldVM = userVmDao.findByUuidIncludingRemoved(uuid);
+        if (oldVM == null) {
+            return;
+        }
+        if (oldVM.getRemoved() == null) {
+            logger.error("Found existing VM with the UUID from request data and it is not removed. Cannot " +
+                    "proceed with UUID update. VM with conflicting UUID: {}", oldVM);
+            throw new CloudRuntimeException("VM with ID " + uuid + " already exists and is not removed. Cannot proceed with VM creation for restore.");
+        }
+        logger.debug("Found removed VM with UUID from request data. Updating its UUID to a new random " +
+                "value to free up the requested UUID for the new VM. Old VM: {}", uuid, oldVM);
+        UserVmVO updateObj = userVmDao.createForUpdate(oldVM.getId());
+        updateObj.setUuid(UUID.randomUUID().toString());
+        userVmDao.update(updateObj.getId(), updateObj);
+    }
+
+    protected Pair<Vm, UserVm> createInstance(com.cloud.dc.DataCenter zone, Long clusterId, Account owner, Long domainId,
+                String accountName, Long projectId, String name, String displayName, String serviceOfferingUuid,
+                int cpu, int memory, String templateUuid, GuestOS guestOs, String userdata, ApiConstants.BootType bootType,
+                ApiConstants.BootMode bootMode, Vm request) {
+        final String affinityGroupId = request.getAffinityGroupId();
+        final String userDataId = request.getUserDataId();
+        final String sshKeyPairNames = request.getSshKeyPairNames();
+        final Map<String, String> details = request.getDetails();
+        Account account = owner != null ? owner : CallContext.current().getCallingAccount();
+        ServiceOffering serviceOffering = getServiceOfferingIdForVmCreation(zone, account, serviceOfferingUuid, cpu,
+                memory);
+        if (serviceOffering == null) {
+            throw new CloudRuntimeException("No service offering found for VM creation with specified CPU and memory");
+        }
+        DeployVMCmdByAdmin cmd = new DeployVMCmdByAdmin();
+        cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+        ComponentContext.inject(cmd);
+        cmd.setZoneId(zone.getId());
+        cmd.setClusterId(clusterId);
+        if (domainId != null && StringUtils.isNotEmpty(accountName)) {
+            cmd.setDomainId(domainId);
+            cmd.setAccountName(accountName);
+        }
+        if (projectId != null) {
+            cmd.setProjectId(projectId);
+        }
+        cmd.setName(name);
+        if (displayName != null) {
+            cmd.setDisplayName(displayName);
+        }
+        cmd.setServiceOfferingId(serviceOffering.getId());
+        if (StringUtils.isNotEmpty(userdata)) {
+            cmd.setUserData(Base64.getEncoder().encodeToString(userdata.getBytes(StandardCharsets.UTF_8)));
+        }
+        if (bootType != null) {
+            cmd.setBootType(bootType.toString());
+        }
+        if (bootMode != null) {
+            cmd.setBootMode(bootMode.toString());
+        }
+        VMTemplateVO template = getTemplateForInstanceCreation(templateUuid, guestOs);
+        if (template != null) {
+            cmd.setTemplateId(template.getId());
+        } else if (guestOs != null) {
+            CallContext.current().putContextParameter(ApiConstants.OS_ID, guestOs);
+        }
+        AffinityGroupVO group = getValidatedAffinityGroup(affinityGroupId);
+        if (group != null) {
+            cmd.setAffinityGroupIds(List.of(group.getId()));
+        }
+        UserDataVO userData = getValidatedUserdata(userDataId);
+        if (userData != null) {
+            cmd.setUserDataId(userData.getId());
+        }
+        if (StringUtils.isNotBlank(sshKeyPairNames)) {
+            cmd.setSshKeyPairNames(getValidatedSshKeyPairNames(sshKeyPairNames, owner));
+        }
+        final String instanceType = getValidatedInstanceType(request);
+        cmd.setInstanceType(StringUtils.trimToNull(instanceType));
+        cmd.setHypervisor(Hypervisor.HypervisorType.KVM.name());
+        Map<String, String> instanceDetails = getDetailsForInstanceCreation(request, serviceOffering, details);
+        if (MapUtils.isNotEmpty(instanceDetails)) {
+            Map<Integer, Map<String, String>> map = new HashMap<>();
+            map.put(0, instanceDetails);
+            cmd.setDetails(map);
+        }
+        cmd.setBlankInstance(true);
+        UserVm vm = createVmWithForRestoreIfNeeded(cmd, request);
+        vm = userVmManager.finalizeCreateVirtualMachine(vm.getId());
+        UserVmJoinVO vo = userVmJoinDao.findById(vm.getId());
+        Vm vmObj = UserVmJoinVOToVmConverter.toVm(vo, this::getHostById, this::getDetailsByInstanceId,
+                this::listTagsByInstanceId, this::listDiskAttachmentsByInstanceId, this::listNicsByInstance,
+                null, null, false);
+        return new Pair<>(vmObj, vm);
+    }
+
+    @NotNull
+    protected static Map<String, String> getDetailsForInstanceCreation(Vm request, ServiceOffering serviceOffering,
+                           Map<String, String> existingDetails) {
+        Map<String, String> details = new HashMap<>();
+        List<String> detailsTobeSkipped = List.of(
+                ApiConstants.BootType.BIOS.toString(),
+                ApiConstants.BootType.UEFI.toString());
+        if (MapUtils.isNotEmpty(existingDetails)) {
+            for (Map.Entry<String, String> entry : existingDetails.entrySet()) {
+                if (detailsTobeSkipped.contains(entry.getKey())) {
+                    continue;
+                }
+                details.put(entry.getKey(), entry.getValue());
+            }
+        }
+        if (request.isWorkerVm()) {
+            // Assumption: Only worker VM will have userdata and it needs CPU mode
+            details.put(VmDetailConstants.GUEST_CPU_MODE, WORKER_VM_GUEST_CPU_MODE);
+        }
+        if (serviceOffering.isCustomized()) {
+            details.put(VmDetailConstants.CPU_NUMBER, String.valueOf(serviceOffering.getCpu()));
+            details.put(VmDetailConstants.MEMORY, String.valueOf(serviceOffering.getRamSize()));
+            if (serviceOffering.getSpeed() == null && !details.containsKey(VmDetailConstants.CPU_SPEED)) {
+                details.put(VmDetailConstants.CPU_SPEED, String.valueOf(1000));
+            }
+        }
+        return details;
+    }
+
+    protected void saveInstanceAdditionalDetails(Vm request, UserVm vm) {
+        if (request.isWorkerVm()) {
+            Optional<String> ip = CloudConfigUtil.extractIpv4Address(
+                    request.getInitialization().getCustomScript());
+            if (ip.isPresent() && StringUtils.isNotBlank(ip.get())) {
+                logger.debug("Saving worker VM IP {} in details for {}", ip.get(), vm);
+                vmInstanceDetailsDao.addDetail(vm.getId(), WORKER_VM_IP_DETAIL, ip.get(), false);
+            }
+            return;
+        }
+        saveInstanceRestoreConfig(request, vm);
+    }
+
+    protected void saveInstanceRestoreConfig(Vm request, UserVm vm) {
+        if (StringUtils.isBlank(request.getAccountId())) {
+            return;
+        }
+        if (accountService.getAccountByUuid(request.getAccountId()) == null) {
+            return;
+        }
+        String restoreConfig = OvfXmlUtil.getConfigMetadataXml(request, logger);
+        if (StringUtils.isBlank(restoreConfig)) {
+            return;
+        }
+        logger.debug("Saving restore config: {} in details for {}", restoreConfig, vm);
+        vmInstanceDetailsDao.addDetail(vm.getId(), RESTORE_CONFIG, restoreConfig, false);
+    }
+
+    protected void removeInstanceRestoreConfig(UserVm vm) {
+        vmInstanceDetailsDao.removeDetail(vm.getId(), RESTORE_CONFIG);
+    }
+
+    protected void removeInstanceWorkerVmIp(UserVm vm) {
+        vmInstanceDetailsDao.removeDetail(vm.getId(), WORKER_VM_IP_DETAIL);
+    }
+
+    protected void processInstanceRestoreConfigIfNeeded(UserVm userVm, Volume volume) {
+        VMInstanceDetailVO detail = vmInstanceDetailsDao.findDetail(userVm.getId(), RESTORE_CONFIG);
+        if (detail == null) {
+            return;
+        }
+        String config = detail.getValue();
+        if (StringUtils.isAnyBlank(userVm.getUserVmType(), config)) {
+            removeInstanceRestoreConfig(userVm);
+            return;
+        }
+        Vm vm = OvfXmlUtil.parseVmRestoreConfig(config, logger);
+        if (StringUtils.isAnyBlank(vm.getSharedFSId(), vm.getSharedFsVolumeName())) {
+            removeInstanceRestoreConfig(userVm);
+            return;
+        }
+        if (!vm.getSharedFsVolumeName().equals(volume.getName())) {
+            return;
+        }
+        removeInstanceRestoreConfig(userVm);
+        SharedFS sharedFS = sharedFSService.getSharedFSByUuid(vm.getSharedFSId());
+        if (sharedFS == null) {
+            logger.warn("Shared Filesystem with ID {} specified in the restore config for {} not found, unable to restore Instance for Shared Filesystem",
+                    vm.getSharedFSId(), userVm);
+            return;
+        }
+        UserVm existingVm = userVmDao.findById(sharedFS.getId());
+        if (existingVm != null) {
+            logger.error("{} specified in the restore config for {} is already associated with {}, unable to restore Instance for Shared Filesystem",
+                    sharedFS, userVm, existingVm);
+        }
+        sharedFSService.updateSharedFSPostRestore(sharedFS.getId(), volume.getId());
+    }
+
+    protected Pair<String, String> getValidatedInstanceNicDetails(final String config, final NetworkVO network) {
+        if (ObjectUtils.anyNull(config, network) || StringUtils.isBlank(config)) {
+            return new Pair<>(null, null);
+        }
+        Pair<String, String> result = OvfXmlUtil.getVmNicDetailFromStoredConfig(config, network.getUuid(), logger);
+        String mac = StringUtils.trimToNull(result.first());
+        String ip4Address = StringUtils.trimToNull(result.second());
+        NicVO nic = null;
+        if (mac != null) {
+            nic = nicDao.findByNetworkIdAndMacAddress(network.getId(), mac);
+            if (nic != null) {
+                logger.warn("MAC address {} specified in the restore config for {} is already in use by {}, ignoring it",
+                        mac, network, nic);
+                mac = null;
+                if (!Objects.equals(ip4Address, nic.getIPv4Address())) {
+                    nic = null;
+                }
+            }
+        }
+        if (ip4Address != null) {
+            if (nic == null) {
+                nic = nicDao.findNonPlaceHolderByIp4AddressAndNetworkId(ip4Address, network.getId());
+            }
+            if (nic != null) {
+                logger.warn("IPv4 address {} specified in the restore config for {} is already in use by {}, ignoring it",
+                        ip4Address, network, nic);
+                mac = null;
+                if (Objects.equals(ip4Address, nic.getIPv4Address())) {
+                    ip4Address = null;
+                }
+            }
+        }
+        return new Pair<>(mac, ip4Address);
+    }
+
+    protected void updateInstanceSecurityGroupsIfNeeded(final UserVmVO vmVo, final String config, final NetworkVO network) {
+        if (ObjectUtils.anyNull(config, network) || StringUtils.isBlank(config)) {
+            return;
+        }
+        Vm vm = OvfXmlUtil.parseVmRestoreConfig(config, logger);
+        if (CollectionUtils.isEmpty(vm.getSecurityGroupIds())) {
+            return;
+        }
+        List<Long> securityGroupIds = getValidatedSecurityGroups(vm.getSecurityGroupIds(), vmVo.getId());
+        if (CollectionUtils.isEmpty(securityGroupIds)) {
+            return;
+        }
+        if (!networkModel.areServicesSupportedInNetwork(network.getId(), NetworkVO.Service.SecurityGroup)) {
+            logger.debug("{} does not support security groups, will try with remaining networks for {}", network, vmVo);
+            return;
+        }
+        UpdateVMCmd cmd = new UpdateVMCmd();
+        ComponentContext.inject(cmd);
+        cmd.setId(vmVo.getId());
+        cmd.setSecurityGroupIdList(securityGroupIds);
+        try {
+            userVmManager.updateVirtualMachine(cmd);
+        } catch (ResourceUnavailableException | InsufficientCapacityException e) {
+            throw new CloudRuntimeException("Failed to add security group(s) due to: " + e.getMessage());
+        }
+    }
+
+    protected static long getProvisionedSizeInGb(String sizeStr) {
+        long provisionedSizeInGb;
+        try {
+            provisionedSizeInGb = Long.parseLong(sizeStr);
+        } catch (NumberFormatException ex) {
+            throw new InvalidParameterValueException("Invalid provisioned size: " + sizeStr);
+        }
+        if (provisionedSizeInGb <= 0) {
+            throw new InvalidParameterValueException("Provisioned size must be greater than zero");
+        }
+        // round-up provisionedSizeInGb to the next whole GB
+        long GB = 1024L * 1024L * 1024L;
+        provisionedSizeInGb = Math.max(1L, (provisionedSizeInGb + GB - 1) / GB);
+        return provisionedSizeInGb;
+    }
+
+    protected Long getVolumePhysicalSize(VolumeJoinVO vo) {
+        return volumeApiService.getVolumePhysicalSize(vo.getFormat(), vo.getPath(), vo.getChainInfo());
+    }
+
+    @NotNull
+    protected Disk createDisk(Account serviceAccount, StoragePoolVO pool, String name, Long diskOfferingId, long sizeInGb, Long initialSize) {
+        Volume volume;
+        try {
+            volume = volumeApiService.allocVolume(serviceAccount.getId(), pool.getDataCenterId(), diskOfferingId, null,
+                    null, name, sizeInGb, null, null, null, null);
+        } catch (ResourceAllocationException e) {
+            throw new CloudRuntimeException(e.getMessage(), e);
+        }
+        if (volume == null) {
+            throw new CloudRuntimeException("Failed to create volume");
+        }
+        volume = volumeApiService.createVolume(volume.getId(), null, null, pool.getId(), true);
+        if (initialSize != null) {
+            volumeDetailsDao.addDetail(volume.getId(), ApiConstants.VIRTUAL_SIZE, String.valueOf(initialSize), true);
+        }
+
+        // Implementation for creating a Disk resource
+        return VolumeJoinVOToDiskConverter.toDisk(volumeJoinDao.findById(volume.getId()), this::getVolumePhysicalSize);
+    }
+
+    protected List<Nic> listNicsByInstance(final long instanceId, final String instanceUuid) {
+        List<NicVO> nics = nicDao.listByVmId(instanceId);
+        return NicVOToNicConverter.toNicList(nics, instanceUuid, this::getNetworkById);
+    }
+
+    protected List<Nic> listNicsByInstance(final UserVmJoinVO vo) {
+        return listNicsByInstance(vo.getId(), vo.getUuid());
+    }
+
+    protected boolean accountCannotAccessNetwork(NetworkVO networkVO, long accountId) {
+        Account account = accountService.getActiveAccountById(accountId);
+        try {
+            networkModel.checkNetworkPermissions(account, networkVO);
+            return false;
+        } catch (CloudRuntimeException e) {
+            logger.debug("{} cannot access {}: {}", account, networkVO, e.getMessage());
+        }
+        return true;
+    }
+
+    protected void assignVmToAccount(UserVmVO vmVO, long accountId) {
+        Account account = accountService.getActiveAccountById(accountId);
+        if (account == null) {
+            throw new InvalidParameterValueException("Account with ID " + accountId + " not found");
+        }
+        try {
+            AssignVMCmd cmd = new AssignVMCmd();
+            ComponentContext.inject(cmd);
+            cmd.setVirtualMachineId(vmVO.getId());
+            cmd.setDomainId(account.getDomainId());
+            if (Account.Type.PROJECT.equals(account.getType())) {
+                Project project = projectManager.findByProjectAccountId(account.getId());
+                if (project == null) {
+                    throw new InvalidParameterValueException("Project for " + account + " not found");
+                }
+                cmd.setProjectId(project.getId());
+            } else {
+                cmd.setAccountName(account.getAccountName());
+            }
+            cmd.setSkipNetwork(true);
+            userVmManager.moveVmToUser(cmd);
+        } catch (ResourceAllocationException | CloudRuntimeException | ResourceUnavailableException |
+                 InsufficientCapacityException e) {
+            logger.error("Failed to assign {} to {}: {}", vmVO, account, e.getMessage(), e);
+        }
+    }
+
+    protected ImageTransfer createImageTransfer(Long backupId, Long volumeId, Direction direction, Format format) {
+        org.apache.cloudstack.backup.ImageTransfer imageTransfer =
+                kvmBackupExportService.createImageTransfer(volumeId, backupId, direction, format);
+        ImageTransferVO imageTransferVO = imageTransferDao.findById(imageTransfer.getId());
+        return ImageTransferVOToImageTransferConverter.toImageTransfer(imageTransferVO, this::getHostById,
+                this::getVolumeById);
+    }
+
+    protected DataCenterJoinVO getZoneById(Long zoneId) {
+        if (zoneId == null) {
+            return null;
+        }
+        return dataCenterJoinDao.findById(zoneId);
+    }
+
+    protected HostJoinVO getHostById(Long hostId) {
+        if (hostId == null) {
+            return null;
+        }
+        return hostJoinDao.findById(hostId);
+    }
+
+    protected VolumeJoinVO getVolumeById(Long volumeId) {
+        if (volumeId == null) {
+            return null;
+        }
+        return volumeJoinDao.findById(volumeId);
+    }
+
+    protected NetworkVO getNetworkById(Long networkId) {
+        if (networkId == null) {
+            return null;
+        }
+        return networkDao.findById(networkId);
+    }
+
+    protected Map<String, String> getDetailsByInstanceId(Long instanceId) {
+        return vmInstanceDetailsDao.listDetailsKeyPairs(instanceId, true);
+    }
+
+    protected SharedFS getSharedFSForInstance(UserVmJoinVO vo) {
+        if (vo == null || !UserVmManager.SHAREDFSVM.equals(vo.getUserVmType())) {
+            return null;
+        }
+        return sharedFSService.getSharedFSForVmId(vo.getId());
+    }
+
+    protected List<SecurityGroupVO> getSecurityGroupsForInstance(long vmId) {
+        List<SecurityGroupVMMapVO> mappings = securityGroupVMMapDao.listByInstanceId(vmId);
+        if (CollectionUtils.isEmpty(mappings)) {
+            return null;
+        }
+        return securityGroupDao.listByIds(
+                mappings.stream()
+                        .map(SecurityGroupVMMapVO::getSecurityGroupId)
+                        .collect(Collectors.toList()));
+    }
+
+    protected void validateInstanceBackupConditions(UserVm vm) {
+        List<AutoScaleVmGroupVmMapVO> asGroupVmVOs = autoScaleVmGroupVmMapDao.listByVm(vm.getId());
+        if (CollectionUtils.isNotEmpty(asGroupVmVOs)) {
+            throw new CloudRuntimeException("Instance is part of an AutoScale group, unable to proceed with backup");
+        }
+    }
+
+    public Pair<User, Account> getServiceAccount() {
+        String serviceAccountUuid = VeeamControlService.ServiceAccountId.value();
+        if (StringUtils.isEmpty(serviceAccountUuid)) {
+            throw new CloudRuntimeException("Service account is not configured, unable to proceed");
+        }
+        Account account = accountService.getActiveAccountByUuid(serviceAccountUuid);
+        if (account == null) {
+            throw new CloudRuntimeException("Service account with ID " + serviceAccountUuid + " not found, unable to proceed");
+        }
+        User user = accountService.getOneActiveUserForAccount(account);
+        if (user == null) {
+            throw new CloudRuntimeException("No active user found for service account with ID " + serviceAccountUuid);
+        }
+        return new Pair<>(user, account);
+    }
+
+    @ApiAccess(command = ListZonesCmd.class)
+    public List<DataCenter> listAllDataCenters(Long offset, Long limit) {
+        Filter filter = new Filter(DataCenterJoinVO.class, "id", true, offset, limit);
+        final List<DataCenterJoinVO> clusters = dataCenterJoinDao.listByIds(
+                kvmBackupExportService.listCompatibleDataCenterIds(), filter);
+        return DataCenterJoinVOToDataCenterConverter.toDCList(clusters);
+    }
+
+    @ApiAccess(command = ListZonesCmd.class)
+    public DataCenter getDataCenter(String uuid) {
+        final DataCenterJoinVO vo = dataCenterJoinDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("DataCenter with ID " + uuid + " not found");
+        }
+        return  DataCenterJoinVOToDataCenterConverter.toDataCenter(vo);
+    }
+
+    @ApiAccess(command = ListStoragePoolsCmd.class)
+    public List<StorageDomain> listStorageDomainsByDcId(final String uuid, final Long offset, final Long limit) {
+        final DataCenterVO dataCenterVO = dataCenterDao.findByUuid(uuid);
+        if (dataCenterVO == null) {
+            throw new InvalidParameterValueException("DataCenter with ID " + uuid + " not found");
+        }
+        Filter filter = new Filter(StoragePoolJoinVO.class, "id", true, offset, limit);
+        List<StoragePoolJoinVO> storagePoolVOS = storagePoolJoinDao.listAvailableByZoneHypervisorAndType(dataCenterVO.getId(),
+                Hypervisor.HypervisorType.KVM, SUPPORTED_STORAGE_TYPES, filter);
+        return StoreVOToStorageDomainConverter.toStorageDomainListFromPools(storagePoolVOS);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public List<Network> listNetworksByDcId(final String uuid, final Long offset, final Long limit) {
+        final DataCenterJoinVO dataCenterVO = dataCenterJoinDao.findByUuid(uuid);
+        if (dataCenterVO == null) {
+            throw new InvalidParameterValueException("DataCenter with ID " + uuid + " not found");
+        }
+        Filter filter = new Filter(NetworkVO.class, "id", true, offset, limit);
+        List<NetworkVO> networks = networkDao.listByZoneAndTrafficType(dataCenterVO.getId(), Networks.TrafficType.Guest, filter);
+        return NetworkVOToNetworkConverter.toNetworkList(networks, (dcId) -> dataCenterVO);
+    }
+
+    @ApiAccess(command = ListClustersCmd.class)
+    public List<Cluster> listAllClusters(Long offset, Long limit) {
+        Filter filter = new Filter(ClusterVO.class, "id", true, offset, limit);
+        final List<ClusterVO> clusters = clusterDao.listByZonesAndHypervisorType(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Hypervisor.HypervisorType.KVM, filter);
+        return ClusterVOToClusterConverter.toClusterList(clusters, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListClustersCmd.class)
+    public Cluster getCluster(String uuid) {
+        final ClusterVO vo = clusterDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Cluster with ID " + uuid + " not found");
+        }
+        return ClusterVOToClusterConverter.toCluster(vo, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListHostsCmd.class)
+    public List<Host> listAllHosts(Long offset, Long limit) {
+        Filter filter = new Filter(HostJoinVO.class, "id", true, offset, limit);
+        final List<HostJoinVO> hosts = hostJoinDao.listAvailableRoutingByZonesAndHypervisor(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Hypervisor.HypervisorType.KVM, filter);
+        return HostJoinVOToHostConverter.toHostList(hosts);
+    }
+
+    @ApiAccess(command = ListHostsCmd.class)
+    public Host getHost(String uuid) {
+        final HostJoinVO vo = hostJoinDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Host with ID " + uuid + " not found");
+        }
+        return HostJoinVOToHostConverter.toHost(vo);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public List<Network> listAllNetworks(Long offset, Long limit) {
+        Filter filter = new Filter(NetworkVO.class, "id", true, offset, limit);
+        Pair<List<Long>, List<Long>> ownerDetails = getResourceOwnerFiltersWithDomainIds();
+        final List<NetworkVO> networks = networkDao.listByZonesTrafficTypeAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Networks.TrafficType.Guest,
+                ownerDetails.first(), ownerDetails.second(), filter);
+        return NetworkVOToNetworkConverter.toNetworkList(networks, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public Network getNetwork(String uuid) {
+        final NetworkVO vo = networkDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Network with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return NetworkVOToNetworkConverter.toNetwork(vo, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public List<VnicProfile> listAllVnicProfiles(Long offset, Long limit) {
+        Filter filter = new Filter(NetworkVO.class, "id", true, offset, limit);
+        Pair<List<Long>, List<Long>> ownerDetails = getResourceOwnerFiltersWithDomainIds();
+        final List<NetworkVO> networks = networkDao.listByZonesTrafficTypeAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Networks.TrafficType.Guest,
+                ownerDetails.first(), ownerDetails.second(), filter);
+        return NetworkVOToVnicProfileConverter.toVnicProfileList(networks, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListNetworksCmd.class)
+    public VnicProfile getVnicProfile(String uuid) {
+        final NetworkVO vo = networkDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Nic profile with ID " + uuid + " not found");
+        }
+        return NetworkVOToVnicProfileConverter.toVnicProfile(vo, this::getZoneById);
+    }
+
+    @ApiAccess(command = ListVMsCmd.class)
+    public List<Vm> listAllInstances(boolean includeTags, boolean includeDisks, boolean includeNics,
+                 boolean allContent, Long offset, Long limit) {
+        Filter filter = new Filter(UserVmJoinVO.class, "id", true, offset, limit);
+        Pair<List<Long>, String> ownerDetails = getResourceOwnerFilters();
+        List<UserVmJoinVO> vms = userVmJoinDao.listByZonesHypervisorNotTypesAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Hypervisor.HypervisorType.KVM,
+                Arrays.asList(UserVmManager.CKS_NODE), ownerDetails.first(), ownerDetails.second(), filter);
+        return UserVmJoinVOToVmConverter.toVmList(vms,
+                this::getHostById,
+                this::getDetailsByInstanceId,
+                (includeTags || allContent) ? this::listTagsByInstanceId : null,
+                (includeDisks || allContent) ? this::listDiskAttachmentsByInstanceId : null,
+                (includeNics || allContent) ? this::listNicsByInstance : null,
+                allContent ? this::getSharedFSForInstance: null,
+                allContent ? this::getSecurityGroupsForInstance: null,
+                allContent);
+    }
+
+    @ApiAccess(command = ListVMsCmd.class)
+    public Vm getInstance(String uuid, boolean includeTags, boolean includeDisks, boolean includeNics,
+              boolean allContent) {
+        UserVmJoinVO vo = userVmJoinDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        return UserVmJoinVOToVmConverter.toVm(vo,
+                this::getHostById,
+                this::getDetailsByInstanceId,
+                (includeTags || allContent) ? this::listTagsByInstanceId : null,
+                (includeDisks || allContent) ? this::listDiskAttachmentsByInstanceId : null,
+                (includeNics || allContent) ? this::listNicsByInstance : null,
+                allContent ? this::getSharedFSForInstance: null,
+                allContent ? this::getSecurityGroupsForInstance: null,
+                allContent);
+    }
+
+    @ApiAccess(command = DeployVMCmd.class)
+    public Vm createInstance(Vm request) {
+        if (request == null) {
+            throw new InvalidParameterValueException("Request VM data is empty");
+        }
+        logger.debug("VM create request [worker-vm: {}]", request.isWorkerVm());
+        OvfXmlUtil.updateFromConfiguration(request);
+        String name = request.getName();
+        if (StringUtils.isBlank(name)) {
+            throw new InvalidParameterValueException("Invalid name specified for the VM");
+        }
+        String displayName = name;
+        name = name.replace("_", "-");
+        Long zoneId = null;
+        Long clusterId = null;
+        if (request.getCluster() != null && StringUtils.isNotEmpty(request.getCluster().getId())) {
+            ClusterVO clusterVO = clusterDao.findByUuid(request.getCluster().getId());
+            if (clusterVO != null) {
+                zoneId = clusterVO.getDataCenterId();
+                clusterId = clusterVO.getId();
+            }
+        }
+        if (zoneId == null) {
+            throw new InvalidParameterValueException("Failed to determine datacenter for VM creation request");
+        }
+        DataCenterVO zone = dataCenterDao.findById(zoneId);
+        if (zone == null) {
+            throw new InvalidParameterValueException("DataCenter could not be determined for the request");
+        }
+        Integer cpu = null;
+        try {
+            cpu = Integer.valueOf(request.getCpu().getTopology().getSockets());
+        } catch (Exception ignored) {
+        }
+        if (cpu == null) {
+            throw new InvalidParameterValueException("CPU topology sockets must be specified");
+        }
+        Long memory = null;
+        try {
+            memory = Long.valueOf(request.getMemory());
+        } catch (Exception ignored) {
+        }
+        if (memory == null) {
+            throw new InvalidParameterValueException("Memory must be specified");
+        }
+        int memoryMB = (int)(memory / (1024L * 1024L));
+        String userdata = null;
+        if (request.getInitialization() != null) {
+            userdata = request.getInitialization().getCustomScript();
+        }
+        Pair<ApiConstants.BootType, ApiConstants.BootMode> bootOptions = Vm.Bios.retrieveBootOptions(request.getBios());
+        Account owner = getOwnerForInstanceCreation(request);
+        Ternary<Long, String, Long> ownerDetails = getOwnerDetailsForInstanceCreation(owner);
+        String serviceOfferingUuid = null;
+        if (request.getCpuProfile() != null && StringUtils.isNotEmpty(request.getCpuProfile().getId())) {
+            serviceOfferingUuid = request.getCpuProfile().getId();
+        }
+        String templateUuid = null;
+        if (request.getTemplate() != null && StringUtils.isNotEmpty(request.getTemplate().getId())) {
+            templateUuid = request.getTemplate().getId();
+        }
+        GuestOS guestOs = getGuestOsForInstance(request);
+        Pair<Vm, UserVm> result = createInstance(zone, clusterId, owner, ownerDetails.first(), ownerDetails.second(),
+                ownerDetails.third(), name, displayName, serviceOfferingUuid, cpu, memoryMB, templateUuid, guestOs,
+                userdata, bootOptions.first(), bootOptions.second(), request);
+        saveInstanceRestoreConfig(request, result.second());
+        return result.first();
+    }
+
+    @ApiAccess(command = UpdateVMCmd.class)
+    public Vm updateInstance(String uuid, Vm request) {
+        logger.warn("Received request to update VM with ID {}. No action, returning existing VM data.", uuid);
+        return getInstance(uuid, false, false, false, false);
+    }
+
+    @ApiAccess(command = DestroyVMCmd.class)
+    public VmAction deleteInstance(String uuid, boolean deleteVolumes, boolean async) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        boolean isAdmin = accountService.isRootAdmin(CallContext.current().getCallingAccountId());
+        try {
+            DestroyVMCmd cmd = isAdmin ? new DestroyVMCmdByAdmin() : new DestroyVMCmd();
+            cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.ID, vo.getUuid());
+            params.put(ApiConstants.EXPUNGE, Boolean.TRUE.toString());
+            if (deleteVolumes) {
+                List<String>volumeIds = volumeDao.findByInstance(vo.getId()).stream()
+                        .filter(v -> Volume.Type.DATADISK.equals(v.getVolumeType()))
+                        .map(VolumeVO::getUuid)
+                        .collect(Collectors.toList());
+                if (CollectionUtils.isNotEmpty(volumeIds)) {
+                    params.put(ApiConstants.VOLUME_IDS, String.join(",", volumeIds));
+                }
+            }
+            if (isAdmin) {
+                params.put(ApiConstants.FORCED, Boolean.TRUE.toString());
+            }
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for VM deletion");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            return AsyncJobJoinVOToJobConverter.toVmAction(jobVo, userVmJoinDao.findById(vo.getId()));
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to delete VM: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = StartVMCmd.class)
+    public VmAction startInstance(String uuid, boolean async) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        try {
+            StartVMCmd cmd = new StartVMCmd();
+            cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.ID, vo.getUuid());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for VM start");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            return AsyncJobJoinVOToJobConverter.toVmAction(jobVo, userVmJoinDao.findById(vo.getId()));
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to start VM: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = StopVMCmd.class)
+    public VmAction stopInstance(String uuid, boolean async) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        try {
+            StopVMCmd cmd = new StopVMCmd();
+            cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.ID, vo.getUuid());
+            params.put(ApiConstants.FORCED, Boolean.TRUE.toString());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for VM stop");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            return AsyncJobJoinVOToJobConverter.toVmAction(jobVo, userVmJoinDao.findById(vo.getId()));
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to stop VM: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = StopVMCmd.class)
+    public VmAction shutdownInstance(String uuid, boolean async) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        try {
+            StopVMCmd cmd = new StopVMCmd();
+            cmd.setHttpMethod(BaseCmd.HTTPMethod.POST.name());
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.ID, vo.getUuid());
+            params.put(ApiConstants.FORCED, Boolean.FALSE.toString());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for VM shutdown");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            return AsyncJobJoinVOToJobConverter.toVmAction(jobVo, userVmJoinDao.findById(vo.getId()));
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to shutdown VM: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListTagsCmd.class)
+    protected List<Tag> listTagsByInstanceId(final long instanceId) {
+        List<ResourceTagVO> tags = resourceTagDao.listByResourceTypeIdAndKeyPrefix(
+                ResourceTag.ResourceObjectType.UserVm, instanceId, VM_TAG_KEY);
+        return ResourceTagVOToTagConverter.toTags(tags);
+    }
+
+    @ApiAccess(command = ListVolumesCmd.class)
+    protected List<DiskAttachment> listDiskAttachmentsByInstanceId(final long instanceId) {
+        List<VolumeJoinVO> kvmVolumes = volumeJoinDao.listByInstanceId(instanceId);
+        return VolumeJoinVOToDiskConverter.toDiskAttachmentList(kvmVolumes, this::getVolumePhysicalSize);
+    }
+
+    @ApiAccess(command = ListVolumesCmd.class)
+    public List<DiskAttachment> listDiskAttachmentsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return listDiskAttachmentsByInstanceId(vo.getId());
+    }
+
+    @ApiAccess(command = ListVolumesCmd.class)
+    public List<Disk> listAllDisks(Long offset, Long limit) {
+        Filter filter = new Filter(VolumeJoinVO.class, "id", true, offset, limit);
+        Pair<List<Long>, String> ownerDetails = getResourceOwnerFilters();
+        List<VolumeJoinVO> kvmVolumes = volumeJoinDao.listByZonesHypervisorTypeAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), Hypervisor.HypervisorType.KVM,
+                ownerDetails.first(), ownerDetails.second(), filter);
+        return VolumeJoinVOToDiskConverter.toDiskList(kvmVolumes, this::getVolumePhysicalSize);
+    }
+
+    @ApiAccess(command = ListVolumesCmd.class)
+    public Disk getDisk(String uuid) {
+        VolumeVO vo = volumeDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Disk with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return VolumeJoinVOToDiskConverter.toDisk(volumeJoinDao.findByUuid(uuid), this::getVolumePhysicalSize);
+    }
+
+    protected void assignVolumeToAccount(VolumeVO volumeVO, long accountId) {
+        Account account = accountService.getActiveAccountById(accountId);
+        if (account == null) {
+            throw new InvalidParameterValueException("Account with ID " + accountId + " not found");
+        }
+        try {
+            AssignVolumeCmd cmd = new AssignVolumeCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            cmd.setVolumeId(volumeVO.getId());
+            params.put(ApiConstants.VOLUME_ID, volumeVO.getUuid());
+            if (Account.Type.PROJECT.equals(account.getType())) {
+                Project project = projectManager.findByProjectAccountId(account.getId());
+                if (project == null) {
+                    throw new InvalidParameterValueException("Project for " + account + " not found");
+                }
+                cmd.setProjectId(project.getId());
+                params.put(ApiConstants.PROJECT_ID, project.getUuid());
+            } else {
+                cmd.setAccountId(account.getId());
+                params.put(ApiConstants.ACCOUNT_ID, account.getUuid());
+            }
+            cmd.setFullUrlParams(params);
+            volumeApiService.assignVolumeToAccount(cmd);
+        } catch (ResourceAllocationException | CloudRuntimeException e) {
+            logger.error("Failed to assign {} to {}: {}", volumeVO, account, e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = AttachVolumeCmd.class)
+    public DiskAttachment attachInstanceDisk(final String vmUuid, final DiskAttachment request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        if (request == null || request.getDisk() == null || StringUtils.isEmpty(request.getDisk().getId())) {
+            throw new InvalidParameterValueException("Request disk data is empty");
+        }
+        VolumeVO volumeVO = volumeDao.findByUuid(request.getDisk().getId());
+        if (volumeVO == null) {
+            throw new InvalidParameterValueException("Disk with ID " + request.getDisk().getId() + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        if (vmVo.getAccountId() != volumeVO.getAccountId()) {
+            if (VeeamControlService.InstanceRestoreAssignOwner.value()) {
+                assignVolumeToAccount(volumeVO, vmVo.getAccountId());
+            } else {
+                throw new PermissionDeniedException("Disk with ID " + request.getDisk().getId() +
+                        " belongs to a different account and cannot be attached to the VM");
+            }
+        }
+        Long deviceId = null;
+        if (Boolean.parseBoolean(request.getBootable()) || Volume.Type.ROOT.equals(volumeVO.getVolumeType())) {
+            deviceId = 0L;
+        }
+        CallContext context = CallContext.current();
+        context.setEventDetails("Volume Id: " + volumeVO.getUuid() + " VmId: " + vmVo.getUuid());
+        context.setEventResourceType(ApiCommandResourceType.Volume);
+        context.setEventResourceId(volumeVO.getId());
+        Volume volume = volumeApiService.attachVolumeToVM(vmVo.getId(), volumeVO.getId(), deviceId, true);
+        processInstanceRestoreConfigIfNeeded(vmVo, volume);
+        VolumeJoinVO attachedVolumeVO = volumeJoinDao.findById(volume.getId());
+        return VolumeJoinVOToDiskConverter.toDiskAttachment(attachedVolumeVO, this::getVolumePhysicalSize);
+    }
+
+    @ApiAccess(command = DetachVolumeCmd.class)
+    public void detachInstanceDisk(final String vmUuid, final String volumeUuid) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        if (!VirtualMachine.State.Stopped.equals(vmVo.getState())) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " must be in stopped state to detach disk");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        VolumeVO volumeVO = volumeDao.findByUuid(volumeUuid);
+        if (volumeVO == null) {
+            throw new InvalidParameterValueException("Volume with ID " + volumeUuid + " not found");
+        }
+        if (volumeVO.getInstanceId() != vmVo.getId()) {
+            throw new InvalidParameterValueException("Volume with ID " + volumeUuid + " is not attached to VM with ID " + vmUuid);
+        }
+        CallContext context = CallContext.current();
+        context.setEventDetails("Volume Id: " + volumeVO.getUuid() + " VmId: " + vmVo.getUuid());
+        context.setEventResourceType(ApiCommandResourceType.Volume);
+        context.setEventResourceId(volumeVO.getId());
+        DetachVolumeCmd cmd = new DetachVolumeCmd();
+        ComponentContext.inject(cmd);
+        cmd.setId(volumeVO.getId());
+        volumeApiService.detachVolumeFromVM(cmd);
+    }
+
+    @ApiAccess(command = CreateVolumeCmd.class)
+    public Disk createDisk(Disk request) {
+        if (request == null) {
+            throw new InvalidParameterValueException("Request disk data is empty");
+        }
+        String name = request.getName();
+        if (request.getStorageDomains() == null || CollectionUtils.isEmpty(request.getStorageDomains().getItems()) ||
+                request.getStorageDomains().getItems().size() > 1) {
+            throw new InvalidParameterValueException("Exactly one storage domain must be specified");
+        }
+        StorageDomain domain = request.getStorageDomains().getItems().get(0);
+        if (domain == null || domain.getId() == null) {
+            throw new InvalidParameterValueException("Storage domain ID must be specified");
+        }
+        StoragePoolVO pool = primaryDataStoreDao.findByUuid(domain.getId());
+        if (pool == null) {
+            throw new InvalidParameterValueException("Storage domain with ID " + domain.getId() + " not found");
+        }
+        String sizeStr = request.getProvisionedSize();
+        if (StringUtils.isBlank(sizeStr)) {
+            throw new InvalidParameterValueException("Provisioned size must be specified");
+        }
+        long provisionedSizeInGb = getProvisionedSizeInGb(sizeStr);
+        Long initialSize = null;
+        if (StringUtils.isNotBlank(request.getInitialSize())) {
+            try {
+                initialSize = Long.parseLong(request.getInitialSize());
+            } catch (NumberFormatException ignored) {}
+        }
+        Account caller = CallContext.current().getCallingAccount();
+        DataCenterVO zone = dataCenterDao.findById(pool.getDataCenterId());
+        if (zone == null || !Grouping.AllocationState.Enabled.equals(zone.getAllocationState())) {
+            throw new InvalidParameterValueException("Datacenter for the specified storage domain is not found or not active");
+        }
+        Long diskOfferingId = volumeApiService.getCustomDiskOfferingIdForVolumeUpload(caller, zone,
+                VeeamControlService.InstanceEncryptVolumes.valueIn(zone.getId()));
+        if (diskOfferingId == null) {
+            throw new CloudRuntimeException("Failed to find custom offering for disk" + zone.getName());
+        }
+        return createDisk(caller, pool, name, diskOfferingId, provisionedSizeInGb, initialSize);
+    }
+
+    @ApiAccess(command = DestroyVolumeCmd.class)
+    public void deleteDisk(String uuid) {
+        VolumeVO vo = volumeDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Disk with ID " + uuid + " not found");
+        }
+        CallContext context = CallContext.current();
+        context.setEventDetails("Volume Id: " + vo.getUuid());
+        context.setEventResourceType(ApiCommandResourceType.Volume);
+        context.setEventResourceId(vo.getId());
+        volumeApiService.destroyVolume(vo.getId(), CallContext.current().getCallingAccount(), true, false);
+    }
+
+    @ApiAccess(command = UpdateVolumeCmd.class)
+    public Disk updateDisk(String uuid, Disk request) {
+        VolumeVO vo = volumeDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Disk with ID " + uuid + " not found");
+        }
+        logger.warn("Update disk is not implemented, returning disk ID: {} as it is", uuid);
+        return getDisk(uuid);
+    }
+
+    @ApiAccess(command = UpdateVolumeCmd.class)
+    public Disk copyDisk(String uuid) {
+        throw new InvalidParameterValueException("Copy Disk with ID " + uuid + " not implemented");
+    }
+
+    @ApiAccess(command = UpdateVolumeCmd.class)
+    public Disk reduceDisk(String uuid) {
+        throw new InvalidParameterValueException("Reduce Disk with ID " + uuid + " not implemented");
+    }
+
+    @ApiAccess(command = ListNicsCmd.class)
+    public List<Nic> listNicsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return listNicsByInstance(vo.getId(), vo.getUuid());
+    }
+
+    @ApiAccess(command = AddNicToVMCmd.class)
+    public Nic attachInstanceNic(final String vmUuid, final Nic request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        if (request == null || request.getVnicProfile() == null || StringUtils.isEmpty(request.getVnicProfile().getId())) {
+            throw new InvalidParameterValueException("Request nic data is empty");
+        }
+        NetworkVO networkVO = networkDao.findByUuid(request.getVnicProfile().getId());
+        if (networkVO == null) {
+            throw new InvalidParameterValueException("VNic profile " + request.getVnicProfile().getId() + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, networkVO);
+        if (vmVo.getAccountId() != networkVO.getAccountId() &&
+                networkVO.getAccountId() != Account.ACCOUNT_ID_SYSTEM &&
+                VeeamControlService.InstanceRestoreAssignOwner.value() &&
+                accountCannotAccessNetwork(networkVO, vmVo.getAccountId())) {
+            assignVmToAccount(vmVo, networkVO.getAccountId());
+        }
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(
+                vmVo.getId(), List.of(RESTORE_CONFIG, WORKER_VM_IP_DETAIL));
+        String restoreConfig = details.get(RESTORE_CONFIG);
+        Pair<String, String> nicDetails = getValidatedInstanceNicDetails(restoreConfig, networkVO);
+        String workerVmIp = details.get(WORKER_VM_IP_DETAIL);
+        if (StringUtils.isNotBlank(workerVmIp)) {
+            nicDetails = new Pair<>(null, workerVmIp);
+            removeInstanceWorkerVmIp(vmVo);
+        }
+        CallContext context = CallContext.current();
+        context.setEventResourceType(ApiCommandResourceType.VirtualMachine);
+        context.setEventResourceId(vmVo.getId());
+        CallContext.current().setEventDetails("Vm Id: " + vmVo.getUuid() + " Network Id: " + networkVO.getUuid());
+        AddNicToVMCmd cmd = new AddNicToVMCmd();
+        ComponentContext.inject(cmd);
+        cmd.setVmId(vmVo.getId());
+        cmd.setNetworkId(networkVO.getId());
+        cmd.setMacAddress(nicDetails.first());
+        cmd.setIpaddr(nicDetails.second());
+        if (request.getMac() != null && StringUtils.isNotBlank(request.getMac().getAddress())) {
+            cmd.setMacAddress(request.getMac().getAddress());
+        }
+        userVmManager.addNicToVirtualMachine(cmd);
+        NicVO nic = nicDao.findByInstanceIdAndNetworkIdIncludingRemoved(networkVO.getId(), vmVo.getId());
+        if (nic == null) {
+            throw new CloudRuntimeException("Failed to attach NIC to VM");
+        }
+        updateInstanceSecurityGroupsIfNeeded(vmVo, restoreConfig, networkVO);
+        return NicVOToNicConverter.toNic(nic, vmUuid, this::getNetworkById);
+    }
+
+    @ApiAccess(command = ListImageTransfersCmd.class)
+    public List<ImageTransfer> listAllImageTransfers(Long offset, Long limit) {
+        Filter filter = new Filter(ImageTransferVO.class, "id", true, offset, limit);
+        Pair<List<Long>, List<Long>> ownerDetails = getResourceOwnerFiltersWithDomainIds();
+        List<ImageTransferVO> imageTransfers = imageTransferDao.listByZonesAndOwners(
+                kvmBackupExportService.listCompatibleDataCenterIds(), ownerDetails.first(),
+                ownerDetails.second(), filter);
+        return ImageTransferVOToImageTransferConverter.toImageTransferList(imageTransfers, this::getHostById, this::getVolumeById);
+    }
+
+    @ApiAccess(command = ListImageTransfersCmd.class)
+    public ImageTransfer getImageTransfer(String uuid) {
+        ImageTransferVO vo = imageTransferDao.findByUuidIncludingRemoved(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Image transfer with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return ImageTransferVOToImageTransferConverter.toImageTransfer(vo, this::getHostById, this::getVolumeById);
+    }
+
+    @ApiAccess(command = CreateImageTransferCmd.class)
+    public ImageTransfer createImageTransfer(ImageTransfer request) {
+        if (request == null) {
+            throw new InvalidParameterValueException("Request image transfer data is empty");
+        }
+        if (request.getDisk() == null || StringUtils.isBlank(request.getDisk().getId())) {
+            throw new InvalidParameterValueException("Disk ID must be specified");
+        }
+        VolumeJoinVO volumeVO = volumeJoinDao.findByUuid(request.getDisk().getId());
+        if (volumeVO == null) {
+            throw new InvalidParameterValueException("Disk with ID " + request.getDisk().getId() + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false,
+                volumeVO);
+        Direction direction = EnumUtils.getEnum(Direction.class, request.getDirection());
+        if (direction == null) {
+            throw new InvalidParameterValueException("Invalid or missing direction");
+        }
+        Format format = EnumUtils.getEnum(Format.class, request.getFormat());
+        Long backupId = null;
+        if (request.getBackup() != null && StringUtils.isNotBlank(request.getBackup().getId())) {
+            BackupVO backupVO = backupDao.findByUuid(request.getBackup().getId());
+            if (backupVO == null) {
+                throw new InvalidParameterValueException("Backup with ID " + request.getBackup().getId() + " not found");
+            }
+            backupId = backupVO.getId();
+        }
+        return createImageTransfer(backupId, volumeVO.getId(), direction, format);
+    }
+
+    @ApiAccess(command = FinalizeImageTransferCmd.class)
+    public boolean cancelImageTransfer(String uuid) {
+        ImageTransferVO vo = imageTransferDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Image transfer with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry, false, vo);
+        return kvmBackupExportService.cancelImageTransfer(vo.getId());
+    }
+
+    @ApiAccess(command = FinalizeImageTransferCmd.class)
+    public boolean finalizeImageTransfer(String uuid) {
+        ImageTransferVO vo = imageTransferDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Image transfer with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry, false, vo);
+        return kvmBackupExportService.finalizeImageTransfer(vo.getId());
+    }
+
+    @ApiAccess(command = ListAsyncJobsCmd.class)
+    public List<Job> listPendingJobs() {
+        List<Long> jobIds = asyncJobDao.listPendingJobIdsForAccount(CallContext.current().getCallingAccountId());
+        List<AsyncJobJoinVO> jobJoinVOs = asyncJobJoinDao.listByIds(jobIds);
+        return AsyncJobJoinVOToJobConverter.toJobList(jobJoinVOs);
+    }
+
+    @ApiAccess(command = ListAsyncJobsCmd.class)
+    public Job getJob(String uuid) {
+        final AsyncJobJoinVO vo = asyncJobJoinDao.findByUuidIncludingRemoved(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Job with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return AsyncJobJoinVOToJobConverter.toJob(vo);
+    }
+
+    @ApiAccess(command = ListVMSnapshotCmd.class)
+    public List<Snapshot> listSnapshotsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        List<VMSnapshotVO> snapshots = vmSnapshotDao.findByVm(vo.getId());
+        return VmSnapshotVOToSnapshotConverter.toSnapshotList(snapshots, vo.getUuid());
+    }
+
+    @ApiAccess(command = CreateVMSnapshotCmd.class)
+    public Snapshot createInstanceSnapshot(final String vmUuid, final Snapshot request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        try {
+            CreateVMSnapshotCmd cmd = new CreateVMSnapshotCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VIRTUAL_MACHINE_ID, vmVo.getUuid());
+            params.put(ApiConstants.VM_SNAPSHOT_DESCRIPTION, request.getDescription());
+            params.put(ApiConstants.VM_SNAPSHOT_MEMORY, String.valueOf(Boolean.parseBoolean(request.getPersistMemorystate())));
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            if (result.objectId == null) {
+                throw new CloudRuntimeException("No snapshot ID returned");
+            }
+            VMSnapshotVO vo = vmSnapshotDao.findById(result.objectId);
+            if (vo == null) {
+                throw new CloudRuntimeException("Snapshot not found");
+            }
+            return VmSnapshotVOToSnapshotConverter.toSnapshot(vo, vmVo.getUuid());
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to create snapshot: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListVMSnapshotCmd.class)
+    public Snapshot getSnapshot(String uuid) {
+        VMSnapshotVO vo = vmSnapshotDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Snapshot with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        UserVmVO vm = userVmDao.findById(vo.getVmId());
+        return VmSnapshotVOToSnapshotConverter.toSnapshot(vo, vm.getUuid());
+    }
+
+    public ResourceAction deleteSnapshot(String uuid, boolean async) {
+        ResourceAction action = null;
+        VMSnapshotVO vo = vmSnapshotDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Snapshot with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vo);
+        try {
+            DeleteVMSnapshotCmd cmd = new DeleteVMSnapshotCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VM_SNAPSHOT_ID, vo.getUuid());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for snapshot deletion");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            action = AsyncJobJoinVOToJobConverter.toAction(jobVo);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to delete snapshot: " + e.getMessage(), e);
+        }
+        return action;
+    }
+
+    @ApiAccess(command = RevertToVMSnapshotCmd.class)
+    public ResourceAction revertInstanceToSnapshot(String uuid, boolean async) {
+        ResourceAction action = null;
+        VMSnapshotVO vo = vmSnapshotDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Snapshot with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vo);
+        try {
+            RevertToVMSnapshotCmd cmd = new RevertToVMSnapshotCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VM_SNAPSHOT_ID, vo.getUuid());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            AsyncJobJoinVO jobVo = asyncJobJoinDao.findById(result.jobId);
+            if (jobVo == null) {
+                throw new CloudRuntimeException("Failed to find job for snapshot revert");
+            }
+            if (!async) {
+                waitForJobCompletion(jobVo);
+            }
+            action = AsyncJobJoinVOToJobConverter.toAction(jobVo);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to revert to snapshot: " + e.getMessage(), e);
+        }
+        return action;
+    }
+
+    @ApiAccess(command = ListBackupsCmd.class)
+    public List<Backup> listBackupsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        List<BackupVO> backups = backupDao.searchByVmIds(List.of(vo.getId()));
+        return BackupVOToBackupConverter.toBackupList(backups, id -> vo, this::getHostById);
+    }
+
+    protected void validateInstanceStorage(UserVmVO vm) {
+        List<VolumeVO> volumes = volumeDao.findUsableVolumesForInstance(vm.getId());
+        List<Long> storageIds = volumes.stream().map(VolumeVO::getPoolId).distinct().collect(Collectors.toList());
+        List<StoragePoolVO> pools = primaryDataStoreDao.listByIds(storageIds);
+        pools.stream().filter(p -> !SUPPORTED_STORAGE_TYPES.contains(p.getPoolType()))
+                .findAny().ifPresent(p -> {
+                    throw new InvalidParameterValueException("VM is using storage pool " + p.getName() +
+                            " of type " + p.getPoolType() +
+                            " which is not supported for backup operations");
+                });
+    }
+
+    @ApiAccess(command = StartBackupCmd.class)
+    public Backup createInstanceBackup(final String vmUuid, final Backup request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        validateInstanceBackupConditions(vmVo);
+        validateInstanceStorage(vmVo);
+        try {
+            StartBackupCmd cmd = new StartBackupCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VIRTUAL_MACHINE_ID, vmVo.getUuid());
+            params.put(ApiConstants.NAME, request.getName());
+            params.put(ApiConstants.DESCRIPTION, request.getDescription());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            if (result == null || result.objectId == null) {
+                throw new CloudRuntimeException("Unexpected backup ID returned");
+            }
+            BackupVO vo = backupDao.findById(result.objectId);
+            if (vo == null) {
+                throw new CloudRuntimeException("Backup not found");
+            }
+            return BackupVOToBackupConverter.toBackup(vo, id -> vmVo, this::getHostById, this::getBackupDisks);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to create backup: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListBackupsCmd.class)
+    public Backup getBackup(String uuid) {
+        BackupVO vo = backupDao.findByUuidIncludingRemoved(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("Backup with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        return BackupVOToBackupConverter.toBackup(vo, id -> userVmDao.findById(id), this::getHostById,
+                this::getBackupDisks);
+    }
+
+    @ApiAccess(command = ListBackupsCmd.class)
+    public List<Disk> listDisksByBackupUuid(final String uuid) {
+        throw new InvalidParameterValueException("List Backup Disks with ID " + uuid + " not implemented");
+        // This won't be feasible with current structure
+    }
+
+    @ApiAccess(command = FinalizeBackupCmd.class)
+    public Backup finalizeBackup(final String vmUuid, final String backupUuid) {
+        UserVmVO vm = userVmDao.findByUuid(vmUuid);
+        if (vm == null) {
+            throw new InvalidParameterValueException("Instance with ID " + vmUuid + " not found");
+        }
+        BackupVO backup = backupDao.findByUuid(backupUuid);
+        if (backup == null) {
+            throw new InvalidParameterValueException("Backup with ID " + backupUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, backup);
+        try {
+            FinalizeBackupCmd cmd = new FinalizeBackupCmd();
+            ComponentContext.inject(cmd);
+            Map<String, String> params = new HashMap<>();
+            params.put(ApiConstants.VIRTUAL_MACHINE_ID, vm.getUuid());
+            params.put(ApiConstants.ID, backup.getUuid());
+            ApiServerService.AsyncCmdResult result = processAsyncCmdWithContext(cmd, params);
+            if (result == null) {
+                throw new CloudRuntimeException("Failed to finalize backup");
+            }
+            backup = backupDao.findByIdIncludingRemoved(backup.getId());
+            return BackupVOToBackupConverter.toBackup(backup, id -> vm, this::getHostById, this::getBackupDisks);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to finalize backup: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListBackupsCmd.class)
+    protected List<Disk> getBackupDisks(final BackupVO backup) {
+        List<org.apache.cloudstack.backup.Backup.VolumeInfo> volumeInfos = backup.getBackedUpVolumes();
+        if (CollectionUtils.isEmpty(volumeInfos)) {
+            return Collections.emptyList();
+        }
+        return VolumeJoinVOToDiskConverter.toDiskListFromVolumeInfos(volumeInfos);
+    }
+
+    @ApiAccess(command = ListVmCheckpointsCmd.class)
+    public List<Checkpoint> listCheckpointsByInstanceUuid(final String uuid) {
+        UserVmVO vo = userVmDao.findByUuid(uuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + uuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), null, false, vo);
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(vo.getId());
+        Checkpoint checkpoint = UserVmVOToCheckpointConverter.toCheckpoint(
+                details.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID),
+                details.get(VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME));
+        if (checkpoint == null) {
+            return Collections.emptyList();
+        }
+        return List.of(checkpoint);
+    }
+
+    @ApiAccess(command = DeleteVmCheckpointCmd.class)
+    public void deleteCheckpoint(String vmUuid, String checkpointId) {
+        UserVmVO vo = userVmDao.findByUuid(vmUuid);
+        if (vo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry, false, vo);
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(vo.getId());
+        if (!Objects.equals(details.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID), checkpointId)) {
+            logger.warn("Checkpoint ID {} does not match active checkpoint for VM {}", checkpointId, vmUuid);
+            return;
+        }
+        try {
+            DeleteVmCheckpointCmd cmd = new DeleteVmCheckpointCmd();
+            ComponentContext.inject(cmd);
+            cmd.setVmId(vo.getId());
+            cmd.setCheckpointId(checkpointId);
+            kvmBackupExportService.deleteVmCheckpoint(cmd);
+        } catch (Exception e) {
+            throw new CloudRuntimeException("Failed to delete checkpoint: " + e.getMessage(), e);
+        }
+    }
+
+    @ApiAccess(command = ListTagsCmd.class)
+    public List<Tag> listAllTags(final Long offset, final Long limit) {
+        List<Tag> tags = new ArrayList<>(getDummyTags().values());
+        Filter filter = new Filter(ResourceTagVO.class, "id", true, offset, limit);
+        Pair<List<Long>, List<Long>> ownerDetails = getResourceOwnerFiltersWithDomainIds();
+        List<String> vmResourceTags = resourceTagDao.listByResourceTypeKeyPrefixAndOwners(
+                ResourceTag.ResourceObjectType.UserVm, VM_TAG_KEY, ownerDetails.first(), ownerDetails.second(), filter);
+        if (CollectionUtils.isNotEmpty(vmResourceTags)) {
+            tags.addAll(ResourceTagVOToTagConverter.toTagsFromValues(vmResourceTags));
+        }
+        return tags;
+    }
+
+    @ApiAccess(command = ListTagsCmd.class)
+    public Tag getTag(String uuid) {
+        if (BaseDto.ZERO_UUID.equals(uuid)) {
+            return ResourceTagVOToTagConverter.getRootTag();
+        }
+        Tag tag = getDummyTags().get(uuid);
+        if (tag == null) {
+            ResourceTagVO resourceTagVO = resourceTagDao.findByResourceTypeKeyPrefixAndValue(
+                    ResourceTag.ResourceObjectType.UserVm, VM_TAG_KEY, uuid);
+            accountService.checkAccess(CallContext.current().getCallingAccount(), null, false,
+                    resourceTagVO);
+            if (resourceTagVO != null) {
+                tag = ResourceTagVOToTagConverter.toTag(resourceTagVO);
+            }
+        }
+        if (tag == null) {
+            throw new InvalidParameterValueException("Tag with ID " + uuid + " not found");
+        }
+        return tag;
+    }
+
+    @ApiAccess(command = CreateTagsCmd.class)
+    public Tag createInstanceTag(final String vmUuid, final Tag request) {
+        UserVmVO vmVo = userVmDao.findByUuid(vmUuid);
+        if (vmVo == null) {
+            throw new InvalidParameterValueException("VM with ID " + vmUuid + " not found");
+        }
+        accountService.checkAccess(CallContext.current().getCallingAccount(), SecurityChecker.AccessType.OperateEntry,
+                false, vmVo);
+        Map<String, String> tags = new HashMap<>();
+        String name = request.getId();
+        tags.put(String.format( "%s%s", VM_TAG_KEY, UuidUtils.first(UUID.randomUUID().toString())), name);
+        try {
+            List<ResourceTag> resourceTags = taggedResourceService.createTags(Collections.singletonList(vmUuid),
+                    ResourceTag.ResourceObjectType.UserVm, tags, null);
+            ResourceTagVO tag = null;
+            if (CollectionUtils.isNotEmpty(resourceTags)) {
+                tag = resourceTagDao.findById(resourceTags.get(0).getId());
+            }
+            if (tag == null) {
+                throw new CloudRuntimeException("Unknown error");
+            }
+            return ResourceTagVOToTagConverter.toTag(tag);
+        } catch (Exception e) {
+            throw new CloudRuntimeException(String.format("Failed to create tag for %s: %s", name, e.getMessage()), e);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ApiRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ApiRouteHandler.java
new file mode 100644
index 000000000000..5380b1734881
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ApiRouteHandler.java
@@ -0,0 +1,129 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Api;
+import org.apache.cloudstack.veeam.api.dto.ApiSummary;
+import org.apache.cloudstack.veeam.api.dto.EmptyElement;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.ProductInfo;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.SummaryCount;
+import org.apache.cloudstack.veeam.api.dto.Version;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+
+import com.cloud.utils.component.ManagerBase;
+
+public class ApiRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Inject
+    VeeamControlService veeamControlService;
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith("/api");
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleRootApiRequest(req, resp, outFormat, io);
+            return;
+        }
+        io.notFound(resp, null, outFormat);
+    }
+
+    private void handleRootApiRequest(HttpServletRequest req, HttpServletResponse resp, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        io.getWriter().write(resp, HttpServletResponse.SC_OK,
+                createApiObject(VeeamControlService.ContextPath.value() + BASE_ROUTE),
+                outFormat);
+    }
+
+    protected Api createApiObject(String basePath) {
+        Api api = new Api();
+
+        /* ---------------- Links ---------------- */
+        List<Link> links = new ArrayList<>();
+        add(links, basePath + "/clusters", "clusters");
+        add(links, basePath + "/clusters?search={query}", "clusters/search");
+        add(links, basePath + "/datacenters", "datacenters");
+        add(links, basePath + "/datacenters?search={query}", "datacenters/search");
+        add(links, basePath + "/hosts", "hosts");
+        add(links, basePath + "/hosts?search={query}", "hosts/search");
+        add(links, basePath + "/networks", "networks");
+        add(links, basePath + "/networks?search={query}", "networks/search");
+        add(links, basePath + "/storagedomains", "storagedomains");
+        add(links, basePath + "/storagedomains?search={query}", "storagedomains/search");
+        add(links, basePath + "/vms", "vms");
+        add(links, basePath + "/vms?search={query}", "vms/search");
+        add(links, basePath + "/disks", "disks");
+        add(links, basePath + "/disks?search={query}", "disks/search");
+
+        api.setLink(links);
+
+        /* ---------------- Engine backup ---------------- */
+        api.setEngineBackup(new EmptyElement());
+
+        /* ---------------- Product info ---------------- */
+        ProductInfo productInfo = new ProductInfo();
+        productInfo.setInstanceId(veeamControlService.getInstanceId());
+        productInfo.name = VeeamControlService.PLUGIN_NAME;
+
+        productInfo.version = Version.fromPackageAndCSVersion(true);
+        api.setProductInfo(productInfo);
+
+        /* ---------------- Summary ---------------- */
+        ApiSummary summary = new ApiSummary();
+        summary.setHosts(new SummaryCount(1, 1));
+        summary.setStorageDomains(new SummaryCount(1, 2));
+        summary.setUsers(new SummaryCount(1, 1));
+        summary.setVms(new SummaryCount(1, 8));
+        api.setSummary(summary);
+
+        /* ---------------- Time ---------------- */
+        api.setTime(System.currentTimeMillis());
+
+        /* ---------------- Users ---------------- */
+        String userId = serverAdapter.getServiceAccount().first().getUuid();
+        api.setAuthenticatedUser(Ref.of(basePath + "/users/" + userId, userId));
+        api.setEffectiveUser(Ref.of(basePath + "/users/" + userId, userId));
+
+        return api;
+    }
+
+    private static void add(List<Link> links, String href, String rel) {
+        links.add(Link.of(rel, href));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ClustersRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ClustersRouteHandler.java
new file mode 100644
index 000000000000..f4107ff3735e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ClustersRouteHandler.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.utils.component.ManagerBase;
+
+public class ClustersRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/clusters";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Cluster> result = serverAdapter.listAllClusters(query.getOffset(), query.getLimit());
+            NamedList<Cluster> response = NamedList.of("cluster", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            Cluster response = serverAdapter.getCluster(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandler.java
new file mode 100644
index 000000000000..a06af4f24429
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandler.java
@@ -0,0 +1,151 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class DataCentersRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/datacenters";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            } else if (idAndSubPath.size() == 2) {
+                String subPath = idAndSubPath.get(1);
+                if ("storagedomains".equals(subPath)) {
+                    handleGetStorageDomainsByDcId(id, req, resp, outFormat, io);
+                    return;
+                }
+                if ("networks".equals(subPath)) {
+                    handleGetNetworksByDcId(id, req, resp, outFormat, io);
+                    return;
+                }
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        ListQuery query = ListQuery.fromRequest(req);
+        final List<DataCenter> result = serverAdapter.listAllDataCenters(query.getOffset(), query.getLimit());
+        NamedList<DataCenter> response = NamedList.of("data_center", result);
+        io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            DataCenter response = serverAdapter.getDataCenter(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetStorageDomainsByDcId(final String id, final HttpServletRequest req,
+             final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            List<StorageDomain> storageDomains = serverAdapter.listStorageDomainsByDcId(id, query.getOffset(),
+                    query.getMax());
+            NamedList<StorageDomain> response = NamedList.of("storage_domain", storageDomains);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetNetworksByDcId(final String id, final HttpServletRequest req,
+           final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            List<Network> networks = serverAdapter.listNetworksByDcId(id, query.getOffset(),
+                    query.getMax());
+            NamedList<Network> response = NamedList.of("network", networks);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DisksRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DisksRouteHandler.java
new file mode 100644
index 000000000000..d12745769e1b
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/DisksRouteHandler.java
@@ -0,0 +1,201 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.fasterxml.jackson.core.JsonProcessingException;
+
+public class DisksRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/disks";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            if ("GET".equalsIgnoreCase(method)) {
+                handleGet(req, resp, outFormat, io);
+                return;
+            }
+            if ("POST".equalsIgnoreCase(method)) {
+                handlePost(req, resp, outFormat, io);
+                return;
+            }
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                if (!"GET".equalsIgnoreCase(method) && !"DELETE".equalsIgnoreCase(method) &&
+                        !"PUT".equalsIgnoreCase(method)) {
+                    io.methodNotAllowed(resp, "GET, DELETE, PUT", outFormat);
+                    return;
+                }
+                if ("GET".equalsIgnoreCase(method)) {
+                    handleGetById(id, resp, outFormat, io);
+                    return;
+                }
+                if ("DELETE".equalsIgnoreCase(method)) {
+                    handleDeleteById(id, resp, outFormat, io);
+                    return;
+                }
+                if ("PUT".equalsIgnoreCase(method)) {
+                    handlePutById(id, req, resp, outFormat, io);
+                    return;
+                }
+            } else if (idAndSubPath.size() == 2) {
+                String subPath = idAndSubPath.get(1);
+                if ("copy".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handlePostDiskCopy(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("reduce".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handlePostDiskReduce(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                }
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Disk> result = serverAdapter.listAllDisks(query.getOffset(), query.getLimit());
+            NamedList<Disk> response = NamedList.of("disk", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePost(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Disk request = io.getMapper().jsonMapper().readValue(data, Disk.class);
+            Disk response = serverAdapter.createDisk(request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            Disk response = serverAdapter.getDisk(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                 final VeeamControlServlet io) throws IOException {
+        try {
+            serverAdapter.deleteDisk(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, "Deleted disk ID: " + id, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePutById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                         final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Disk request = io.getMapper().jsonMapper().readValue(data, Disk.class);
+            Disk response = serverAdapter.updateDisk(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostDiskCopy(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                                  final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Disk response = serverAdapter.copyDisk(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostDiskReduce(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                                  final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Disk response = serverAdapter.reduceDisk(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/HostsRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/HostsRouteHandler.java
new file mode 100644
index 000000000000..931291714c6c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/HostsRouteHandler.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.utils.component.ManagerBase;
+
+public class HostsRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/hosts";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Host> result = serverAdapter.listAllHosts(query.getOffset(), query.getLimit());
+            NamedList<Host> response = NamedList.of("host", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            Host response = serverAdapter.getHost(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (PermissionDeniedException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandler.java
new file mode 100644
index 000000000000..1a04e4028cf0
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandler.java
@@ -0,0 +1,162 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.fasterxml.jackson.core.JsonProcessingException;
+
+public class ImageTransfersRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/imagetransfers";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            if ("GET".equalsIgnoreCase(method)) {
+                handleGet(req, resp, outFormat, io);
+                return;
+            }
+            if ("POST".equalsIgnoreCase(method)) {
+                handlePost(req, resp, outFormat, io);
+                return;
+            }
+        }
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                if (!"GET".equalsIgnoreCase(method)) {
+                    io.methodNotAllowed(resp, "GET", outFormat);
+                    return;
+                }
+                handleGetById(id, resp, outFormat, io);
+                return;
+            } else if (idAndSubPath.size() == 2) {
+                if (!"POST".equalsIgnoreCase(method)) {
+                    io.methodNotAllowed(resp, "POST", outFormat);
+                    return;
+                }
+                String subPath = idAndSubPath.get(1);
+                if ("cancel".equals(subPath)) {
+                    handleCancelById(id, resp, outFormat, io);
+                    return;
+                }
+                if ("finalize".equals(subPath)) {
+                    handleFinalizeById(id, resp, outFormat, io);
+                    return;
+                }
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<ImageTransfer> result = serverAdapter.listAllImageTransfers(query.getOffset(), query.getLimit());
+            NamedList<ImageTransfer> response = NamedList.of("image_transfer", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePost(final HttpServletRequest req, final HttpServletResponse resp,
+                           Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            ImageTransfer request = io.getMapper().jsonMapper().readValue(data, ImageTransfer.class);
+            ImageTransfer response = serverAdapter.createImageTransfer(request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            ImageTransfer response = serverAdapter.getImageTransfer(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleCancelById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            serverAdapter.cancelImageTransfer(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, "Image transfer cancelled successfully", outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleFinalizeById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                    final VeeamControlServlet io) throws IOException {
+        try {
+            serverAdapter.finalizeImageTransfer(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, "Image transfer finalized successfully", outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/JobsRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/JobsRouteHandler.java
new file mode 100644
index 000000000000..95e4e3c9559a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/JobsRouteHandler.java
@@ -0,0 +1,108 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class JobsRouteHandler  extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/jobs";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                             Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            final List<Job> result = serverAdapter.listPendingJobs();
+            NamedList<Job> response = NamedList.of("job", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                 final VeeamControlServlet io) throws IOException {
+        try {
+            Job response = serverAdapter.getJob(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/NetworksRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/NetworksRouteHandler.java
new file mode 100644
index 000000000000..2d1f0962c2b6
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/NetworksRouteHandler.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class NetworksRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/networks";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Network> result = serverAdapter.listAllNetworks(query.getOffset(), query.getLimit());
+            NamedList<Network> response = NamedList.of("network", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            Network response = serverAdapter.getNetwork(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/TagsRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/TagsRouteHandler.java
new file mode 100644
index 000000000000..e1daefc1c443
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/TagsRouteHandler.java
@@ -0,0 +1,111 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class TagsRouteHandler  extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/tags";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat,
+                   VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                             Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Tag> result = serverAdapter.listAllTags(query.getOffset(), query.getLimit());
+            NamedList<Tag> response = NamedList.of("tag", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                 final VeeamControlServlet io) throws IOException {
+        try {
+            Tag response = serverAdapter.getTag(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VmsRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VmsRouteHandler.java
new file mode 100644
index 000000000000..10ca7f80f04e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VmsRouteHandler.java
@@ -0,0 +1,580 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+import java.util.Map;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.Backup;
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.cloudstack.veeam.api.dto.VmAction;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.fasterxml.jackson.core.JsonProcessingException;
+
+public class VmsRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/vms";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method) && !"DELETE".equalsIgnoreCase(method)) {
+                io.methodNotAllowed(resp, "GET, POST, DELETE", outFormat);
+                return;
+            }
+            if ("GET".equalsIgnoreCase(method)) {
+                handleGet(req, resp, outFormat, io);
+                return;
+            }
+            if ("POST".equalsIgnoreCase(method)) {
+                handlePost(req, resp, outFormat, io);
+                return;
+            }
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                if (!"GET".equalsIgnoreCase(method) && !"PUT".equalsIgnoreCase(method) && !"DELETE".equalsIgnoreCase(method)) {
+                    io.methodNotAllowed(resp, "GET, PUT, DELETE", outFormat);
+                } else if ("GET".equalsIgnoreCase(method)) {
+                    handleGetById(id, req, resp, outFormat, io);
+                } else if ("PUT".equalsIgnoreCase(method)) {
+                    handleUpdateById(id, req, resp, outFormat, io);
+                } else if ("DELETE".equalsIgnoreCase(method)) {
+                    handleDeleteById(id, req, resp, outFormat, io);
+                }
+                return;
+            } else if (idAndSubPath.size() == 2) {
+                String subPath = idAndSubPath.get(1);
+                if ("start".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleStartVmById(id, req, resp, outFormat, io);
+                    } else {
+                         io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("stop".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleStopVmById(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("shutdown".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleShutdownVmById(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("diskattachments".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetDiskAttachmentsByVmId(id, resp, outFormat, io);
+                    } else if ("POST".equalsIgnoreCase(method)) {
+                        handlePostDiskAttachmentForVmId(id, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("nics".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetNicsByVmId(id, resp, outFormat, io);
+                    } else if ("POST".equalsIgnoreCase(method)) {
+                        handlePostNicForVmId(id, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("snapshots".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetSnapshotsByVmId(id, resp, outFormat, io);
+                    } else if ("POST".equalsIgnoreCase(method)) {
+                        handlePostSnapshotForVmId(id, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("backups".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"POST".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetBackupsByVmId(id, resp, outFormat, io);
+                    } else if ("POST".equalsIgnoreCase(method)) {
+                        handlePostBackupForVmId(id, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("checkpoints".equals(subPath)) {
+                    if ("GET".equalsIgnoreCase(method)) {
+                        handleGetCheckpointsByVmId(id, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "GET, POST", outFormat);
+                    }
+                    return;
+                } else if ("tags".equals(subPath)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handlePostTagForVmId(id, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                }
+            } else if (idAndSubPath.size() == 3) {
+                String subPath = idAndSubPath.get(1);
+                String subId = idAndSubPath.get(2);
+                if ("diskattachments".equals(subPath)) {
+                    if (!"DELETE".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "DELETE", outFormat);
+                    } else  {
+                        handleDeleteDiskAttachmentForVmId(id, subId, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("snapshots".equals(subPath)) {
+                    if (!"GET".equalsIgnoreCase(method) && !"DELETE".equalsIgnoreCase(method)) {
+                        io.methodNotAllowed(resp, "GET, DELETE", outFormat);
+                    } else if ("GET".equalsIgnoreCase(method)) {
+                        handleGetSnapshotById(subId, resp, outFormat, io);
+                    } else if ("DELETE".equalsIgnoreCase(method)) {
+                        handleDeleteSnapshotById(subId, req, resp, outFormat, io);
+                    }
+                    return;
+                } else if ("backups".equals(subPath)) {
+                    if ("GET".equalsIgnoreCase(method)) {
+                        handleGetBackupById(subId, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "GET", outFormat);
+                    }
+                    return;
+                } else if ("checkpoints".equals(subPath)) {
+                    if ("DELETE".equalsIgnoreCase(method)) {
+                        handleDeleteCheckpoint(id, subId, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "DELETE", outFormat);
+                    }
+                    return;
+                }
+            } else if (idAndSubPath.size() == 4) {
+                String subPath = idAndSubPath.get(1);
+                String subId = idAndSubPath.get(2);
+                String action = idAndSubPath.get(3);
+                if ("snapshots".equals(subPath) && "restore".equals(action)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleRestoreSnapshotById(subId, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                } else if ("backups".equals(subPath) && "disks".equals(action)) {
+                    if ("GET".equalsIgnoreCase(method)) {
+                        handleGetBackupDisksById(subId, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "GET", outFormat);
+                    }
+                    return;
+                } else if ("backups".equals(subPath) && "finalize".equals(action)) {
+                    if ("POST".equalsIgnoreCase(method)) {
+                        handleFinalizeBackupById(id, subId, req, resp, outFormat, io);
+                    } else {
+                        io.methodNotAllowed(resp, "POST", outFormat);
+                    }
+                    return;
+                }
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<Vm> result = serverAdapter.listAllInstances(query.followContains("tags"),
+                    query.followContains("disk_attachments.disk"),
+                    query.followContains("nics.reporteddevices"),
+                    query.isAllContent(),
+                    query.getOffset(),
+                    query.getLimit());
+            NamedList<Vm> response = NamedList.of("vm", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePost(final HttpServletRequest req, final HttpServletResponse resp,
+                              Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Vm request = io.getMapper().jsonMapper().readValue(data, Vm.class);
+            Vm response = serverAdapter.createInstance(request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+             final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            Vm response = serverAdapter.getInstance(id,
+                    query.followContains("tags"),
+                    query.followContains("disk_attachments.disk"),
+                    query.followContains("nics.reporteddevices"),
+                    query.isAllContent());
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleUpdateById(final String id, final HttpServletRequest req, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                                    final VeeamControlServlet io) throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Vm request = io.getMapper().jsonMapper().readValue(data, Vm.class);
+            Vm response = serverAdapter.updateInstance(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        boolean deleteVolumes = Boolean.FALSE.toString().equals(req.getParameter("detach_only"));
+        try {
+            VmAction vm = serverAdapter.deleteInstance(id, deleteVolumes, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, vm, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleStartVmById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+             final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        try {
+            VmAction vm = serverAdapter.startInstance(id, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, vm, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleStopVmById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        try {
+            VmAction vm = serverAdapter.stopInstance(id, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, vm, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleShutdownVmById(final String id, final HttpServletRequest req, final HttpServletResponse resp,
+                final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        try {
+            VmAction vm = serverAdapter.shutdownInstance(id, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, vm, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetDiskAttachmentsByVmId(final String id, final HttpServletResponse resp,
+                  final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<DiskAttachment> disks = serverAdapter.listDiskAttachmentsByInstanceUuid(id);
+            NamedList<DiskAttachment> response = NamedList.of("disk_attachment", disks);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostDiskAttachmentForVmId(final String id, final HttpServletRequest req,
+             final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            DiskAttachment request = io.getMapper().jsonMapper().readValue(data, DiskAttachment.class);
+            DiskAttachment response = serverAdapter.attachInstanceDisk(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetNicsByVmId(final String id, final HttpServletResponse resp,
+                   final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<Nic> nics = serverAdapter.listNicsByInstanceUuid(id);
+            NamedList<Nic> response = NamedList.of("nic", nics);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostNicForVmId(final String id, final HttpServletRequest req,
+               final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Nic request = io.getMapper().jsonMapper().readValue(data, Nic.class);
+            Nic response = serverAdapter.attachInstanceNic(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_CREATED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetSnapshotsByVmId(final String id, final HttpServletResponse resp,
+                final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<Snapshot> snapshots = serverAdapter.listSnapshotsByInstanceUuid(id);
+            NamedList<Snapshot> response = NamedList.of("snapshot", snapshots);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostSnapshotForVmId(final String id, final HttpServletRequest req,
+                 final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Snapshot request = io.getMapper().jsonMapper().readValue(data, Snapshot.class);
+            Snapshot response = serverAdapter.createInstanceSnapshot(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteDiskAttachmentForVmId(final String vmId, final String diskId,
+             final HttpServletRequest req, final HttpServletResponse resp,
+             final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        boolean delete = Boolean.FALSE.toString().equals(req.getParameter("detach_only"));
+        try {
+            serverAdapter.detachInstanceDisk(vmId, diskId);
+            if (delete) {
+                serverAdapter.deleteDisk(diskId);
+            }
+            Map<String, String> response = Map.of("status", "complete");
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetSnapshotById(final String id, final HttpServletResponse resp,
+                 final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            Snapshot response = serverAdapter.getSnapshot(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteSnapshotById(final String id, final HttpServletRequest req,
+                final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        try {
+            ResourceAction action = serverAdapter.deleteSnapshot(id, async);
+            if (action != null) {
+                io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, action, outFormat);
+            } else {
+                io.getWriter().write(resp, HttpServletResponse.SC_OK, null, outFormat);
+            }
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleRestoreSnapshotById(final String id, final HttpServletRequest req,
+                final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        boolean async = RouteHandler.isRequestAsync(req);
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            ResourceAction response = serverAdapter.revertInstanceToSnapshot(id, async);
+            io.getWriter().write(resp, HttpServletResponse.SC_ACCEPTED, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetBackupsByVmId(final String id, final HttpServletResponse resp,
+              final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<Backup> backups = serverAdapter.listBackupsByInstanceUuid(id);
+            NamedList<Backup> response = NamedList.of("backup", backups);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostBackupForVmId(final String id, final HttpServletRequest req,
+               final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Backup request = io.getMapper().jsonMapper().readValue(data, Backup.class);
+            Backup response = serverAdapter.createInstanceBackup(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetBackupById(final String id, final HttpServletResponse resp,
+              final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            Backup response = serverAdapter.getBackup(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetBackupDisksById(final String id, final HttpServletRequest req,
+            final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            List<Disk> disks = serverAdapter.listDisksByBackupUuid(id);
+            NamedList<Disk> response = NamedList.of("disk", disks);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleFinalizeBackupById(final String vmId, final String backupId, final HttpServletRequest req,
+                final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            Backup backup = serverAdapter.finalizeBackup(vmId, backupId);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, backup, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetCheckpointsByVmId(final String id, final HttpServletResponse resp,
+              final Negotiation.OutFormat outFormat, final VeeamControlServlet io) throws IOException {
+        try {
+            List<Checkpoint> checkpoints = serverAdapter.listCheckpointsByInstanceUuid(id);
+            NamedList<Checkpoint> response = NamedList.of("checkpoints", checkpoints);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleDeleteCheckpoint(final String vmId, final String checkpointId,
+                final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        try {
+            serverAdapter.deleteCheckpoint(vmId, checkpointId);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, null, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handlePostTagForVmId(final String id, final HttpServletRequest req,
+               final HttpServletResponse resp, final Negotiation.OutFormat outFormat, final VeeamControlServlet io)
+            throws IOException {
+        String data = RouteHandler.getRequestData(req, logger);
+        try {
+            Tag request = io.getMapper().jsonMapper().readValue(data, Tag.class);
+            Tag response = serverAdapter.createInstanceTag(id, request);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (JsonProcessingException | CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandler.java
new file mode 100644
index 000000000000..fbfc0c9a92dd
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandler.java
@@ -0,0 +1,110 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import java.io.IOException;
+import java.util.List;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.adapter.ServerAdapter;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+import org.apache.cloudstack.veeam.api.request.ListQuery;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.cloudstack.veeam.utils.PathUtil;
+import org.apache.commons.collections.CollectionUtils;
+
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+
+public class VnicProfilesRouteHandler extends ManagerBase implements RouteHandler {
+    public static final String BASE_ROUTE = "/api/vnicprofiles";
+
+    @Inject
+    ServerAdapter serverAdapter;
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public int priority() {
+        return 5;
+    }
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String method = req.getMethod();
+        if (!"GET".equalsIgnoreCase(method)) {
+            io.methodNotAllowed(resp, "GET", outFormat);
+            return;
+        }
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE)) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        List<String> idAndSubPath = PathUtil.extractIdAndSubPath(sanitizedPath, BASE_ROUTE);
+        if (CollectionUtils.isNotEmpty(idAndSubPath)) {
+            String id = idAndSubPath.get(0);
+            if (idAndSubPath.size() == 1) {
+                handleGetById(id, resp, outFormat, io);
+                return;
+            }
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(final HttpServletRequest req, final HttpServletResponse resp,
+                          Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            ListQuery query = ListQuery.fromRequest(req);
+            final List<VnicProfile> result = serverAdapter.listAllVnicProfiles(query.getOffset(), query.getLimit());
+            NamedList<VnicProfile> response = NamedList.of("vnic_profile", result);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+
+    protected void handleGetById(final String id, final HttpServletResponse resp, final Negotiation.OutFormat outFormat,
+                              final VeeamControlServlet io) throws IOException {
+        try {
+            VnicProfile response = serverAdapter.getVnicProfile(id);
+            io.getWriter().write(resp, HttpServletResponse.SC_OK, response, outFormat);
+        } catch (InvalidParameterValueException e) {
+            io.notFound(resp, e.getMessage(), outFormat);
+        } catch (CloudRuntimeException e) {
+            io.badRequest(resp, e.getMessage(), outFormat);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverter.java
new file mode 100644
index 000000000000..e1fbfc82e7aa
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverter.java
@@ -0,0 +1,90 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.jobs.JobInfo;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.JobsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.apache.cloudstack.veeam.api.dto.VmAction;
+
+import com.cloud.api.query.vo.AsyncJobJoinVO;
+import com.cloud.api.query.vo.UserVmJoinVO;
+
+public class AsyncJobJoinVOToJobConverter {
+
+    public static Job toJob(AsyncJobJoinVO vo) {
+        Job job = new Job();
+        final String basePath = VeeamControlService.ContextPath.value();
+        job.setId(vo.getUuid());
+        job.setHref(basePath + JobsRouteHandler.BASE_ROUTE + "/" + vo.getUuid());
+        job.setAutoCleared(Boolean.TRUE.toString());
+        job.setExternal(Boolean.TRUE.toString());
+        job.setLastUpdated(System.currentTimeMillis());
+        job.setStartTime(vo.getCreated().getTime());
+        JobInfo.Status status = JobInfo.Status.values()[vo.getStatus()];
+        Long endTime = System.currentTimeMillis();
+        if (status == JobInfo.Status.SUCCEEDED) {
+            job.setStatus("finished");
+            job.setEndTime(System.currentTimeMillis());
+        } else if (status == JobInfo.Status.FAILED) {
+            job.setStatus(status.name().toLowerCase());
+        } else if (status == JobInfo.Status.CANCELLED) {
+            job.setStatus("aborted");
+        } else {
+            job.setStatus("started");
+            endTime = null;
+        }
+        if (endTime != null) {
+            job.setEndTime(endTime);
+        }
+        job.setOwner(Ref.of(basePath + "/api/users/" + vo.getUserUuid(), vo.getUserUuid()));
+        job.setDescription("Something");
+        job.setLink(Collections.emptyList());
+        return job;
+    }
+
+    public static List<Job> toJobList(List<AsyncJobJoinVO> vos) {
+        return vos.stream().map(AsyncJobJoinVOToJobConverter::toJob).collect(Collectors.toList());
+    }
+
+    protected static void fillAction(final ResourceAction action, final AsyncJobJoinVO vo) {
+        final String basePath = VeeamControlService.ContextPath.value();
+        action.setJob(Ref.of(basePath + JobsRouteHandler.BASE_ROUTE + "/" + vo.getUuid(), vo.getUuid()));
+        action.setStatus("complete");
+    }
+
+    public static VmAction toVmAction(final AsyncJobJoinVO vo, final UserVmJoinVO vm) {
+        VmAction action = new VmAction();
+        fillAction(action, vo);
+        action.setVm(UserVmJoinVOToVmConverter.toVm(vm, null, null, null, null, null, null, null, false));
+        return action;
+    }
+
+    public static ResourceAction toAction(final AsyncJobJoinVO vo) {
+        VmAction action = new VmAction();
+        fillAction(action, vo);
+        return action;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverter.java
new file mode 100644
index 000000000000..04bac31a3d6f
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverter.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Backup;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.vm.UserVmVO;
+
+public class BackupVOToBackupConverter {
+
+    public static Backup toBackup(final BackupVO backupVO, final Function<Long, UserVmVO> vmResolver,
+              final Function<Long, HostJoinVO> hostResolver, final Function<BackupVO, List<Disk>> disksResolver) {
+        Backup backup = new Backup();
+        final String basePath = VeeamControlService.ContextPath.value();
+        backup.setHref(basePath + VmsRouteHandler.BASE_ROUTE + "/backups/" + backupVO.getUuid());
+        backup.setId(backupVO.getUuid());
+        backup.setName(backupVO.getName());
+        backup.setDescription(backupVO.getDescription());
+        backup.setCreationDate(backupVO.getDate().getTime());
+        backup.setPhase(mapStatusToPhase(backupVO.getStatus()));
+        if (backupVO.getFromCheckpointId() != null) {
+            backup.setFromCheckpointId(backupVO.getFromCheckpointId());
+        }
+        if (backupVO.getToCheckpointId() != null) {
+            backup.setToCheckpointId(backupVO.getToCheckpointId());
+        }
+        if (vmResolver != null) {
+            final UserVmVO vmVO = vmResolver.apply(backupVO.getVmId());
+            if (vmVO != null) {
+                backup.setVm(Vm.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vmVO.getUuid(), vmVO.getUuid()));
+            }
+        }
+        if (backupVO.getHostId() != null && hostResolver != null) {
+            final HostJoinVO hostVO = hostResolver.apply(backupVO.getHostId());
+            if (hostVO != null) {
+                backup.setHost(Host.of(basePath + ApiRouteHandler.BASE_ROUTE + "/" + hostVO.getUuid(), hostVO.getUuid()));
+            }
+        }
+        if (disksResolver != null) {
+            List<Disk> disks = disksResolver.apply(backupVO);
+            backup.setDisks(NamedList.of("disks", disks));
+        }
+        return backup;
+    }
+
+    public static List<Backup> toBackupList(final List<BackupVO> backupVOs, final Function<Long, UserVmVO> vmResolver,
+                final Function<Long, HostJoinVO> hostResolver) {
+        return backupVOs
+                .stream()
+                .map(backupVO -> toBackup(backupVO, vmResolver, hostResolver, null))
+                .collect(Collectors.toList());
+    }
+
+    private static String mapStatusToPhase(final BackupVO.Status status) {
+        switch (status) {
+            case Allocated:
+            case Queued:
+                return "initializing";
+            case BackingUp:
+                return "starting";
+            case ReadyForImageTransfer:
+                return "ready";
+            case FinalizingImageTransfer:
+                return "finalizing";
+            case Restoring:
+            case BackedUp:
+                return "succeeded";
+        }
+        return "failed";
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverter.java
new file mode 100644
index 000000000000..42b2233393da
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverter.java
@@ -0,0 +1,155 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ClustersRouteHandler;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.apache.cloudstack.veeam.api.dto.Cpu;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.Version;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.dc.ClusterVO;
+import com.cloud.utils.UuidUtils;
+
+public class ClusterVOToClusterConverter {
+    public static Cluster toCluster(final ClusterVO vo, final Function<Long, DataCenterJoinVO> dataCenterResolver) {
+        final Cluster c = new Cluster();
+        final String basePath = VeeamControlService.ContextPath.value();
+        final String clusterId = vo.getUuid();
+        c.setId(clusterId);
+        c.setHref(basePath + ClustersRouteHandler.BASE_ROUTE + "/" + clusterId);
+
+        c.setName(vo.getName());
+
+        c.setBallooningEnabled("true");
+        c.setBiosType(Vm.Bios.getDefault().getType());
+        c.setFipsMode("disabled");
+        c.setFirewallType("firewalld");
+        c.setGlusterService("false");
+        c.setHaReservation("false");
+        c.setSwitchType("legacy");
+        c.setThreadsAsCores("false");
+        c.setTrustedService("false");
+        c.setTunnelMigration("false");
+        c.setUpgradeInProgress("false");
+        c.setUpgradePercentComplete("0");
+        c.setVirtService("true");
+        c.setVncEncryption("false");
+
+        // --- cpu (best-effort defaults)
+        final Cpu cpu = new Cpu();
+        cpu.setArchitecture(vo.getArch().getType());
+        cpu.setType(vo.getArch().getType()); // replace if you can detect host cpu model
+        c.setCpu(cpu);
+
+        final Version ver = Version.fromPackageAndCSVersion(false);
+        c.setVersion(ver);
+
+        // --- ksm / memory policy (defaults)
+        c.setKsm(new Cluster.Ksm());
+        c.getKsm().enabled = "true";
+        c.getKsm().mergeAcrossNodes = "true";
+
+        c.setMemoryPolicy(new Cluster.MemoryPolicy());
+        c.getMemoryPolicy().overCommit = new Cluster.OverCommit();
+        c.getMemoryPolicy().overCommit.percent = "100";
+        c.getMemoryPolicy().transparentHugepages = new Cluster.TransparentHugepages();
+        c.getMemoryPolicy().transparentHugepages.enabled = "true";
+
+        // --- migration defaults
+        c.setMigration(new Cluster.Migration());
+        c.getMigration().autoConverge = "inherit";
+        c.getMigration().bandwidth = new Cluster.Bandwidth();
+        c.getMigration().bandwidth.assignmentMethod = "auto";
+        c.getMigration().compressed = "inherit";
+        c.getMigration().encrypted = "inherit";
+        c.getMigration().parallelMigrationsPolicy = "disabled";
+        // policy ref (dummy but valid shape)
+        c.getMigration().policy = Ref.of(basePath + "/migrationpolicies/" + stableUuid("migrationpolicy:default"),
+                stableUuid("migrationpolicy:default")
+        );
+
+        // --- rng sources
+        c.setRequiredRngSources(new Cluster.RequiredRngSources());
+        c.getRequiredRngSources().requiredRngSource = Collections.singletonList("urandom");
+
+        // --- error handling
+        c.setErrorHandling(new Cluster.ErrorHandling());
+        c.getErrorHandling().onError = "migrate";
+
+        // --- fencing policy defaults
+        c.setFencingPolicy(new Cluster.FencingPolicy());
+        c.getFencingPolicy().enabled = "true";
+        c.getFencingPolicy().skipIfConnectivityBroken = new Cluster.SkipIfConnectivityBroken();
+        c.getFencingPolicy().skipIfConnectivityBroken.enabled = "false";
+        c.getFencingPolicy().skipIfConnectivityBroken.threshold = "50";
+        c.getFencingPolicy().skipIfGlusterBricksUp = "false";
+        c.getFencingPolicy().skipIfGlusterQuorumNotMet = "false";
+        c.getFencingPolicy().skipIfSdActive = new Cluster.SkipIfSdActive();
+        c.getFencingPolicy().skipIfSdActive.enabled = "false";
+
+        // --- scheduling policy props (optional; dummy ok)
+        c.setCustomSchedulingPolicyProperties(new Cluster.CustomSchedulingPolicyProperties());
+        final Cluster.Property p1 = new Cluster.Property(); p1.name = "HighUtilization"; p1.value = "80";
+        final Cluster.Property p2 = new Cluster.Property(); p2.name = "CpuOverCommitDurationMinutes"; p2.value = "2";
+        c.getCustomSchedulingPolicyProperties().property = List.of(p1, p2);
+
+        // --- data_center ref mapping (CloudStack cluster -> pod -> zone)
+        if (dataCenterResolver != null) {
+            final DataCenterJoinVO zone = dataCenterResolver.apply(vo.getDataCenterId());
+            if (zone != null) {
+                c.setDataCenter(Ref.of(basePath + DataCentersRouteHandler.BASE_ROUTE + "/" + zone.getUuid(), zone.getUuid()));
+            }
+        }
+
+        // --- mac pool & scheduling policy refs (dummy but consistent)
+        c.setMacPool(Ref.of(basePath + "/macpools/" + stableUuid("macpool:default"),
+                stableUuid("macpool:default")));
+        c.setSchedulingPolicy(Ref.of(basePath + "/schedulingpolicies/" + stableUuid("schedpolicy:default"),
+                stableUuid("schedpolicy:default")));
+
+        // --- related links (optional)
+        c.setLink(List.of(
+                Link.of("networks", c.getHref() + "/networks")
+        ));
+
+        return c;
+    }
+
+    public static List<Cluster> toClusterList(final List<ClusterVO> voList,
+            final Function<Long, DataCenterJoinVO> dataCenterResolver) {
+        return voList.stream()
+                .map(vo -> toCluster(vo, dataCenterResolver))
+                .collect(Collectors.toList());
+    }
+
+    private static String stableUuid(final String key) {
+        // deterministic UUID, so the same ClusterVO maps to same "ovirt id" every time
+        return UuidUtils.nameUUIDFromBytes(key.getBytes()).toString();
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverter.java
new file mode 100644
index 000000000000..58ceb730d69c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverter.java
@@ -0,0 +1,76 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.stream.Collectors;
+import java.util.stream.Stream;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.SupportedVersions;
+import org.apache.cloudstack.veeam.api.dto.Version;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.org.Grouping;
+
+public class DataCenterJoinVOToDataCenterConverter {
+    public static DataCenter toDataCenter(final DataCenterJoinVO zone) {
+        final String id = zone.getUuid();
+        final String basePath = VeeamControlService.ContextPath.value();
+        final String href = basePath + DataCentersRouteHandler.BASE_ROUTE + "/" + id;
+
+        final DataCenter dc = new DataCenter();
+
+        // ---- Identity ----
+        dc.setId(id);
+        dc.setHref(href);
+        dc.setName(zone.getName());
+        dc.setDescription(zone.getDescription());
+
+        // ---- State ----
+        dc.setStatus(Grouping.AllocationState.Enabled.equals(zone.getAllocationState()) ? "up" : "down");
+        dc.setLocal("false");
+        dc.setQuotaMode("disabled");
+
+        // ---- Versions ----
+        final Version ver = Version.fromPackageAndCSVersion(false);
+        dc.setVersion(ver);
+        dc.setSupportedVersions(new SupportedVersions(List.of(ver)));
+
+        // ---- mac_pool (static placeholder) ----
+        dc.setMacPool(Ref.of(basePath + "/macpools/default", "default"));
+
+        // ---- Related links ----
+
+        dc.link = Stream.of("cluster", "networks", "storagedomains")
+                .map(rel -> Link.of(rel, href + "/" + rel))
+                .collect(Collectors.toList());
+
+        return dc;
+    }
+
+    public static List<DataCenter> toDCList(final List<DataCenterJoinVO> srcList) {
+        return srcList.stream()
+                .map(DataCenterJoinVOToDataCenterConverter::toDataCenter)
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverter.java
new file mode 100644
index 000000000000..da5aadac5f0e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverter.java
@@ -0,0 +1,103 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ClustersRouteHandler;
+import org.apache.cloudstack.veeam.api.HostsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Cpu;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.Topology;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.host.Status;
+import com.cloud.resource.ResourceState;
+
+public class HostJoinVOToHostConverter {
+
+    /**
+     * Convert CloudStack HostJoinVO -> oVirt-like Host.
+     *
+     */
+    public static Host toHost(final HostJoinVO vo) {
+        final Host h = new Host();
+
+        final String hostUuid = vo.getUuid();
+
+        h.setId(hostUuid);
+        final String basePath = VeeamControlService.ContextPath.value();
+        h.setHref(basePath + HostsRouteHandler.BASE_ROUTE + "/" + hostUuid);
+
+        final String name = vo.getName() != null ? vo.getName() : ("host-" + hostUuid);
+        h.setName(name);
+
+        String addr = vo.getPrivateIpAddress();
+        h.setAddress(addr);
+
+        h.setStatus(mapStatus(vo));
+        h.setExternalStatus("ok");
+
+        // --- cluster ---
+        final String clusterUuid = vo.getClusterUuid();
+        h.setCluster(Ref.of(basePath + ClustersRouteHandler.BASE_ROUTE + "/" + clusterUuid, clusterUuid));
+
+        // --- CPU ---
+        final Cpu cpu = new Cpu();
+        cpu.setSpeed(String.valueOf(Math.toIntExact(vo.getSpeed())));
+        final Topology topo = new Topology(vo.getCpuSockets(), vo.getCpus(), 1);
+        cpu.setTopology(topo);
+        h.setCpu(cpu);
+
+        // --- Memory ---
+        h.setMemory(String.valueOf(vo.getTotalMemory()));
+        h.setMaxSchedulingMemory(String.valueOf(Math.max(0, vo.getTotalMemory() - vo.getMemUsedCapacity())));
+
+        h.setType("ovirt_node");
+        h.setAutoNumaStatus("unknown");
+        h.setKdumpStatus("disabled");
+        h.setNumaSupported("false");
+        h.setReinstallationRequired("false");
+        h.setUpdateAvailable("false");
+
+
+        h.setActions(null);
+        h.setLink(Collections.emptyList());
+
+        return h;
+    }
+
+    public static List<Host> toHostList(final List<HostJoinVO> vos) {
+        return vos.stream().map(HostJoinVOToHostConverter::toHost).collect(Collectors.toList());
+    }
+
+    private static String mapStatus(final HostJoinVO vo) {
+        if (vo.isInMaintenanceStates()) {
+            return "maintenance";
+        }
+        if (Status.Up.equals(vo.getStatus()) &&
+                ResourceState.Enabled.equals(vo.getResourceState())) {
+            return "up";
+        }
+        return "down";
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverter.java
new file mode 100644
index 000000000000..8b6b9eb92e4f
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverter.java
@@ -0,0 +1,89 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.backup.ImageTransferVO;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.DisksRouteHandler;
+import org.apache.cloudstack.veeam.api.HostsRouteHandler;
+import org.apache.cloudstack.veeam.api.ImageTransfersRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.VolumeJoinVO;
+
+public class ImageTransferVOToImageTransferConverter {
+    public static ImageTransfer toImageTransfer(ImageTransferVO vo, final Function<Long, HostJoinVO> hostResolver,
+            final Function<Long, VolumeJoinVO> volumeResolver) {
+        ImageTransfer imageTransfer = new ImageTransfer();
+        final String basePath = VeeamControlService.ContextPath.value();
+        imageTransfer.setId(vo.getUuid());
+        imageTransfer.setHref(basePath + ImageTransfersRouteHandler.BASE_ROUTE + "/" + vo.getUuid());
+        imageTransfer.setActive(Boolean.toString(org.apache.cloudstack.backup.ImageTransfer.Phase.transferring.equals(vo.getPhase())));
+        imageTransfer.setDirection(vo.getDirection().name());
+        imageTransfer.setFormat("cow");
+        imageTransfer.setInactivityTimeout(Integer.toString(3600));
+        imageTransfer.setPhase(vo.getPhase().name());
+        if (org.apache.cloudstack.backup.ImageTransfer.Phase.finished.equals(vo.getPhase())) {
+            imageTransfer.setPhase("finished_success");
+        } else if (org.apache.cloudstack.backup.ImageTransfer.Phase.failed.equals(vo.getPhase())) {
+            imageTransfer.setPhase("finished_failed");
+        }
+        imageTransfer.setShallow(Boolean.toString(false));
+        imageTransfer.setTimeoutPolicy("legacy");
+        imageTransfer.setTransferUrl(vo.getTransferUrl());
+        imageTransfer.setTransferred(Long.toString(0));
+        if (hostResolver != null) {
+            HostJoinVO hostVo = hostResolver.apply(vo.getHostId());
+            if (hostVo != null) {
+                imageTransfer.setHost(Ref.of(basePath + HostsRouteHandler.BASE_ROUTE + "/" + hostVo.getUuid(), hostVo.getUuid()));
+            }
+        }
+        if (volumeResolver != null) {
+            VolumeJoinVO volumeVo = volumeResolver.apply(vo.getVolumeId());
+            if (volumeVo != null) {
+                imageTransfer.setDisk(Ref.of(basePath + DisksRouteHandler.BASE_ROUTE + "/" + volumeVo.getUuid(), volumeVo.getUuid()));
+                imageTransfer.setImage(Ref.of(null, volumeVo.getUuid()));
+            }
+        }
+        final List<Link> links = new ArrayList<>();
+        links.add(getLink(imageTransfer, "cancel"));
+        links.add(getLink(imageTransfer, "finalize"));
+        imageTransfer.setActions(NamedList.of("link", links));
+        return imageTransfer;
+    }
+
+    public static List<ImageTransfer> toImageTransferList(List<? extends ImageTransferVO> vos,
+            final Function<Long, HostJoinVO> hostResolver,
+            final Function<Long, VolumeJoinVO> volumeResolver) {
+        return vos.stream().map(vo -> toImageTransfer(vo, hostResolver, volumeResolver))
+                .collect(Collectors.toList());
+    }
+
+    private static Link getLink(ImageTransfer it, String rel) {
+        return Link.of(rel, it.getHref() + "/" + rel);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverter.java
new file mode 100644
index 000000000000..82198997e7db
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverter.java
@@ -0,0 +1,79 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.NetworksRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.network.dao.NetworkVO;
+
+public class NetworkVOToNetworkConverter {
+    public static Network toNetwork(final NetworkVO vo, final Function<Long, DataCenterJoinVO> dcResolver) {
+        final Network dto = new Network();
+
+        final String networkUuid = vo.getUuid();
+        dto.setId(networkUuid);
+        final String basePath = VeeamControlService.ContextPath.value();
+        dto.setHref(basePath + NetworksRouteHandler.BASE_ROUTE + "/" + networkUuid);
+
+        String name = vo.getName() != null ? vo.getName() : vo.getTrafficType().name() + "-" + networkUuid;
+        dto.setName(name);
+        dto.setDescription(vo.getDisplayText());
+        dto.setComment("");
+
+        dto.setMtu(String.valueOf(vo.getPrivateMtu() != null ? vo.getPrivateMtu() : 0));
+        dto.setPortIsolation("false");
+        dto.setStp("false");
+
+        dto.setUsages(NamedList.of("usage", List.of("vm")));
+
+        // Best-effort mapping for vdsm_name
+        dto.setVdsmName(dto.getName());
+
+        if (dcResolver != null) {
+            final DataCenterJoinVO dc = dcResolver.apply(vo.getDataCenterId());
+            if (dc != null) {
+                final String dcUuid = dc.getUuid();
+                if (dcUuid != null && !dcUuid.isEmpty()) {
+                    dto.setDataCenter(Ref.of(basePath + DataCentersRouteHandler.BASE_ROUTE + "/" + dcUuid, dcUuid));
+                }
+            }
+        }
+
+        dto.setLink(Collections.emptyList());
+
+        return dto;
+    }
+
+    public static List<Network> toNetworkList(final List<? extends NetworkVO> vos,
+            final Function<Long, DataCenterJoinVO> dcResolver) {
+        return vos.stream()
+                .map(vo -> toNetwork(vo, dcResolver))
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverter.java
new file mode 100644
index 000000000000..af10d586c89a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverter.java
@@ -0,0 +1,65 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.NetworksRouteHandler;
+import org.apache.cloudstack.veeam.api.VnicProfilesRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.network.dao.NetworkVO;
+
+public class NetworkVOToVnicProfileConverter {
+    public static VnicProfile toVnicProfile(final NetworkVO vo, final Function<Long, DataCenterJoinVO> dcResolver) {
+        final VnicProfile vnicProfile = new VnicProfile();
+
+        final String networkUuid = vo.getUuid();
+        vnicProfile.setId(networkUuid);
+        final String basePath = VeeamControlService.ContextPath.value();
+        vnicProfile.setHref(basePath + VnicProfilesRouteHandler.BASE_ROUTE + "/" + networkUuid);
+        vnicProfile.setId(networkUuid);
+        String name = vo.getName() != null ? vo.getName() : vo.getTrafficType().name() + "-" + networkUuid;
+        vnicProfile.setName(name);
+        vnicProfile.setNetwork(Ref.of(basePath + NetworksRouteHandler.BASE_ROUTE + "/" + networkUuid, networkUuid));
+        vnicProfile.setDescription(vo.getDisplayText());
+
+        if (dcResolver != null) {
+            final DataCenterJoinVO dc = dcResolver.apply(vo.getDataCenterId());
+            if (dc != null) {
+                final String dcUuid = dc.getUuid();
+                if (dcUuid != null && !dcUuid.isEmpty()) {
+                    vnicProfile.setDataCenter(Ref.of(basePath + DataCentersRouteHandler.BASE_ROUTE + "/" + dcUuid, dcUuid));
+                }
+            }
+        }
+        return vnicProfile;
+    }
+
+    public static List<VnicProfile> toVnicProfileList(final List<NetworkVO> vos, final Function<Long, DataCenterJoinVO> dcResolver) {
+        return vos.stream()
+                .map(vo -> toVnicProfile(vo, dcResolver))
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverter.java
new file mode 100644
index 000000000000..3af2f7c31396
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverter.java
@@ -0,0 +1,116 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.VnicProfilesRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Ip;
+import org.apache.cloudstack.veeam.api.dto.Mac;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.ReportedDevice;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.jetbrains.annotations.NotNull;
+
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.vm.NicVO;
+
+public class NicVOToNicConverter {
+    private static final String DEFAULT_INTERFACE_TYPE = "virtio";
+    private static final String DEFAULT_REPORTED_DEVICE_NAME = "eth0";
+
+    public static Nic toNic(final NicVO vo, final String vmUuid, final Function<Long, NetworkVO> networkResolver) {
+        final String basePath = VeeamControlService.ContextPath.value();
+        final Nic nic = new Nic();
+        nic.setId(vo.getUuid());
+        nic.setName(vo.getReserver());
+        Mac mac = new Mac();
+        mac.setAddress(vo.getMacAddress());
+        nic.setMac(mac);
+        nic.setLinked(Boolean.TRUE.toString());
+        nic.setPlugged(Boolean.TRUE.toString());
+        nic.setSynced(Boolean.TRUE.toString());
+        if (StringUtils.isNotBlank(vmUuid)) {
+            Vm vm = Vm.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vmUuid, vmUuid);
+            nic.setVm(vm);
+            nic.setHref(vm.getHref() + "/nics/" + vo.getUuid());
+        }
+        nic.setInterfaceType(DEFAULT_INTERFACE_TYPE);
+        ReportedDevice device = getReportedDevice(vo, mac, nic.getVm());
+        nic.setReportedDevices(NamedList.of("reported_device", List.of(device)));
+        if (networkResolver != null) {
+            final NetworkVO network = networkResolver.apply(vo.getNetworkId());
+            if (network != null) {
+                nic.setVnicProfile(Ref.of(basePath + VnicProfilesRouteHandler.BASE_ROUTE + "/" + network.getUuid(), network.getUuid()));
+            }
+        }
+        return nic;
+    }
+
+    @NotNull
+    private static ReportedDevice getReportedDevice(NicVO vo, Mac mac, Vm vm) {
+        ReportedDevice device = new ReportedDevice();
+        device.setType("network");
+        device.setId(vo.getUuid());
+        device.setName(DEFAULT_REPORTED_DEVICE_NAME);
+        device.setDescription(String.format("%s device", vo.getReserver()));
+        device.setMac(mac);
+        if (ObjectUtils.anyNotNull(vo.getIPv4Address(), vo.getIPv6Address())) {
+            List<Ip> ips = getIps(vo);
+            device.setIps(NamedList.of("ip", ips));
+        }
+        device.setHref(vm.getHref() + "/reporteddevices/" + vo.getUuid());
+        device.setVm(vm);
+        return device;
+    }
+
+    @NotNull
+    private static List<Ip> getIps(NicVO vo) {
+        List<Ip> ips = new ArrayList<>();
+        if (vo.getIPv4Address() != null) {
+            Ip ip = new Ip();
+            ip.setAddress(vo.getIPv4Address());
+            ip.setGateway(vo.getIPv4Gateway());
+            ip.setVersion("v4");
+            ips.add(ip);
+        }
+        if (vo.getIPv6Address() != null) {
+            Ip ip6 = new Ip();
+            ip6.setAddress(vo.getIPv6Address());
+            ip6.setGateway(vo.getIPv6Gateway());
+            ip6.setVersion("v6");
+            ips.add(ip6);
+        }
+        return ips;
+    }
+
+    public static List<Nic> toNicList(final List<NicVO> vos, final String vmUuid, final Function<Long, NetworkVO> networkResolver) {
+        return vos.stream()
+                .map(vo -> toNic(vo, vmUuid, networkResolver))
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverter.java
new file mode 100644
index 000000000000..38d67a778378
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverter.java
@@ -0,0 +1,82 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.TagsRouteHandler;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+
+import com.cloud.server.ResourceTag;
+import com.cloud.tags.ResourceTagVO;
+
+public class ResourceTagVOToTagConverter {
+
+    public static Ref getRootTagRef() {
+        String basePath = VeeamControlService.ContextPath.value();
+        return Ref.of(basePath + TagsRouteHandler.BASE_ROUTE + "/" + BaseDto.ZERO_UUID, BaseDto.ZERO_UUID);
+    }
+
+    public static Tag getRootTag() {
+        Tag tag = new Tag();
+        tag.setId(BaseDto.ZERO_UUID);
+        tag.setName("root");
+        tag.setHref(getRootTagRef().getHref());
+        return tag;
+    }
+
+    public static Tag toTag(ResourceTagVO vo) {
+        String basePath = VeeamControlService.ContextPath.value();
+        Tag tag = new Tag();
+        String id = vo.getValue();
+        tag.setId(id);
+        tag.setName(vo.getValue());
+        tag.setDescription(String.format("Tag %s with value: %s", vo.getKey(), vo.getValue()));
+        tag.setHref(basePath + TagsRouteHandler.BASE_ROUTE + "/" + id);
+        if (ResourceTag.ResourceObjectType.UserVm.equals(vo.getResourceType())) {
+            tag.setVm(Ref.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vo.getResourceUuid(),
+                    vo.getResourceUuid()));
+        }
+        tag.setParent(getRootTagRef());
+        return tag;
+    }
+
+    public static Tag toTag(String id) {
+        String basePath = VeeamControlService.ContextPath.value();
+        Tag tag = new Tag();
+        tag.setId(id);
+        tag.setName(id);
+        tag.setDescription(String.format("Tag: %s", id));
+        tag.setHref(basePath + TagsRouteHandler.BASE_ROUTE + "/" + id);
+        tag.setParent(getRootTagRef());
+        return tag;
+    }
+
+    public static List<Tag> toTags(List<ResourceTagVO> vos) {
+        return vos.stream().map(ResourceTagVOToTagConverter::toTag).collect(Collectors.toList());
+    }
+
+    public static List<Tag> toTagsFromValues(List<String> values) {
+        return values.stream().map(ResourceTagVOToTagConverter::toTag).collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverter.java
new file mode 100644
index 000000000000..2b8f65052528
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverter.java
@@ -0,0 +1,244 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.api.DataCentersRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Storage;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+
+import com.cloud.api.query.vo.ImageStoreJoinVO;
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+
+public class StoreVOToStorageDomainConverter {
+
+    /** Primary storage -> oVirt storage_domain (type=data) */
+    public static StorageDomain toStorageDomain(final StoragePoolJoinVO pool) {
+        final String basePath = VeeamControlService.ContextPath.value();
+
+        final String id = pool.getUuid();
+
+        StorageDomain sd = new StorageDomain();
+        sd.setId(id);
+        final String href = href(basePath, ApiRouteHandler.BASE_ROUTE + "/storagedomains/" + id);
+        sd.setHref(href);
+
+        sd.setName(pool.getName());
+
+        // oVirt sample returns numbers as strings
+        sd.setAvailable(Long.toString(Math.max(0, pool.getCapacityBytes() - pool.getUsedBytes())));
+        sd.setUsed(Long.toString(pool.getUsedBytes()));
+        sd.setCommitted(Long.toString(pool.getCapacityBytes()));
+
+        sd.setType("data");
+        sd.setStatus(mapPoolStatus(pool));   // "active"/"inactive"/"maintenance" (approx)
+        sd.setMaster("true");                // if you don’t have a concept, choose stable default
+        sd.setBackup("false");
+
+        sd.setBlockSize("512");              // stable default unless you can compute it
+        sd.setExternalStatus("ok");
+        sd.setStorageFormat("v5");
+
+        sd.setDiscardAfterDelete("false");
+        sd.setWipeAfterDelete("false");
+        sd.setSupportsDiscard("false");
+        sd.setSupportsDiscardZeroesData("false");
+
+        sd.setWarningLowSpaceIndicator("10");
+        sd.setCriticalSpaceActionBlocker("5");
+
+        // Nested storage (try to extract if available)
+        sd.setStorage(buildPrimaryStorage(pool));
+
+        // dc attachment
+        String dcId = pool.getZoneUuid();
+        DataCenter dc = new DataCenter();
+        dc.setHref(href(basePath, DataCentersRouteHandler.BASE_ROUTE + "/" + dcId));
+        dc.setId(dcId);
+        sd.setDataCenters(NamedList.of("data_center", List.of(dc)));
+
+        sd.setLink(defaultStorageDomainLinks(href, true, /*includeTemplates*/ true));
+
+        return sd;
+    }
+
+    public static List<StorageDomain> toStorageDomainListFromPools(final List<StoragePoolJoinVO> pools) {
+        return pools.stream().map(StoreVOToStorageDomainConverter::toStorageDomain).collect(Collectors.toList());
+    }
+
+    /** Secondary/Image store -> oVirt storage_domain (type=image) */
+    public static StorageDomain toStorageDomain(final ImageStoreJoinVO store) {
+        final String basePath = VeeamControlService.ContextPath.value();
+
+        final String id = store.getUuid();
+
+        StorageDomain sd = new StorageDomain();
+        sd.setId(id);
+        final String href = href(basePath, ApiRouteHandler.BASE_ROUTE + "/storagedomains/" + id);
+        sd.setHref(href);
+
+        sd.setName(store.getName());
+
+        // Many image repos don’t have these values readily; keep as "0" or omit (null)
+        sd.setCommitted("0");
+        sd.setAvailable(null); // oVirt’s glance example omitted available/used
+        sd.setUsed(null);
+
+        sd.setType("image");
+        sd.setStatus("unattached"); // matches your sample for glance-like repo
+        sd.setMaster("false");
+        sd.setBackup("false");
+
+        sd.setBlockSize("512");
+        sd.setExternalStatus("ok");
+        sd.setStorageFormat("v1");
+
+        sd.setDiscardAfterDelete("false");
+        sd.setWipeAfterDelete("false");
+        sd.setSupportsDiscard("false");
+        sd.setSupportsDiscardZeroesData("false");
+
+        sd.setWarningLowSpaceIndicator("0");
+        sd.setCriticalSpaceActionBlocker("0");
+
+        sd.setStorage(buildImageStoreStorage(store));
+
+        // Optionally include dc attachment (your first object had it; second didn’t)
+        String dcId = store.getZoneUuid();
+        DataCenter dc = new DataCenter();
+        dc.setHref(href(basePath, DataCentersRouteHandler.BASE_ROUTE + "/" + dcId));
+        dc.setId(dcId);
+        sd.setDataCenters(NamedList.of("data_center", List.of(dc)));
+
+        sd.setLink(defaultStorageDomainLinks(href, false, /*includeTemplates*/ false));
+
+        return sd;
+    }
+
+    public static List<StorageDomain> toStorageDomainListFromStores(final List<ImageStoreJoinVO> stores) {
+        return stores.stream().map(StoreVOToStorageDomainConverter::toStorageDomain).collect(Collectors.toList());
+    }
+
+    // ----------- Helpers -----------
+
+    private static Storage buildPrimaryStorage(StoragePoolJoinVO pool) {
+        Storage st = new Storage();
+        st.setType(mapPrimaryStorageType(pool));
+
+        // If you can parse details/url, fill these. If not, keep empty strings like oVirt.
+        // For NFS pools in CloudStack, URL is often like: nfs://10.0.32.4/path or 10.0.32.4:/path
+        String url = null;
+        try {
+            url = pool.getHostAddress(); // sometimes exists in VO; if not, ignore
+        } catch (Exception ignored) { }
+
+        if ("nfs".equals(st.getType())) {
+            // best-effort placeholders
+            st.setAddress("");        // fill if you can parse
+            st.setPath("");           // fill if you can parse
+            st.setMountOptions("");
+            st.setNfsVersion("auto");
+        }
+        return st;
+    }
+
+    private static Storage buildImageStoreStorage(ImageStoreJoinVO store) {
+        Storage st = new Storage();
+
+        // Match your sample: glance store => type=glance
+        // If you want "nfs" for secondary, map based on provider/protocol instead.
+        st.setType(mapImageStorageType(store));
+
+        if ("nfs".equals(st.getType())) {
+            st.setAddress("");
+            st.setPath("");
+            st.setMountOptions("");
+            st.setNfsVersion("auto");
+        }
+        return st;
+    }
+
+    private static List<Link> defaultStorageDomainLinks(String basePath, boolean includeDisks, boolean includeTemplates) {
+        // Mirrors the rels you pasted; keep stable order.
+        // You can add/remove based on what endpoints you actually implement.
+        List<Link> common = new java.util.ArrayList<>();
+        common.add(Link.of("diskprofiles", href(basePath, "/diskprofiles")));
+        if (includeDisks) {
+            common.add(Link.of("disks", href(basePath, "/disks")));
+            common.add(Link.of("storageconnections", href(basePath, "/storageconnections")));
+        }
+        common.add(Link.of("permissions", href(basePath, "/permissions")));
+        if (includeTemplates) {
+            common.add(Link.of("templates", href(basePath, "/templates")));
+            common.add(Link.of("vms", href(basePath, "/vms")));
+        } else {
+            common.add(Link.of("images", href(basePath, "/images")));
+        }
+        common.add(Link.of("disksnapshots", href(basePath, "/disksnapshots")));
+        return common;
+    }
+
+    private static String mapPoolStatus(StoragePoolJoinVO pool) {
+        // This is approximate; adjust if you have better signals.
+        try {
+            Object status = pool.getStatus(); // often StoragePoolStatus enum
+            if (status != null) {
+                String s = status.toString().toLowerCase();
+                if (s.contains("up") || s.contains("enabled")) return "active";
+                if (s.contains("maintenance")) return "maintenance";
+            }
+        } catch (Exception ignored) { }
+        return "inactive";
+    }
+
+    private static String mapPrimaryStorageType(StoragePoolJoinVO pool) {
+        try {
+            Object t = pool.getPoolType(); // often StoragePoolType enum
+            if (t != null) {
+                String s = t.toString().toLowerCase();
+                if (s.contains("networkfilesystem") || s.contains("nfs") || s.contains("sharedmountpoint")) return "nfs";
+                if (s.contains("iscsi")) return "iscsi";
+                if (s.contains("filesystem")) return "localfs";
+                if (s.contains("rbd") || s.contains("ceph")) return "cinder"; // not perfect; pick stable
+            }
+        } catch (Exception ignored) { }
+        return "unknown";
+    }
+
+    private static String mapImageStorageType(ImageStoreJoinVO store) {
+        // If your secondary store is S3/NFS/etc, you may want different mapping.
+        // For your oVirt sample, "glance" is used for an image repo.
+        try {
+            String provider = store.getProviderName(); // may exist
+            if (provider != null && provider.toLowerCase().contains("glance")) return "glance";
+        } catch (Exception ignored) { }
+        return "glance";
+    }
+
+    private static String href(String baseUrl, String path) {
+        if (baseUrl.endsWith("/")) baseUrl = baseUrl.substring(0, baseUrl.length() - 1);
+        return baseUrl + path;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverter.java
new file mode 100644
index 000000000000..dc3fe17a3d07
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverter.java
@@ -0,0 +1,270 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.Arrays;
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.storage.sharedfs.SharedFS;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.Cpu;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.Os;
+import org.apache.cloudstack.veeam.api.dto.OvfXmlUtil;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Topology;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.network.security.SecurityGroupVO;
+import com.cloud.vm.VirtualMachine;
+
+public final class UserVmJoinVOToVmConverter {
+
+    private UserVmJoinVOToVmConverter() {
+    }
+
+    /**
+     * Convert CloudStack UserVmJoinVO -> oVirt-like Vm DTO.
+     *
+     */
+    public static Vm toVm(final UserVmJoinVO src,
+                          final Function<Long, HostJoinVO> hostResolver,
+                          final Function<Long, Map<String, String>> detailsResolver,
+                          final Function<Long, List<Tag>> tagsResolver,
+                          final Function<Long, List<DiskAttachment>> disksResolver,
+                          final Function<UserVmJoinVO, List<Nic>> nicsResolver,
+                          final Function<UserVmJoinVO, SharedFS> sharedFsResolver,
+                          final Function<Long, List<SecurityGroupVO>> securityGroupsResolver,
+                          final boolean allContent) {
+        if (src == null) {
+            return null;
+        }
+        final String basePath = VeeamControlService.ContextPath.value();
+        final Vm dst = new Vm();
+
+        dst.setId(src.getUuid());
+        dst.setName(StringUtils.firstNonBlank(src.getName(), src.getInstanceName()));
+        // CloudStack doesn't really have "description" for VM; displayName is closest
+        dst.setDescription(src.getDisplayName());
+        dst.setHref(basePath + VmsRouteHandler.BASE_ROUTE + "/" + src.getUuid());
+        dst.setStatus(mapStatus(src.getState()));
+        dst.setCreationTime(src.getCreated().getTime());
+        final Date lastUpdated = src.getLastUpdated() != null ? src.getLastUpdated() : src.getCreated();
+        if ("down".equals(dst.getStatus())) {
+            dst.setStopTime(lastUpdated.getTime());
+        }
+        if ("up".equals(dst.getStatus())) {
+            dst.setStartTime(lastUpdated.getTime());
+        }
+        final Ref template = buildRef(
+                basePath + ApiRouteHandler.BASE_ROUTE,
+                "templates",
+                src.getTemplateUuid()
+        );
+        dst.setTemplate(template);
+        dst.setOriginalTemplate(template);
+        if (StringUtils.isNotBlank(src.getHostUuid())) {
+            dst.setHost(buildRef(
+                    basePath + ApiRouteHandler.BASE_ROUTE,
+                    "hosts",
+                    src.getHostUuid()));
+        }
+        if (hostResolver != null) {
+            Long hostId = (src.getHostId() == null || src.getHostId() == 0) ? src.getLastHostId() : src.getHostId();
+            HostJoinVO hostVo = hostResolver.apply(hostId);
+            if (hostVo != null) {
+                dst.setHost(buildRef(
+                        basePath + ApiRouteHandler.BASE_ROUTE,
+                        "hosts",
+                        hostVo.getUuid()));
+                dst.setCluster(buildRef(
+                        basePath + ApiRouteHandler.BASE_ROUTE,
+                        "clusters",
+                        hostVo.getClusterUuid()));
+            }
+        }
+
+        String memory = String.valueOf(src.getRamSize() * 1024L * 1024L);
+        dst.setMemory(memory);
+        Vm.MemoryPolicy memoryPolicy = new Vm.MemoryPolicy();
+        memoryPolicy.setGuaranteed(memory);
+        memoryPolicy.setMax(memory);
+        memoryPolicy.setBallooning("false");
+        dst.setMemoryPolicy(memoryPolicy);
+        Cpu cpu = new Cpu();
+        cpu.setArchitecture(src.getArch());
+        cpu.setTopology(new Topology(src.getCpu(), 1, 1));
+        dst.setCpu(cpu);
+        Os os = new Os();
+        os.setType(Os.inferTypeFromOsName(src.getGuestOsDisplayName()));
+        Os.Boot boot = new Os.Boot();
+        boot.setDevices(NamedList.of("device", List.of("hd")));
+        os.setBoot(boot);
+        dst.setOs(os);
+        Vm.Bios bios = Vm.Bios.getDefault();
+        Map<String, String> details = null;
+        if (detailsResolver != null) {
+            details = detailsResolver.apply(src.getId());
+            Vm.Bios.updateBios(bios, MapUtils.getString(details, ApiConstants.BootType.UEFI.toString()));
+        }
+        dst.setBios(bios);
+        dst.setType("desktop");
+        dst.setOrigin("ovirt");
+        dst.setStateless("false");
+
+        if (disksResolver != null) {
+            List<DiskAttachment> diskAttachments = disksResolver.apply(src.getId());
+            dst.setDiskAttachments(NamedList.of("disk_attachment", diskAttachments));
+        }
+
+        if (nicsResolver != null) {
+            List<Nic> nics = nicsResolver.apply(src);
+            dst.setNics(NamedList.of("nic", nics));
+        }
+
+        dst.setActions(NamedList.of("link", List.of(
+                BaseDto.getActionLink("start", dst.getHref()),
+                BaseDto.getActionLink("stop", dst.getHref()),
+                BaseDto.getActionLink("shutdown", dst.getHref())
+        )));
+        dst.setLink(List.of(
+                BaseDto.getActionLink("diskattachments", dst.getHref()),
+                BaseDto.getActionLink("nics", dst.getHref()),
+                BaseDto.getActionLink("reporteddevices", dst.getHref()),
+                BaseDto.getActionLink("snapshots", dst.getHref())
+        ));
+        if (tagsResolver != null) {
+            List<Tag> tags = tagsResolver.apply(src.getId());
+            dst.setTags(NamedList.of("tag", tags));
+        }
+        dst.setCpuProfile(Ref.of(
+                basePath + ApiRouteHandler.BASE_ROUTE + "/cpuprofiles/" + src.getServiceOfferingUuid(),
+                src.getServiceOfferingUuid()));
+
+        dst.setInstanceId(src.getUuid());
+        dst.setInstanceName(src.getInstanceName());
+        dst.setInstanceGroupId(src.getInstanceGroupUuid());
+        dst.setAccountId(src.getAccountUuid());
+        dst.setAffinityGroupId(src.getAffinityGroupUuid());
+        dst.setUserDataId(src.getUserDataUuid());
+        dst.setDetails(details);
+        dst.setSshKeyPairNames(src.getKeypairNames());
+        dst.setGuestOsId(src.getGuestOsUuid());
+        dst.setGuestOsName(src.getGuestOsDisplayName());
+        dst.setInstanceType(src.getUserVmType());
+        updateSharedFSDetailsIfNeeded(src, sharedFsResolver, dst);
+        updateSecurityGroupsIfNeeded(src, securityGroupsResolver, dst);
+
+        // Keep at end
+        if (allContent) {
+            dst.setInitialization(getOvfInitialization(dst, src));
+        }
+
+        return dst;
+    }
+
+    private static void updateSecurityGroupsIfNeeded(UserVmJoinVO src, Function<Long, List<SecurityGroupVO>> securityGroupsResolver, Vm dst) {
+        if (securityGroupsResolver == null) {
+            return;
+        }
+        List<SecurityGroupVO> securityGroups = securityGroupsResolver.apply(src.getId());
+        if (CollectionUtils.isEmpty(securityGroups)) {
+            return;
+        }
+        dst.setSecurityGroupIds(securityGroups.stream()
+                .map(SecurityGroupVO::getUuid)
+                .collect(Collectors.toList()));
+    }
+
+    private static void updateSharedFSDetailsIfNeeded(UserVmJoinVO src, Function<UserVmJoinVO, SharedFS> sharedFsResolver, Vm dst) {
+        if (sharedFsResolver == null || dst.getDiskAttachments() == null) {
+            return;
+        }
+        SharedFS sharedFS = sharedFsResolver.apply(src);
+        if (sharedFS == null) {
+            return;
+        }
+        Optional<DiskAttachment> disk = dst.getDiskAttachments().getItems()
+                .stream()
+                .filter(d -> d.getInternalId() == sharedFS.getVolumeId())
+                .findFirst();
+        disk.ifPresent(diskAttachment -> {
+            dst.setSharedFSId(sharedFS.getUuid());
+            dst.setSharedFsVolumeName(diskAttachment.getLogicalName());
+        });
+    }
+
+    private static Vm.Initialization getOvfInitialization(Vm vm, UserVmJoinVO vo) {
+        final Vm.Initialization.Configuration configuration = new Vm.Initialization.Configuration();
+        configuration.setType("ovf");
+        configuration.setData(OvfXmlUtil.toXml(vm, vo));
+
+        final Vm.Initialization initialization = new Vm.Initialization();
+        initialization.setConfiguration(configuration);
+        return initialization;
+    }
+
+    public static List<Vm> toVmList(final List<UserVmJoinVO> srcList,
+                                    final Function<Long, HostJoinVO> hostResolver,
+                                    final Function<Long, Map<String, String>> detailsResolver,
+                                    final Function<Long, List<Tag>> tagsResolver,
+                                    final Function<Long, List<DiskAttachment>> disksResolver,
+                                    final Function<UserVmJoinVO, List<Nic>> nicsResolver,
+                                    final Function<UserVmJoinVO, SharedFS> sharedFsResolver,
+                                    final Function<Long, List<SecurityGroupVO>> securityGroupsResolver,
+                                    final boolean allContent) {
+        return srcList.stream()
+                .map(v -> toVm(v, hostResolver, detailsResolver, tagsResolver, disksResolver,
+                        nicsResolver, sharedFsResolver, securityGroupsResolver, allContent))
+                .collect(Collectors.toList());
+    }
+
+    private static String mapStatus(final VirtualMachine.State state) {
+        if (Arrays.asList(
+                VirtualMachine.State.Running,
+                VirtualMachine.State.Migrating,
+                VirtualMachine.State.Restoring).contains(state)) {
+            return "up";
+        }
+        return "down";
+    }
+
+    private static Ref buildRef(final String baseHref, final String suffix, final String id) {
+        if (StringUtils.isBlank(id)) {
+            return null;
+        }
+        return Ref.of((baseHref != null) ? (baseHref + "/" + suffix + "/" + id) : null, id);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverter.java
new file mode 100644
index 000000000000..7f64b6b7d4aa
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverter.java
@@ -0,0 +1,45 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.time.Instant;
+
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.NumbersUtil;
+
+public class UserVmVOToCheckpointConverter {
+
+    public static Checkpoint toCheckpoint(String checkpointId, String createTimeStr) {
+        if (StringUtils.isEmpty(checkpointId)) {
+            return null;
+        }
+        Checkpoint checkpoint = new Checkpoint();
+        checkpoint.setId(checkpointId);
+        checkpoint.setName(checkpointId);
+        long createTimeSeconds = createTimeStr != null ? NumbersUtil.parseLong(createTimeStr, 0L) : 0L;
+        if (createTimeSeconds > 0) {
+            checkpoint.setCreationDate(String.valueOf(Instant.ofEpochSecond(createTimeSeconds).toEpochMilli()));
+        } else {
+            checkpoint.setCreationDate(String.valueOf(System.currentTimeMillis()));
+        }
+        checkpoint.setState("created");
+        return checkpoint;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverter.java
new file mode 100644
index 000000000000..4dbc71505d79
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverter.java
@@ -0,0 +1,54 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.List;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+
+import com.cloud.vm.snapshot.VMSnapshot;
+import com.cloud.vm.snapshot.VMSnapshotVO;
+
+public class VmSnapshotVOToSnapshotConverter {
+    public static Snapshot toSnapshot(final VMSnapshotVO vmSnapshotVO, String vmUuid) {
+        final String basePath = VeeamControlService.ContextPath.value();
+        final Snapshot snapshot = new Snapshot();
+        snapshot.setId(vmSnapshotVO.getUuid());
+        snapshot.setHref(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vmUuid + "/snapshots/" + vmSnapshotVO.getUuid());
+        snapshot.setVm(Vm.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vmUuid, vmUuid));
+        snapshot.setDescription(vmSnapshotVO.getDescription());
+        snapshot.setSnapshotType("active");
+        snapshot.setDate(vmSnapshotVO.getCreated().getTime());
+        snapshot.setPersistMemorystate(String.valueOf(VMSnapshotVO.Type.DiskAndMemory.equals(vmSnapshotVO.getType())));
+        snapshot.setSnapshotStatus(VMSnapshot.State.Ready.equals(vmSnapshotVO.getState()) ? "ok" : "locked");
+        snapshot.setActions(NamedList.of("link", List.of(BaseDto.getActionLink("restore", snapshot.getHref()))));
+        return snapshot;
+    }
+
+    public static List<Snapshot> toSnapshotList(final List<VMSnapshotVO> vmSnapshotVOList, final String vmUuid) {
+        return vmSnapshotVOList.stream()
+                .map(v -> toSnapshot(v, vmUuid))
+                .collect(Collectors.toList());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverter.java
new file mode 100644
index 000000000000..ea1a6d6fbf1e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverter.java
@@ -0,0 +1,198 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import java.util.ArrayList;
+import java.util.List;
+import java.util.function.Function;
+import java.util.stream.Collectors;
+
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.ApiRouteHandler;
+import org.apache.cloudstack.veeam.api.DisksRouteHandler;
+import org.apache.cloudstack.veeam.api.VmsRouteHandler;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.Link;
+import org.apache.cloudstack.veeam.api.dto.NamedList;
+import org.apache.cloudstack.veeam.api.dto.Ref;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+
+import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Volume;
+
+public class VolumeJoinVOToDiskConverter {
+    public static Disk toDisk(final VolumeJoinVO vol, final Function<VolumeJoinVO, Long> physicalSizeResolver) {
+        final Disk disk = new Disk();
+        final String basePath = VeeamControlService.ContextPath.value();
+        final String apiBasePath = basePath + ApiRouteHandler.BASE_ROUTE;
+        final String diskId = vol.getUuid();
+        final String diskHref = basePath + DisksRouteHandler.BASE_ROUTE + "/" + diskId;
+
+        disk.setId(diskId);
+        disk.setHref(diskHref);
+        disk.setBootable(String.valueOf(Volume.Type.ROOT.equals(vol.getVolumeType())));
+
+        // Names
+        disk.setName(vol.getName());
+        disk.setAlias(vol.getName());
+        disk.setDescription(vol.getName());
+
+        // Sizes (bytes)
+        final long size = vol.getSize();
+        final long actualSize = vol.getVolumeStoreSize();
+
+        disk.setProvisionedSize(String.valueOf(size));
+        disk.setActualSize(String.valueOf(actualSize));
+        disk.setTotalSize(String.valueOf(size));
+        Long physicalSize = null;
+        if (physicalSizeResolver != null) {
+            physicalSize = physicalSizeResolver.apply(vol);
+        }
+        if (physicalSize != null) {
+            disk.setActualSize(String.valueOf(physicalSize));
+        }
+
+        // Disk format
+        disk.setFormat(mapFormat(vol.getFormat()));
+        disk.setQcowVersion("qcow2_v3");
+
+        // Content & storage
+        disk.setContentType("data");
+        disk.setStorageType("image");
+        disk.setSparse("true");
+        disk.setShareable("false");
+
+        // Status
+        disk.setStatus(mapStatus(vol.getState()));
+
+        // Backup-related flags (safe defaults)
+        disk.setBackup("none");
+        disk.setPropagateErrors("false");
+        disk.setWipeAfterDelete("false");
+
+        // Image ID (best-effort)
+        disk.setImageId(vol.getPath()); // acceptable placeholder
+
+        // Disk profile (optional)
+        disk.setDiskProfile(Ref.of(
+                apiBasePath + "/diskprofiles/" + vol.getDiskOfferingUuid(),
+                String.valueOf(vol.getDiskOfferingUuid())
+        ));
+
+        // Storage domains
+        if (vol.getPoolUuid() != null) {
+            StorageDomain sd = new StorageDomain();
+            sd.setHref(apiBasePath + "/storagedomains/" + vol.getPoolUuid());
+            sd.setId(vol.getPoolUuid());
+            disk.setStorageDomains(NamedList.of("storage_domain", List.of(sd)));
+        }
+
+        // Links
+        disk.setLink(List.of(
+                Link.of("disksnapshots", diskHref + "/disksnapshots")
+        ));
+
+        return disk;
+    }
+
+    public static List<Disk> toDiskList(final List<VolumeJoinVO> srcList,
+                        final Function<VolumeJoinVO, Long> physicalSizeResolver) {
+        return srcList.stream()
+                .map(vo -> toDisk(vo, physicalSizeResolver))
+                .collect(Collectors.toList());
+    }
+
+    public static List<Disk> toDiskListFromVolumeInfos(final List<Backup.VolumeInfo> volumeInfos) {
+        List<Disk> disks = new ArrayList<>();
+        for (Backup.VolumeInfo volumeInfo : volumeInfos) {
+            Disk disk = new Disk();
+            disk.setId(volumeInfo.getUuid());
+            disk.setName(volumeInfo.getUuid());
+            disk.setProvisionedSize(String.valueOf(volumeInfo.getSize()));
+            disk.setActualSize(String.valueOf(volumeInfo.getSize()));
+            disk.setTotalSize(String.valueOf(volumeInfo.getSize()));
+            disk.setBootable(String.valueOf(Volume.Type.ROOT.equals(volumeInfo.getType())));
+            disks.add(disk);
+        }
+        return disks;
+    }
+
+    public static  DiskAttachment toDiskAttachment(final VolumeJoinVO vol,
+                           final Function<VolumeJoinVO, Long> physicalSizeResolver) {
+        final DiskAttachment da = new DiskAttachment();
+        final String basePath = VeeamControlService.ContextPath.value();
+
+        final String diskAttachmentId = vol.getUuid();
+        da.setVm(Vm.of(basePath + VmsRouteHandler.BASE_ROUTE + "/" + vol.getVmUuid(), vol.getVmUuid()));
+
+        da.setId(diskAttachmentId);
+        da.setHref(da.getVm().getHref() + "/diskattachments/" + diskAttachmentId);;
+
+        // Links
+        da.setDisk(toDisk(vol, physicalSizeResolver));
+
+        // Properties
+        da.setActive("true");
+        da.setBootable(String.valueOf(Volume.Type.ROOT.equals(vol.getVolumeType())));
+        da.setIface("virtio_scsi");
+        da.setLogicalName(vol.getName());
+        da.setReadOnly("false");
+        da.setPassDiscard("false");
+
+        da.setInternalId(vol.getId());
+
+        return da;
+    }
+
+    public static List<DiskAttachment> toDiskAttachmentList(final List<VolumeJoinVO> srcList,
+                            final Function<VolumeJoinVO, Long> physicalSizeResolver) {
+        return srcList.stream()
+                .map(vo -> toDiskAttachment(vo, physicalSizeResolver))
+                .collect(Collectors.toList());
+    }
+
+    private static String mapFormat(final Storage.ImageFormat format) {
+        if (format == null) {
+            return "cow";
+        }
+        switch (format) {
+            case RAW:
+                return "raw";
+            case QCOW2:
+            default:
+                return "cow";
+        }
+    }
+
+    private static String mapStatus(final Volume.State state) {
+        if (state == null) {
+            return "ok";
+        }
+        switch (state) {
+            case Ready:
+            case Allocated:
+                return "ok";
+            default:
+                return "locked";
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Api.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Api.java
new file mode 100644
index 000000000000..93ae93b26d72
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Api.java
@@ -0,0 +1,104 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+/**
+ * Root response for GET /ovirt-engine/api
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Api {
+
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+    private EmptyElement engineBackup;
+    private ProductInfo productInfo;
+    private SpecialObjects specialObjects;
+    private ApiSummary summary;
+    private Long time;
+    private Ref authenticatedUser;
+    private Ref effectiveUser;
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+
+    public EmptyElement getEngineBackup() {
+        return engineBackup;
+    }
+
+    public void setEngineBackup(EmptyElement engineBackup) {
+        this.engineBackup = engineBackup;
+    }
+
+    public ProductInfo getProductInfo() {
+        return productInfo;
+    }
+
+    public void setProductInfo(ProductInfo productInfo) {
+        this.productInfo = productInfo;
+    }
+
+    public SpecialObjects getSpecialObjects() {
+        return specialObjects;
+    }
+
+    public void setSpecialObjects(SpecialObjects specialObjects) {
+        this.specialObjects = specialObjects;
+    }
+
+    public ApiSummary getSummary() {
+        return summary;
+    }
+
+    public void setSummary(ApiSummary summary) {
+        this.summary = summary;
+    }
+
+    public Long getTime() {
+        return time;
+    }
+
+    public void setTime(Long time) {
+        this.time = time;
+    }
+
+    public Ref getAuthenticatedUser() {
+        return authenticatedUser;
+    }
+
+    public void setAuthenticatedUser(Ref authenticatedUser) {
+        this.authenticatedUser = authenticatedUser;
+    }
+
+    public Ref getEffectiveUser() {
+        return effectiveUser;
+    }
+
+    public void setEffectiveUser(Ref effectiveUser) {
+        this.effectiveUser = effectiveUser;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ApiSummary.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ApiSummary.java
new file mode 100644
index 000000000000..a81c2a1d2745
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ApiSummary.java
@@ -0,0 +1,61 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class ApiSummary {
+
+    private SummaryCount hosts;
+    private SummaryCount storageDomains;
+    private SummaryCount users;
+    private SummaryCount vms;
+
+    public SummaryCount getHosts() {
+        return hosts;
+    }
+
+    public void setHosts(SummaryCount hosts) {
+        this.hosts = hosts;
+    }
+
+    public SummaryCount getStorageDomains() {
+        return storageDomains;
+    }
+
+    public void setStorageDomains(SummaryCount storageDomains) {
+        this.storageDomains = storageDomains;
+    }
+
+    public SummaryCount getUsers() {
+        return users;
+    }
+
+    public void setUsers(SummaryCount users) {
+        this.users = users;
+    }
+
+    public SummaryCount getVms() {
+        return vms;
+    }
+
+    public void setVms(SummaryCount vms) {
+        this.vms = vms;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Backup.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Backup.java
new file mode 100644
index 000000000000..b337541bf5ca
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Backup.java
@@ -0,0 +1,103 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class Backup extends BaseDto {
+
+    private String name;
+    private String description;
+    private Long creationDate;
+    private Vm vm;
+    private Host host;
+    private String phase;
+    private String fromCheckpointId;
+    private String toCheckpointId;
+    private NamedList<Disk> disks;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public Long getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(Long creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+
+    public Host getHost() {
+        return host;
+    }
+
+    public void setHost(Host host) {
+        this.host = host;
+    }
+
+    public String getPhase() {
+        return phase;
+    }
+
+    public void setPhase(String phase) {
+        this.phase = phase;
+    }
+
+    public String getFromCheckpointId() {
+        return fromCheckpointId;
+    }
+
+    public void setFromCheckpointId(String fromCheckpointId) {
+        this.fromCheckpointId = fromCheckpointId;
+    }
+
+    public String getToCheckpointId() {
+        return toCheckpointId;
+    }
+
+    public void setToCheckpointId(String toCheckpointId) {
+        this.toCheckpointId = toCheckpointId;
+    }
+
+    public NamedList<Disk> getDisks() {
+        return disks;
+    }
+
+    public void setDisks(NamedList<Disk> disks) {
+        this.disks = disks;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/BaseDto.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/BaseDto.java
new file mode 100644
index 000000000000..0b260a5cdcd7
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/BaseDto.java
@@ -0,0 +1,55 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class BaseDto {
+
+    public static final String ZERO_UUID = "00000000-0000-0000-0000-000000000000";
+
+    private String href;
+    private String id;
+
+    public String getHref() {
+        return href;
+    }
+
+    public void setHref(String href) {
+        this.href = href;
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    public static Link getActionLink(final String action, final String baseHref) {
+        return Link.of(action, baseHref + "/" + action);
+    }
+
+    protected static <T extends BaseDto> T withHrefAndId(T dto, String href, String id) {
+        dto.setHref(href);
+        dto.setId(id);
+        return dto;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Certificate.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Certificate.java
new file mode 100644
index 000000000000..12e99159bfc9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Certificate.java
@@ -0,0 +1,42 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Certificate {
+    private String organization;
+    private String subject;
+
+    public String getOrganization() {
+        return organization;
+    }
+
+    public void setOrganization(String organization) {
+        this.organization = organization;
+    }
+
+    public String getSubject() {
+        return subject;
+    }
+
+    public void setSubject(String subject) {
+        this.subject = subject;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Checkpoint.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Checkpoint.java
new file mode 100644
index 000000000000..763875535904
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Checkpoint.java
@@ -0,0 +1,76 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class Checkpoint extends BaseDto {
+
+    private String name;
+    private String description;
+    private String creationDate;
+    private Vm vm;
+    private String state;
+    private String parentId;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getCreationDate() {
+        return creationDate;
+    }
+
+    public void setCreationDate(String creationDate) {
+        this.creationDate = creationDate;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+
+    public String getState() {
+        return state;
+    }
+
+    public void setState(String state) {
+        this.state = state;
+    }
+
+    public String getParentId() {
+        return parentId;
+    }
+
+    public void setParentId(String parentId) {
+        this.parentId = parentId;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cluster.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cluster.java
new file mode 100644
index 000000000000..db0cd8be6eab
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cluster.java
@@ -0,0 +1,408 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JacksonXmlRootElement(localName = "cluster")
+public final class Cluster extends BaseDto {
+
+    private String name;
+    private String description;
+    private String comment;
+    private String ballooningEnabled;
+    private String biosType;
+    private Cpu cpu;
+    private CustomSchedulingPolicyProperties customSchedulingPolicyProperties;
+    private ErrorHandling errorHandling;
+    private FencingPolicy fencingPolicy;
+    private String fipsMode; // "disabled"
+    private String firewallType; // "firewalld"
+    private String glusterService;
+    private String haReservation;
+    private Ksm ksm;
+    private String logMaxMemoryUsedThreshold;
+    private String logMaxMemoryUsedThresholdType;
+    private MemoryPolicy memoryPolicy;
+    private Migration migration;
+    private RequiredRngSources requiredRngSources;
+    private String switchType;
+    private String threadsAsCores;
+    private String trustedService;
+    private String tunnelMigration;
+    private String upgradeInProgress;
+    private String upgradePercentComplete;
+    private Version version;
+    private String virtService;
+    private String vncEncryption;
+    private Ref dataCenter;
+    private Ref macPool;
+    private Ref schedulingPolicy;
+    private NamedList<Link> actions;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+
+    public String getBallooningEnabled() {
+        return ballooningEnabled;
+    }
+
+    public void setBallooningEnabled(String ballooningEnabled) {
+        this.ballooningEnabled = ballooningEnabled;
+    }
+
+    public String getBiosType() {
+        return biosType;
+    }
+
+    public void setBiosType(String biosType) {
+        this.biosType = biosType;
+    }
+
+    public Cpu getCpu() {
+        return cpu;
+    }
+
+    public void setCpu(Cpu cpu) {
+        this.cpu = cpu;
+    }
+
+    public CustomSchedulingPolicyProperties getCustomSchedulingPolicyProperties() {
+        return customSchedulingPolicyProperties;
+    }
+
+    public void setCustomSchedulingPolicyProperties(CustomSchedulingPolicyProperties customSchedulingPolicyProperties) {
+        this.customSchedulingPolicyProperties = customSchedulingPolicyProperties;
+    }
+
+    public ErrorHandling getErrorHandling() {
+        return errorHandling;
+    }
+
+    public void setErrorHandling(ErrorHandling errorHandling) {
+        this.errorHandling = errorHandling;
+    }
+
+    public FencingPolicy getFencingPolicy() {
+        return fencingPolicy;
+    }
+
+    public void setFencingPolicy(FencingPolicy fencingPolicy) {
+        this.fencingPolicy = fencingPolicy;
+    }
+
+    public String getFipsMode() {
+        return fipsMode;
+    }
+
+    public void setFipsMode(String fipsMode) {
+        this.fipsMode = fipsMode;
+    }
+
+    public String getFirewallType() {
+        return firewallType;
+    }
+
+    public void setFirewallType(String firewallType) {
+        this.firewallType = firewallType;
+    }
+
+    public String getGlusterService() {
+        return glusterService;
+    }
+
+    public void setGlusterService(String glusterService) {
+        this.glusterService = glusterService;
+    }
+
+    public String getHaReservation() {
+        return haReservation;
+    }
+
+    public void setHaReservation(String haReservation) {
+        this.haReservation = haReservation;
+    }
+
+    public Ksm getKsm() {
+        return ksm;
+    }
+
+    public void setKsm(Ksm ksm) {
+        this.ksm = ksm;
+    }
+
+    public String getLogMaxMemoryUsedThreshold() {
+        return logMaxMemoryUsedThreshold;
+    }
+
+    public void setLogMaxMemoryUsedThreshold(String logMaxMemoryUsedThreshold) {
+        this.logMaxMemoryUsedThreshold = logMaxMemoryUsedThreshold;
+    }
+
+    public String getLogMaxMemoryUsedThresholdType() {
+        return logMaxMemoryUsedThresholdType;
+    }
+
+    public void setLogMaxMemoryUsedThresholdType(String logMaxMemoryUsedThresholdType) {
+        this.logMaxMemoryUsedThresholdType = logMaxMemoryUsedThresholdType;
+    }
+
+    public MemoryPolicy getMemoryPolicy() {
+        return memoryPolicy;
+    }
+
+    public void setMemoryPolicy(MemoryPolicy memoryPolicy) {
+        this.memoryPolicy = memoryPolicy;
+    }
+
+    public Migration getMigration() {
+        return migration;
+    }
+
+    public void setMigration(Migration migration) {
+        this.migration = migration;
+    }
+
+    public RequiredRngSources getRequiredRngSources() {
+        return requiredRngSources;
+    }
+
+    public void setRequiredRngSources(RequiredRngSources requiredRngSources) {
+        this.requiredRngSources = requiredRngSources;
+    }
+
+    public String getSwitchType() {
+        return switchType;
+    }
+
+    public void setSwitchType(String switchType) {
+        this.switchType = switchType;
+    }
+
+    public String getThreadsAsCores() {
+        return threadsAsCores;
+    }
+
+    public void setThreadsAsCores(String threadsAsCores) {
+        this.threadsAsCores = threadsAsCores;
+    }
+
+    public String getTrustedService() {
+        return trustedService;
+    }
+
+    public void setTrustedService(String trustedService) {
+        this.trustedService = trustedService;
+    }
+
+    public String getTunnelMigration() {
+        return tunnelMigration;
+    }
+
+    public void setTunnelMigration(String tunnelMigration) {
+        this.tunnelMigration = tunnelMigration;
+    }
+
+    public String getUpgradeInProgress() {
+        return upgradeInProgress;
+    }
+
+    public void setUpgradeInProgress(String upgradeInProgress) {
+        this.upgradeInProgress = upgradeInProgress;
+    }
+
+    public String getUpgradePercentComplete() {
+        return upgradePercentComplete;
+    }
+
+    public void setUpgradePercentComplete(String upgradePercentComplete) {
+        this.upgradePercentComplete = upgradePercentComplete;
+    }
+
+    public Version getVersion() {
+        return version;
+    }
+
+    public void setVersion(Version version) {
+        this.version = version;
+    }
+
+    public String getVirtService() {
+        return virtService;
+    }
+
+    public void setVirtService(String virtService) {
+        this.virtService = virtService;
+    }
+
+    public String getVncEncryption() {
+        return vncEncryption;
+    }
+
+    public void setVncEncryption(String vncEncryption) {
+        this.vncEncryption = vncEncryption;
+    }
+
+    public Ref getDataCenter() {
+        return dataCenter;
+    }
+
+    public void setDataCenter(Ref dataCenter) {
+        this.dataCenter = dataCenter;
+    }
+
+    public Ref getMacPool() {
+        return macPool;
+    }
+
+    public void setMacPool(Ref macPool) {
+        this.macPool = macPool;
+    }
+
+    public Ref getSchedulingPolicy() {
+        return schedulingPolicy;
+    }
+
+    public void setSchedulingPolicy(Ref schedulingPolicy) {
+        this.schedulingPolicy = schedulingPolicy;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class CustomSchedulingPolicyProperties {
+        @JacksonXmlElementWrapper(useWrapping = false)
+        public List<Property> property;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Property {
+        public String name;
+        public String value;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class ErrorHandling {
+        public String onError; // "migrate"
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class FencingPolicy {
+        public String enabled;
+        public SkipIfConnectivityBroken skipIfConnectivityBroken;
+        public String skipIfGlusterBricksUp;
+        public String skipIfGlusterQuorumNotMet;
+        public SkipIfSdActive skipIfSdActive;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class SkipIfConnectivityBroken {
+        public String enabled;
+        public String threshold;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class SkipIfSdActive {
+        public String enabled;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Ksm {
+        public String enabled;
+        public String mergeAcrossNodes;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class MemoryPolicy {
+        public OverCommit overCommit;
+        public TransparentHugepages transparentHugepages;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class OverCommit {
+        public String percent;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class TransparentHugepages {
+        public String enabled;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Migration {
+        public String autoConverge;
+        public Bandwidth bandwidth;
+        public String compressed;
+        public String encrypted;
+        public String parallelMigrationsPolicy;
+        public Ref policy;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Bandwidth {
+        public String assignmentMethod;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class RequiredRngSources {
+        @JacksonXmlElementWrapper(useWrapping = false)
+        public List<String> requiredRngSource;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cpu.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cpu.java
new file mode 100644
index 000000000000..3dce4931c848
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Cpu.java
@@ -0,0 +1,69 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Cpu {
+    private String name;
+    private String speed;
+    private String architecture;
+    private String type;
+    private Topology topology;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getSpeed() {
+        return speed;
+    }
+
+    public void setSpeed(String speed) {
+        this.speed = speed;
+    }
+
+    public String getArchitecture() {
+        return architecture;
+    }
+
+    public void setArchitecture(String architecture) {
+        this.architecture = architecture;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public Topology getTopology() {
+        return topology;
+    }
+
+    public void setTopology(Topology topology) {
+        this.topology = topology;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DataCenter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DataCenter.java
new file mode 100644
index 000000000000..52f6a6c279f1
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DataCenter.java
@@ -0,0 +1,129 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JacksonXmlRootElement(localName = "data_center")
+public final class DataCenter extends BaseDto {
+    private String local;
+    private String quotaMode;
+    private String status;
+    private String storageFormat;
+    private SupportedVersions supportedVersions;
+    private Version version;
+    private Ref macPool;
+    private NamedList<Link> actions;
+    private String name;
+    private String description;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    public List<Link> link;
+
+    public String getLocal() {
+        return local;
+    }
+
+    public void setLocal(String local) {
+        this.local = local;
+    }
+
+    public String getQuotaMode() {
+        return quotaMode;
+    }
+
+    public void setQuotaMode(String quotaMode) {
+        this.quotaMode = quotaMode;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getStorageFormat() {
+        return storageFormat;
+    }
+
+    public void setStorageFormat(String storageFormat) {
+        this.storageFormat = storageFormat;
+    }
+
+    public SupportedVersions getSupportedVersions() {
+        return supportedVersions;
+    }
+
+    public void setSupportedVersions(SupportedVersions supportedVersions) {
+        this.supportedVersions = supportedVersions;
+    }
+
+    public Version getVersion() {
+        return version;
+    }
+
+    public void setVersion(Version version) {
+        this.version = version;
+    }
+
+    public Ref getMacPool() {
+        return macPool;
+    }
+
+    public void setMacPool(Ref macPool) {
+        this.macPool = macPool;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Disk.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Disk.java
new file mode 100644
index 000000000000..c9a19794c189
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Disk.java
@@ -0,0 +1,247 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JacksonXmlRootElement(localName = "disk")
+public final class Disk extends BaseDto {
+
+    private String bootable;
+    private String actualSize;
+    private String alias;
+    private String backup;
+    private String contentType;
+    private String format;
+    private String imageId;
+    private String propagateErrors;
+    private String initialSize;
+    private String provisionedSize;
+    private String qcowVersion;
+    private String shareable;
+    private String sparse;
+    private String status;
+    private String storageType;
+    private String totalSize;
+    private String wipeAfterDelete;
+    private Ref diskProfile;
+    private Ref quota;
+    private NamedList<StorageDomain> storageDomains;
+    private NamedList<Link> actions;
+    private String name;
+    private String description;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+
+    public String getBootable() {
+        return bootable;
+    }
+
+    public void setBootable(String bootable) {
+        this.bootable = bootable;
+    }
+
+    public String getActualSize() {
+        return actualSize;
+    }
+
+    public void setActualSize(String actualSize) {
+        this.actualSize = actualSize;
+    }
+
+    public String getAlias() {
+        return alias;
+    }
+
+    public void setAlias(String alias) {
+        this.alias = alias;
+    }
+
+    public String getBackup() {
+        return backup;
+    }
+
+    public void setBackup(String backup) {
+        this.backup = backup;
+    }
+
+    public String getContentType() {
+        return contentType;
+    }
+
+    public void setContentType(String contentType) {
+        this.contentType = contentType;
+    }
+
+    public String getFormat() {
+        return format;
+    }
+
+    public void setFormat(String format) {
+        this.format = format;
+    }
+
+    public String getImageId() {
+        return imageId;
+    }
+
+    public void setImageId(String imageId) {
+        this.imageId = imageId;
+    }
+
+    public String getPropagateErrors() {
+        return propagateErrors;
+    }
+
+    public void setPropagateErrors(String propagateErrors) {
+        this.propagateErrors = propagateErrors;
+    }
+
+    public String getInitialSize() {
+        return initialSize;
+    }
+
+    public void setInitialSize(String initialSize) {
+        this.initialSize = initialSize;
+    }
+
+    public String getProvisionedSize() {
+        return provisionedSize;
+    }
+
+    public void setProvisionedSize(String provisionedSize) {
+        this.provisionedSize = provisionedSize;
+    }
+
+    public String getQcowVersion() {
+        return qcowVersion;
+    }
+
+    public void setQcowVersion(String qcowVersion) {
+        this.qcowVersion = qcowVersion;
+    }
+
+    public String getShareable() {
+        return shareable;
+    }
+
+    public void setShareable(String shareable) {
+        this.shareable = shareable;
+    }
+
+    public String getSparse() {
+        return sparse;
+    }
+
+    public void setSparse(String sparse) {
+        this.sparse = sparse;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getStorageType() {
+        return storageType;
+    }
+
+    public void setStorageType(String storageType) {
+        this.storageType = storageType;
+    }
+
+    public String getTotalSize() {
+        return totalSize;
+    }
+
+    public void setTotalSize(String totalSize) {
+        this.totalSize = totalSize;
+    }
+
+    public String getWipeAfterDelete() {
+        return wipeAfterDelete;
+    }
+
+    public void setWipeAfterDelete(String wipeAfterDelete) {
+        this.wipeAfterDelete = wipeAfterDelete;
+    }
+
+    public Ref getDiskProfile() {
+        return diskProfile;
+    }
+
+    public void setDiskProfile(Ref diskProfile) {
+        this.diskProfile = diskProfile;
+    }
+
+    public Ref getQuota() {
+        return quota;
+    }
+
+    public void setQuota(Ref quota) {
+        this.quota = quota;
+    }
+
+    public NamedList<StorageDomain> getStorageDomains() {
+        return storageDomains;
+    }
+
+    public void setStorageDomains(NamedList<StorageDomain> storageDomains) {
+        this.storageDomains = storageDomains;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DiskAttachment.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DiskAttachment.java
new file mode 100644
index 000000000000..6b3518dc8e79
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/DiskAttachment.java
@@ -0,0 +1,124 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class DiskAttachment extends BaseDto {
+
+    private String active;
+    private String bootable;
+    @JsonProperty("interface")
+    private String iface; // virtio_scsi etc
+    private String logicalName;
+    private String passDiscard;
+    private String readOnly;
+    private String usesScsiReservation;
+    private Disk disk;
+    private Vm vm;
+
+    // Internal properties
+    private long internalId;
+
+    public DiskAttachment() {
+    }
+
+    public String getActive() {
+        return active;
+    }
+
+    public void setActive(String active) {
+        this.active = active;
+    }
+
+    public String getBootable() {
+        return bootable;
+    }
+
+    public void setBootable(String bootable) {
+        this.bootable = bootable;
+    }
+
+    public String getIface() {
+        return iface;
+    }
+
+    public void setIface(String iface) {
+        this.iface = iface;
+    }
+
+    public String getLogicalName() {
+        return logicalName;
+    }
+
+    public void setLogicalName(String logicalName) {
+        this.logicalName = logicalName;
+    }
+
+    public String getPassDiscard() {
+        return passDiscard;
+    }
+
+    public void setPassDiscard(String passDiscard) {
+        this.passDiscard = passDiscard;
+    }
+
+    public String getReadOnly() {
+        return readOnly;
+    }
+
+    public void setReadOnly(String readOnly) {
+        this.readOnly = readOnly;
+    }
+
+    public String getUsesScsiReservation() {
+        return usesScsiReservation;
+    }
+
+    public void setUsesScsiReservation(String usesScsiReservation) {
+        this.usesScsiReservation = usesScsiReservation;
+    }
+
+    public Disk getDisk() {
+        return disk;
+    }
+
+    public void setDisk(Disk disk) {
+        this.disk = disk;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+
+    @JsonIgnore
+    public long getInternalId() {
+        return internalId;
+    }
+
+    public void setInternalId(long internalId) {
+        this.internalId = internalId;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElement.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElement.java
new file mode 100644
index 000000000000..3c4111c55a31
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElement.java
@@ -0,0 +1,26 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+
+@JsonSerialize(using = EmptyElementSerializer.class)
+public final class EmptyElement {
+    public EmptyElement() {
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElementSerializer.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElementSerializer.java
new file mode 100644
index 000000000000..9a877d5e4b25
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/EmptyElementSerializer.java
@@ -0,0 +1,36 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.core.JsonGenerator;
+import com.fasterxml.jackson.databind.JsonSerializer;
+import com.fasterxml.jackson.databind.SerializerProvider;
+
+import java.io.IOException;
+
+/**
+ * Serializes as an "empty object".
+ * With Jackson XML this becomes an empty element: <engine_backup/>.
+ */
+public final class EmptyElementSerializer extends JsonSerializer<EmptyElement> {
+    @Override
+    public void serialize(EmptyElement value, JsonGenerator gen, SerializerProvider serializers) throws IOException {
+        gen.writeStartObject();
+        gen.writeEndObject();
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Fault.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Fault.java
new file mode 100644
index 000000000000..20989d8cbd70
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Fault.java
@@ -0,0 +1,39 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Fault {
+    private String reason; // "Not Found", "Bad Request", "Unauthorized"
+    private String detail; // full message
+
+    public Fault(final String reason, final String detail) {
+        this.reason = reason;
+        this.detail = detail;
+    }
+
+    public String getReason() {
+        return reason;
+    }
+
+    public String getDetail() {
+        return detail;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Host.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Host.java
new file mode 100644
index 000000000000..73efba5eeb89
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Host.java
@@ -0,0 +1,315 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Host extends BaseDto {
+
+    private String address;
+    private String autoNumaStatus;
+    private Certificate certificate;
+    private Cpu cpu;
+    private String externalStatus;
+    private HardwareInformation hardwareInformation;
+    private String kdumpStatus;
+    private Version libvirtVersion;
+    private String maxSchedulingMemory;
+    private String memory;
+    private String numaSupported;
+    private Os os;
+    private String port;
+    private String protocol;
+    private String reinstallationRequired;
+    private String status;
+    private ApiSummary summary;
+    private String type;
+    private String updateAvailable;
+    private Version version;
+    private String vgpuPlacement;
+    private Ref cluster;
+    private NamedList<Link> actions;
+    private String name;
+    private String comment;
+    private List<Link> link;
+
+    // getters/setters (generate via IDE)
+    public String getAddress() {
+        return address;
+    }
+
+    public void setAddress(String address) {
+        this.address = address;
+    }
+
+    public String getAutoNumaStatus() {
+        return autoNumaStatus;
+    }
+
+    public void setAutoNumaStatus(String autoNumaStatus) {
+        this.autoNumaStatus = autoNumaStatus;
+    }
+
+    public Certificate getCertificate() {
+        return certificate;
+    }
+
+    public void setCertificate(Certificate certificate) {
+        this.certificate = certificate;
+    }
+
+    public Cpu getCpu() {
+        return cpu;
+    }
+
+    public void setCpu(Cpu cpu) {
+        this.cpu = cpu;
+    }
+
+    public String getExternalStatus() {
+        return externalStatus;
+    }
+
+    public void setExternalStatus(String externalStatus) {
+        this.externalStatus = externalStatus;
+    }
+
+    public HardwareInformation getHardwareInformation() {
+        return hardwareInformation;
+    }
+
+    public void setHardwareInformation(HardwareInformation hardwareInformation) {
+        this.hardwareInformation = hardwareInformation;
+    }
+
+    public String getKdumpStatus() {
+        return kdumpStatus;
+    }
+
+    public void setKdumpStatus(String kdumpStatus) {
+        this.kdumpStatus = kdumpStatus;
+    }
+
+    public Version getLibvirtVersion() {
+        return libvirtVersion;
+    }
+
+    public void setLibvirtVersion(Version libvirtVersion) {
+        this.libvirtVersion = libvirtVersion;
+    }
+
+    public String getMaxSchedulingMemory() {
+        return maxSchedulingMemory;
+    }
+
+    public void setMaxSchedulingMemory(String maxSchedulingMemory) {
+        this.maxSchedulingMemory = maxSchedulingMemory;
+    }
+
+    public String getMemory() {
+        return memory;
+    }
+
+    public void setMemory(String memory) {
+        this.memory = memory;
+    }
+
+    public String getNumaSupported() {
+        return numaSupported;
+    }
+
+    public void setNumaSupported(String numaSupported) {
+        this.numaSupported = numaSupported;
+    }
+
+    public Os getOs() {
+        return os;
+    }
+
+    public void setOs(Os os) {
+        this.os = os;
+    }
+
+    public String getPort() {
+        return port;
+    }
+
+    public void setPort(String port) {
+        this.port = port;
+    }
+
+    public String getProtocol() {
+        return protocol;
+    }
+
+    public void setProtocol(String protocol) {
+        this.protocol = protocol;
+    }
+
+    public String getReinstallationRequired() {
+        return reinstallationRequired;
+    }
+
+    public void setReinstallationRequired(String reinstallationRequired) {
+        this.reinstallationRequired = reinstallationRequired;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public ApiSummary getSummary() {
+        return summary;
+    }
+
+    public void setSummary(ApiSummary summary) {
+        this.summary = summary;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getUpdateAvailable() {
+        return updateAvailable;
+    }
+
+    public void setUpdateAvailable(String updateAvailable) {
+        this.updateAvailable = updateAvailable;
+    }
+
+    public Version getVersion() {
+        return version;
+    }
+
+    public void setVersion(Version version) {
+        this.version = version;
+    }
+
+    public String getVgpuPlacement() {
+        return vgpuPlacement;
+    }
+
+    public void setVgpuPlacement(String vgpuPlacement) {
+        this.vgpuPlacement = vgpuPlacement;
+    }
+
+    public Ref getCluster() {
+        return cluster;
+    }
+
+    public void setCluster(Ref cluster) {
+        this.cluster = cluster;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static class HardwareInformation {
+        private String manufacturer;
+        private String productName;
+        private String serialNumber;
+        private String uuid;
+        private String version;
+
+        public String getManufacturer() {
+            return manufacturer;
+        }
+
+        public void setManufacturer(String manufacturer) {
+            this.manufacturer = manufacturer;
+        }
+
+        public String getProductName() {
+            return productName;
+        }
+
+        public void setProductName(String productName) {
+            this.productName = productName;
+        }
+
+        public String getSerialNumber() {
+            return serialNumber;
+        }
+
+        public void setSerialNumber(String serialNumber) {
+            this.serialNumber = serialNumber;
+        }
+
+        public String getUuid() {
+            return uuid;
+        }
+
+        public void setUuid(String uuid) {
+            this.uuid = uuid;
+        }
+
+        public String getVersion() {
+            return version;
+        }
+
+        public void setVersion(String version) {
+            this.version = version;
+        }
+    }
+
+    public static Host of(String href, String id) {
+        return withHrefAndId(new Host(), href, id);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ImageTransfer.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ImageTransfer.java
new file mode 100644
index 000000000000..b0a26daa1049
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ImageTransfer.java
@@ -0,0 +1,167 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class ImageTransfer extends BaseDto {
+
+    private String active;
+    private String direction;
+    private String format;
+    private String inactivityTimeout;
+    private String phase;
+    private String proxyUrl;
+    private String shallow;
+    private String timeoutPolicy;
+    private String transferUrl;
+    private String transferred;
+    private Backup backup;
+    private Ref host;
+    private Ref image;
+    private Ref disk;
+    private NamedList<Link> actions;
+
+    @JacksonXmlElementWrapper(useWrapping = false)
+    public List<Link> link;
+
+    public String getActive() {
+        return active;
+    }
+
+    public void setActive(String active) {
+        this.active = active;
+    }
+
+    public String getDirection() {
+        return direction;
+    }
+
+    public void setDirection(String direction) {
+        this.direction = direction;
+    }
+
+    public String getFormat() {
+        return format;
+    }
+
+    public void setFormat(String format) {
+        this.format = format;
+    }
+
+    public String getInactivityTimeout() {
+        return inactivityTimeout;
+    }
+
+    public void setInactivityTimeout(String inactivityTimeout) {
+        this.inactivityTimeout = inactivityTimeout;
+    }
+
+    public String getPhase() {
+        return phase;
+    }
+
+    public void setPhase(String phase) {
+        this.phase = phase;
+    }
+
+    public String getProxyUrl() {
+        return proxyUrl;
+    }
+
+    public void setProxyUrl(String proxyUrl) {
+        this.proxyUrl = proxyUrl;
+    }
+
+    public String getShallow() {
+        return shallow;
+    }
+
+    public void setShallow(String shallow) {
+        this.shallow = shallow;
+    }
+
+    public String getTimeoutPolicy() {
+        return timeoutPolicy;
+    }
+
+    public void setTimeoutPolicy(String timeoutPolicy) {
+        this.timeoutPolicy = timeoutPolicy;
+    }
+
+    public String getTransferUrl() {
+        return transferUrl;
+    }
+
+    public void setTransferUrl(String transferUrl) {
+        this.transferUrl = transferUrl;
+    }
+
+    public String getTransferred() {
+        return transferred;
+    }
+
+    public void setTransferred(String transferred) {
+        this.transferred = transferred;
+    }
+
+    public Backup getBackup() {
+        return backup;
+    }
+
+    public void setBackup(Backup backup) {
+        this.backup = backup;
+    }
+
+    public Ref getHost() {
+        return host;
+    }
+
+    public void setHost(Ref host) {
+        this.host = host;
+    }
+
+    public Ref getImage() {
+        return image;
+    }
+
+    public void setImage(Ref image) {
+        this.image = image;
+    }
+
+    public Ref getDisk() {
+        return disk;
+    }
+
+    public void setDisk(Ref disk) {
+        this.disk = disk;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ip.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ip.java
new file mode 100644
index 000000000000..7afbc0710ffb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ip.java
@@ -0,0 +1,61 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Ip {
+
+    private String address;
+    private String gateway;
+    private String netmask;
+    private String version;
+
+    public String getAddress() {
+        return address;
+    }
+
+    public void setAddress(String address) {
+        this.address = address;
+    }
+
+    public String getGateway() {
+        return gateway;
+    }
+
+    public void setGateway(String gateway) {
+        this.gateway = gateway;
+    }
+
+    public String getNetmask() {
+        return netmask;
+    }
+
+    public void setNetmask(String netmask) {
+        this.netmask = netmask;
+    }
+
+    public String getVersion() {
+        return version;
+    }
+
+    public void setVersion(String version) {
+        this.version = version;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Job.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Job.java
new file mode 100644
index 000000000000..13b0e8a02fd1
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Job.java
@@ -0,0 +1,117 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Job extends BaseDto {
+    private String autoCleared;
+    private String external;
+    private Long lastUpdated;
+    private Long startTime;
+    private Long endTime;
+    private String status;
+    private Ref owner;
+    private NamedList<Link> actions;
+    private String description;
+    private List<Link> link;
+
+    // getters and setters
+    public String getAutoCleared() {
+        return autoCleared;
+    }
+
+    public void setAutoCleared(String autoCleared) {
+        this.autoCleared = autoCleared;
+    }
+
+    public String getExternal() {
+        return external;
+    }
+
+    public void setExternal(String external) {
+        this.external = external;
+    }
+
+    public Long getLastUpdated() {
+        return lastUpdated;
+    }
+
+    public void setLastUpdated(Long lastUpdated) {
+        this.lastUpdated = lastUpdated;
+    }
+
+    public Long getStartTime() {
+        return startTime;
+    }
+
+    public void setStartTime(Long startTime) {
+        this.startTime = startTime;
+    }
+
+    public Long getEndTime() {
+        return endTime;
+    }
+
+    public void setEndTime(Long endTime) {
+        this.endTime = endTime;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public Ref getOwner() {
+        return owner;
+    }
+
+    public void setOwner(Ref owner) {
+        this.owner = owner;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Link.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Link.java
new file mode 100644
index 000000000000..7d67820360f9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Link.java
@@ -0,0 +1,49 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Link {
+    private String rel;
+    private String href;
+
+    public static Link of(final String rel, final String href) {
+        Link link = new Link();
+        link.setRel(rel);
+        link.setHref(href);
+        return link;
+    }
+
+    public String getRel() {
+        return rel;
+    }
+
+    public void setRel(String rel) {
+        this.rel = rel;
+    }
+
+    public String getHref() {
+        return href;
+    }
+
+    public void setHref(String href) {
+        this.href = href;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Mac.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Mac.java
new file mode 100644
index 000000000000..02d908054608
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Mac.java
@@ -0,0 +1,34 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Mac {
+
+    private String address;
+
+    public String getAddress() {
+        return address;
+    }
+
+    public void setAddress(String address) {
+        this.address = address;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/NamedList.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/NamedList.java
new file mode 100644
index 000000000000..fb7c2aa664b3
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/NamedList.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.Collections;
+import java.util.List;
+import java.util.Map;
+import java.util.Map.Entry;
+
+import com.fasterxml.jackson.annotation.JsonAnyGetter;
+import com.fasterxml.jackson.annotation.JsonCreator;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+
+public class NamedList<T> {
+    private final String name;
+    private final List<T> items;
+
+    private NamedList(String name, List<T> items) {
+        if (name == null || name.isEmpty()) {
+            throw new IllegalArgumentException("name must be non-empty");
+        }
+        this.name = name;
+        this.items = items == null ? Collections.emptyList() : items;
+    }
+
+    public static <T> NamedList<T> of(String name, List<T> items) {
+        return new NamedList<>(name, items);
+    }
+
+    @JsonAnyGetter
+    public Map<String, List<T>> asMap() {
+        return Collections.singletonMap(name, items);
+    }
+
+    @JsonCreator
+    public static <T> NamedList<T> fromMap(Map<String, List<T>> map) {
+        if (map == null || map.size() != 1) {
+            throw new IllegalArgumentException("Expected single-property object for NamedList");
+        }
+        Entry<String, List<T>> e = map.entrySet().iterator().next();
+        return new NamedList<>(e.getKey(), e.getValue());
+    }
+
+    @JsonIgnore
+    public List<T> getItems() {
+        return items;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Network.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Network.java
new file mode 100644
index 000000000000..bb72a2ad323f
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Network.java
@@ -0,0 +1,126 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Network extends BaseDto {
+    private String mtu;           // oVirt prints as string
+    private String portIsolation; // "false"
+    private String stp;           // "false"
+    private NamedList<String> usages;     // { usage: ["vm"] }
+    private String vdsmName;
+
+    private Ref dataCenter;
+
+    private String name;
+    private String description;
+    private String comment;
+
+    @JsonProperty("link")
+    private List<Link> link;
+
+    public Network() {
+    }
+
+    // ---- getters / setters ----
+
+    public String getMtu() {
+        return mtu;
+    }
+
+    public void setMtu(final String mtu) {
+        this.mtu = mtu;
+    }
+
+    public String getPortIsolation() {
+        return portIsolation;
+    }
+
+    public void setPortIsolation(final String portIsolation) {
+        this.portIsolation = portIsolation;
+    }
+
+    public String getStp() {
+        return stp;
+    }
+
+    public void setStp(final String stp) {
+        this.stp = stp;
+    }
+
+    public NamedList<String> getUsages() {
+        return usages;
+    }
+
+    public void setUsages(final NamedList<String> usages) {
+        this.usages = usages;
+    }
+
+    public String getVdsmName() {
+        return vdsmName;
+    }
+
+    public void setVdsmName(final String vdsmName) {
+        this.vdsmName = vdsmName;
+    }
+
+    public Ref getDataCenter() {
+        return dataCenter;
+    }
+
+    public void setDataCenter(final Ref dataCenter) {
+        this.dataCenter = dataCenter;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(final String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(final String description) {
+        this.description = description;
+    }
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(final String comment) {
+        this.comment = comment;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(final List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Nic.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Nic.java
new file mode 100644
index 000000000000..2f866abef7f4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Nic.java
@@ -0,0 +1,122 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.annotation.JsonProperty;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlProperty;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Nic extends BaseDto {
+
+    private String name;
+    private String description;
+    @JacksonXmlProperty(localName = "interface")
+    @JsonProperty("interface")
+    private String interfaceType;
+    private String linked;
+    private Mac mac;
+    private String plugged;
+    public String synced;
+    private Ref vnicProfile;
+    private Vm vm;
+    private NamedList<ReportedDevice> reportedDevices;
+
+    public Nic() {
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(final String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(final String description) {
+        this.description = description;
+    }
+
+    public String getInterfaceType() {
+        return interfaceType;
+    }
+
+    public void setInterfaceType(String interfaceType) {
+        this.interfaceType = interfaceType;
+    }
+
+    public String getLinked() {
+        return linked;
+    }
+
+    public void setLinked(String linked) {
+        this.linked = linked;
+    }
+
+    public Mac getMac() {
+        return mac;
+    }
+
+    public void setMac(Mac mac) {
+        this.mac = mac;
+    }
+
+    public String getPlugged() {
+        return plugged;
+    }
+
+    public void setPlugged(String plugged) {
+        this.plugged = plugged;
+    }
+
+    public String getSynced() {
+        return synced;
+    }
+
+    public void setSynced(String synced) {
+        this.synced = synced;
+    }
+
+    public Ref getVnicProfile() {
+        return vnicProfile;
+    }
+
+    public void setVnicProfile(Ref vnicProfile) {
+        this.vnicProfile = vnicProfile;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+
+    public NamedList<ReportedDevice> getReportedDevices() {
+        return reportedDevices;
+    }
+
+    public void setReportedDevices(NamedList<ReportedDevice> reportedDevices) {
+        this.reportedDevices = reportedDevices;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Os.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Os.java
new file mode 100644
index 000000000000..be0f71c56bf8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Os.java
@@ -0,0 +1,114 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Os {
+    private String type;
+    private String version;
+    private Boot boot;
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public Boot getBoot() {
+        return boot;
+    }
+
+    public void setBoot(Boot boot) {
+        this.boot = boot;
+    }
+
+    public final static class Boot {
+        private NamedList<String> devices;
+
+        public NamedList<String> getDevices() {
+            return devices;
+        }
+
+        public void setDevices(NamedList<String> devices) {
+            this.devices = devices;
+        }
+    }
+
+    /**
+     * Infers the oVirt guest OS identifier expected by Veeam from the operating system name.
+     * This allows Veeam to correctly recognize Windows virtual machines and enable features
+     * such as file-level restore.
+     *<p>
+     * Identifier values are derived from the
+     * <a href="https://github.com/oVirt/ovirt-engine/blob/master/packaging/conf/osinfo-defaults.properties">
+     * oVirt OS defaults
+     * </a>.
+     *</p>
+     *
+     * @param name normalized operating system name
+     * @return the matching oVirt Windows OS identifier
+     */
+    public static String getWindowsOsKey(final String name) {
+        if (name.contains("2025")) {
+            return "windows_2025";
+        }
+
+        if (name.contains("2022")) {
+            return "windows_2022";
+        }
+
+        if (name.contains("11")) {
+            return "windows_11";
+        }
+
+        if (name.contains("2019")) {
+            return "windows_2019x64";
+        }
+
+        if (name.contains("2016")) {
+            return "windows_2016x64";
+        }
+
+        if (name.contains("10") && name.contains("64")) {
+            return "windows_10x64";
+        }
+
+        return "windows_10";
+    }
+
+    public static String inferTypeFromOsName(String name) {
+        if (StringUtils.isBlank(name)) {
+            return "other";
+        }
+        String normalized = name.trim().toLowerCase();
+        if (normalized.contains("windows")) {
+            return getWindowsOsKey(normalized);
+        }
+        if (normalized.contains("linux") || normalized.contains("ubuntu") || normalized.contains("debian") ||
+                normalized.contains("centos") || normalized.contains("red hat") || normalized.contains("suse")) {
+            return "linux";
+        }
+        return "other";
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtil.java
new file mode 100644
index 000000000000..5de3647ebeda
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtil.java
@@ -0,0 +1,1138 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.text.SimpleDateFormat;
+import java.util.Arrays;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+import java.util.TimeZone;
+import java.util.UUID;
+
+import javax.xml.XMLConstants;
+import javax.xml.namespace.NamespaceContext;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.xpath.XPath;
+import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathExpressionException;
+import javax.xml.xpath.XPathFactory;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.ObjectUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.logging.log4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.w3c.dom.Document;
+import org.w3c.dom.NamedNodeMap;
+import org.w3c.dom.Node;
+import org.w3c.dom.NodeList;
+import org.xml.sax.SAXException;
+
+import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.utils.Pair;
+
+public class OvfXmlUtil {
+
+    private static final String NS_OVF = "http://schemas.dmtf.org/ovf/envelope/1/";
+    private static final String NS_RASD = "http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData";
+    private static final String NS_VSSD = "http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData";
+    private static final String NS_XSI = "http://www.w3.org/2001/XMLSchema-instance";
+
+    private static final String ZERO_UUID = "00000000-0000-0000-0000-000000000000";
+    private static final TimeZone UTC = TimeZone.getTimeZone("Etc/GMT");
+
+    private static final ThreadLocal<SimpleDateFormat> OVIRT_DTF = ThreadLocal.withInitial(() -> {
+        final SimpleDateFormat sdf = new SimpleDateFormat("yyyy/MM/dd HH:mm:ss", Locale.ROOT);
+        sdf.setTimeZone(UTC);
+        return sdf;
+    });
+    private static final org.slf4j.Logger log = LoggerFactory.getLogger(OvfXmlUtil.class);
+
+    protected enum MemoryAllocationUnit {
+        Bytes("byte", 1),
+        Kilobytes("byte * 2^10", 1024),
+        Megabytes("byte * 2^20", 1024 * 1024),
+        Gigabytes("byte * 2^30", 1024 * 1024 * 1024);
+
+        final String allocationUnitsToken;
+        final long bytesMultiplier;
+
+        MemoryAllocationUnit(String allocationUnitsToken, long bytesMultiplier) {
+            this.allocationUnitsToken = allocationUnitsToken;
+            this.bytesMultiplier = bytesMultiplier;
+        }
+
+        public String getAllocationUnitsToken() {
+            return allocationUnitsToken;
+        }
+
+        public long getBytesMultiplier() {
+            return bytesMultiplier;
+        }
+
+        public static MemoryAllocationUnit fromString(String value) {
+            for (MemoryAllocationUnit unit : MemoryAllocationUnit.values()) {
+                if (StringUtils.isNotBlank(value) &&
+                        (unit.getAllocationUnitsToken().equalsIgnoreCase(value) || unit.name().equalsIgnoreCase(value))) {
+                    return unit;
+                }
+            }
+            return null;
+        }
+    }
+
+    public static String toXml(final Vm vm, final UserVmJoinVO vo) {
+        final String vmId = vm.getId();
+        final String vmName = vm.getName();
+        final String vmDesc = defaultString(vm.getDescription());
+
+        final long creationMillis = vm.getCreationTime();
+        final String creationDate = formatDate(creationMillis);
+        final String exportDate = formatDate(System.currentTimeMillis());
+        final String stopTime = vm.getStopTime() != null ? formatDate(vm.getStopTime()) : creationDate;
+        final String bootTime = vm.getStartTime() != null ? formatDate(vm.getStartTime()) : creationDate;
+
+        // Memory: Vm.memory is bytes (string)
+        final long memBytes = parseLong(vm.getMemory(), MemoryAllocationUnit.Gigabytes.getBytesMultiplier());
+        final long memMb = Math.max(128, memBytes / MemoryAllocationUnit.Megabytes.getBytesMultiplier());
+
+        // CPU: topology cores/sockets/threads. We default sockets=1 threads=1.
+        final int vcpu = Math.max(1, Integer.parseInt(vm.getCpu().getTopology().getCores()));
+        final int sockets = Math.max(1, Integer.parseInt(vm.getCpu().getTopology().getSockets()));
+        final int threads = Math.max(1, Integer.parseInt(vm.getCpu().getTopology().getThreads()));
+        final int cpuPerSocket = Math.max(1, vcpu / sockets);
+        final int maxVcpu = vcpu;
+
+        // Template
+        final Ref template = vm.getTemplate();
+        final String templateId = template != null && StringUtils.isNotBlank(template.getId()) ? template.getId() : ZERO_UUID;
+        final String templateName = template != null ? defaultString(template.getId()) : "Blank";
+
+        // Snapshot id (stable per VM id)
+        final String snapshotId = UUID.nameUUIDFromBytes(("ovf-snap-" + vmId).getBytes(StandardCharsets.UTF_8)).toString();
+
+        final List<Nic> nics = nics(vm);
+
+        final StringBuilder sb = new StringBuilder(16_384);
+        sb.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
+        sb.append("<ovf:Envelope ");
+        sb.append("xmlns:ovf=\"").append(NS_OVF).append("\" ");
+        sb.append("xmlns:rasd=\"").append(NS_RASD).append("\" ");
+        sb.append("xmlns:vssd=\"").append(NS_VSSD).append("\" ");
+        sb.append("xmlns:xsi=\"").append(NS_XSI).append("\" ovf:version=\"4.4.0.0\">");
+
+        // --- References (from disks) ---
+        sb.append("<References>");
+        for (DiskAttachment da : diskAttachments(vm)) {
+            if (da == null || da.getDisk() == null || StringUtils.isBlank(da.getDisk().getId())) {
+                continue;
+            }
+            final String diskId = da.getDisk().getId();
+            final String storageDomainId = firstStorageDomainId(da.getDisk());
+            final String href = storageDomainId + "/" + diskId;
+            sb.append("<File ovf:href=\"").append(escapeAttr(href))
+                    .append("\" ovf:id=\"").append(escapeAttr(diskId))
+                    .append("\" ovf:size=\"4096\" ovf:description=\"Active VM\" ovf:disk_storage_type=\"IMAGE\" ovf:cinder_volume_type=\"\"></File>");
+        }
+        sb.append("</References>");
+
+        // --- NetworkSection ---
+        sb.append("<NetworkSection>");
+        sb.append("<Info>List of networks</Info>");
+        // oVirt often lists networks, but can also be empty. We'll include known names if we can.
+        for (Nic nic : nics(vm)) {
+            if (nic == null) {
+                continue;
+            }
+            final String netName = inferNetworkName(nic);
+            if (StringUtils.isBlank(netName)) {
+                continue;
+            }
+            sb.append("<Network ovf:name=\"").append(escapeAttr(netName)).append("\">");
+            sb.append("<Description>").append(escapeText(defaultString(nic.getDescription()))).append("</Description>");
+            sb.append("</Network>");
+        }
+        sb.append("</NetworkSection>");
+
+        // --- DiskSection ---
+        sb.append("<Section xsi:type=\"ovf:DiskSection_Type\">");
+        sb.append("<Info>List of Virtual Disks</Info>");
+        for (DiskAttachment da : diskAttachments(vm)) {
+            if (da == null || da.getDisk() == null || StringUtils.isBlank(da.getDisk().getId())) {
+                continue;
+            }
+            final Disk d = da.getDisk();
+            final String diskId = d.getId();
+            final String storageDomainId = firstStorageDomainId(d);
+            final String href = storageDomainId + "/" + diskId;
+            final long provBytes = parseLong(d.getProvisionedSize(), 0);
+            final long actualBytes = parseLong(d.getActualSize(), 0);
+            final long provGiB = bytesToGibCeil(provBytes);
+            final long actualGiB = bytesToGibCeil(actualBytes);
+            final String diskInterface = mapDiskInterface(da.getIface());
+
+            sb.append("<Disk");
+            sb.append(" ovf:diskId=\"").append(escapeAttr(diskId)).append("\"");
+            sb.append(" ovf:size=\"").append(provGiB > 0 ? provGiB : 1).append("\"");
+            sb.append(" ovf:actual_size=\"").append(actualGiB > 0 ? actualGiB : 1).append("\"");
+            sb.append(" ovf:vm_snapshot_id=\"").append(escapeAttr(snapshotId)).append("\"");
+            sb.append(" ovf:parentRef=\"\"");
+            sb.append(" ovf:fileRef=\"").append(escapeAttr(href)).append("\"");
+            sb.append(" ovf:format=\"").append(escapeAttr(mapOvfDiskFormat(d.getFormat(), d.getSparse()))).append("\"");
+            sb.append(" ovf:volume-format=\"").append(escapeAttr(mapVolumeFormat(d.getFormat()))).append("\"");
+            sb.append(" ovf:volume-type=\"").append(escapeAttr(mapVolumeType(d.getSparse()))).append("\"");
+            sb.append(" ovf:disk-interface=\"").append(escapeAttr(diskInterface)).append("\"");
+            sb.append(" ovf:read-only=\"").append(escapeAttr(booleanString(da.getReadOnly(), "false"))).append("\"");
+            sb.append(" ovf:shareable=\"").append(escapeAttr(booleanString(d.getShareable(), "false"))).append("\"");
+            sb.append(" ovf:boot=\"").append(escapeAttr(booleanString(da.getBootable(), "false"))).append("\"");
+            sb.append(" ovf:pass-discard=\"").append(escapeAttr(booleanString(da.getPassDiscard(), "false"))).append("\"");
+            sb.append(" ovf:incremental-backup=\"false\"");
+            sb.append(" ovf:disk-alias=\"").append(escapeAttr(defaultString(d.getAlias()))).append("\"");
+            sb.append(" ovf:disk-description=\"").append(escapeAttr(defaultString(d.getDescription()))).append("\"");
+            sb.append(" ovf:wipe-after-delete=\"").append(escapeAttr(booleanString(d.getWipeAfterDelete(), "false"))).append("\"");
+            sb.append("></Disk>");
+        }
+        sb.append("</Section>");
+
+        addCloudStackMetadata(vm, vo, sb);
+
+        // --- Content / VirtualSystem ---
+        sb.append("<Content ovf:id=\"out\" xsi:type=\"ovf:VirtualSystem_Type\">");
+        sb.append("<Name>").append(escapeText(vmName)).append("</Name>");
+        sb.append("<Description>").append(escapeText(vmDesc)).append("</Description>");
+        sb.append("<Comment></Comment>");
+        sb.append("<CreationDate>").append(creationDate).append("</CreationDate>");
+        sb.append("<ExportDate>").append(exportDate).append("</ExportDate>");
+        sb.append("<DeleteProtected>false</DeleteProtected>");
+        sb.append("<SsoMethod>guest_agent</SsoMethod>");
+        sb.append("<IsSmartcardEnabled>false</IsSmartcardEnabled>");
+        sb.append("<NumOfIoThreads>1</NumOfIoThreads>");
+        sb.append("<TimeZone>Etc/GMT</TimeZone>");
+        sb.append("<default_boot_sequence>0</default_boot_sequence>");
+        sb.append("<Generation>11</Generation>");
+        sb.append("<ClusterCompatibilityVersion>4.8</ClusterCompatibilityVersion>");
+        sb.append("<VmType>1</VmType>");
+        sb.append("<ResumeBehavior>AUTO_RESUME</ResumeBehavior>");
+        sb.append("<MinAllocatedMem>").append(memMb).append("</MinAllocatedMem>");
+        sb.append("<IsStateless>").append(escapeText(booleanString(vm.getStateless(), "false"))).append("</IsStateless>");
+        sb.append("<IsRunAndPause>false</IsRunAndPause>");
+        sb.append("<AutoStartup>false</AutoStartup>");
+        sb.append("<Priority>0</Priority>");
+        sb.append("<CreatedByUserId>").append(vo.getAccountUuid()).append("</CreatedByUserId>");
+        sb.append("<MigrationSupport>0</MigrationSupport>");
+        sb.append("<IsBootMenuEnabled>").append(escapeText(booleanString(vm.getBios() != null && vm.getBios().getBootMenu() != null ? vm.getBios().getBootMenu().getEnabled() : null, "false"))).append("</IsBootMenuEnabled>");
+        sb.append("<IsSpiceFileTransferEnabled>true</IsSpiceFileTransferEnabled>");
+        sb.append("<IsSpiceCopyPasteEnabled>true</IsSpiceCopyPasteEnabled>");
+        sb.append("<AllowConsoleReconnect>false</AllowConsoleReconnect>");
+        sb.append("<ConsoleDisconnectAction>LOCK_SCREEN</ConsoleDisconnectAction>");
+        sb.append("<ConsoleDisconnectActionDelay>0</ConsoleDisconnectActionDelay>");
+        sb.append("<CustomEmulatedMachine></CustomEmulatedMachine>");
+        sb.append("<BiosType>").append(vm.getBios() != null ? vm.getBios().getTypeOrdinal() : 1).append("</BiosType>");
+        sb.append("<CustomCpuName></CustomCpuName>");
+        sb.append("<PredefinedProperties></PredefinedProperties>");
+        sb.append("<UserDefinedProperties></UserDefinedProperties>");
+        sb.append("<MaxMemorySizeMb>").append(memMb).append("</MaxMemorySizeMb>");
+        sb.append("<MultiQueuesEnabled>true</MultiQueuesEnabled>");
+        sb.append("<VirtioScsiMultiQueuesEnabled>false</VirtioScsiMultiQueuesEnabled>");
+        sb.append("<UseHostCpu>false</UseHostCpu>");
+        sb.append("<BalloonEnabled>").append(mapBalloonEnabled(vm)).append("</BalloonEnabled>");
+        sb.append("<CpuPinningPolicy>0</CpuPinningPolicy>");
+        sb.append("<ClusterName></ClusterName>");
+        sb.append("<TemplateId>").append(escapeText(templateId)).append("</TemplateId>");
+        sb.append("<TemplateName>").append(escapeText(templateName)).append("</TemplateName>");
+        sb.append("<IsInitilized>true</IsInitilized>");
+        sb.append("<Origin>3</Origin>");
+        sb.append("<quota_id>").append(ZERO_UUID).append("</quota_id>");
+        sb.append("<DefaultDisplayType>2</DefaultDisplayType>");
+        sb.append("<TrustedService>false</TrustedService>");
+        sb.append("<OriginalTemplateId>").append(escapeText(templateId)).append("</OriginalTemplateId>");
+        sb.append("<OriginalTemplateName>").append(escapeText(templateName)).append("</OriginalTemplateName>");
+        sb.append("<UseLatestVersion>false</UseLatestVersion>");
+        sb.append("<StopTime>").append(stopTime).append("</StopTime>");
+        sb.append("<BootTime>").append(bootTime).append("</BootTime>");
+        sb.append("<Downtime>0</Downtime>");
+
+        // --- Operating system section ---
+        sb.append("<Section ovf:id=\"").append(escapeAttr(vmId)).append("\" ovf:required=\"false\" xsi:type=\"ovf:OperatingSystemSection_Type\">");
+        sb.append("<Info>Guest Operating System</Info>");
+        sb.append("<Description>").append(escapeText(inferOsDescription(vm))).append("</Description>");
+        sb.append("</Section>");
+
+        // --- Virtual hardware section ---
+        sb.append("<Section xsi:type=\"ovf:VirtualHardwareSection_Type\">");
+        sb.append("<Info>").append(vcpu).append(" CPU, ").append(memMb).append(" Memory</Info>");
+        sb.append("<System>");
+        sb.append("<vssd:VirtualSystemType>ENGINE 4.4.0.0</vssd:VirtualSystemType>");
+        sb.append("</System>");
+
+        // CPU
+        sb.append("<Item>");
+        sb.append("<rasd:Caption>").append(vcpu).append(" virtual cpu</rasd:Caption>");
+        sb.append("<rasd:Description>Number of virtual CPU</rasd:Description>");
+        sb.append("<rasd:InstanceId>1</rasd:InstanceId>");
+        sb.append("<rasd:ResourceType>3</rasd:ResourceType>");
+        sb.append("<rasd:num_of_sockets>").append(sockets).append("</rasd:num_of_sockets>");
+        sb.append("<rasd:cpu_per_socket>").append(cpuPerSocket).append("</rasd:cpu_per_socket>");
+        sb.append("<rasd:threads_per_cpu>").append(threads).append("</rasd:threads_per_cpu>");
+        sb.append("<rasd:max_num_of_vcpus>").append(maxVcpu).append("</rasd:max_num_of_vcpus>");
+        sb.append("<rasd:VirtualQuantity>").append(vcpu).append("</rasd:VirtualQuantity>");
+        sb.append("</Item>");
+
+        // Memory
+        sb.append("<Item>");
+        sb.append("<rasd:Caption>").append(memMb).append(" MB of memory</rasd:Caption>");
+        sb.append("<rasd:Description>Memory Size</rasd:Description>");
+        sb.append("<rasd:InstanceId>2</rasd:InstanceId>");
+        sb.append("<rasd:ResourceType>4</rasd:ResourceType>");
+        sb.append("<rasd:AllocationUnits>").append(MemoryAllocationUnit.Megabytes.getAllocationUnitsToken()).append("</rasd:AllocationUnits>");
+        sb.append("<rasd:VirtualQuantity>").append(memMb).append("</rasd:VirtualQuantity>");
+        sb.append("</Item>");
+
+        // Disks as Items
+        int diskUnit = 0;
+        for (DiskAttachment da : diskAttachments(vm)) {
+            if (da == null || da.getDisk() == null || StringUtils.isBlank(da.getDisk().getId())) {
+                continue;
+            }
+            final Disk d = da.getDisk();
+            final String diskId = d.getId();
+            final String storageDomainId = firstStorageDomainId(d);
+            final String href = storageDomainId + "/" + diskId;
+
+            sb.append("<Item>");
+            sb.append("<rasd:Caption>").append(escapeText(defaultString(d.getAlias()))).append("</rasd:Caption>");
+            sb.append("<rasd:InstanceId>").append(escapeText(diskId)).append("</rasd:InstanceId>");
+            sb.append("<rasd:ResourceType>17</rasd:ResourceType>");
+            sb.append("<rasd:HostResource>").append(escapeText(href)).append("</rasd:HostResource>");
+            sb.append("<rasd:Parent>").append(ZERO_UUID).append("</rasd:Parent>");
+            sb.append("<rasd:Template>").append(escapeText(templateId)).append("</rasd:Template>");
+            sb.append("<rasd:ApplicationList></rasd:ApplicationList>");
+            sb.append("<rasd:StorageId>").append(escapeText(storageDomainId)).append("</rasd:StorageId>");
+            sb.append("<rasd:StoragePoolId>").append(ZERO_UUID).append("</rasd:StoragePoolId>");
+            sb.append("<rasd:CreationDate>").append(creationDate).append("</rasd:CreationDate>");
+            sb.append("<rasd:LastModified>").append(exportDate).append("</rasd:LastModified>");
+            sb.append("<rasd:last_modified_date>").append(exportDate).append("</rasd:last_modified_date>");
+            sb.append("<Type>disk</Type>");
+            sb.append("<Device>disk</Device>");
+            sb.append("<rasd:Address>").append(escapeText("{type=drive, bus=0, controller=0, target=0, unit=" + diskUnit + "}")).append("</rasd:Address>");
+            sb.append("<BootOrder>").append("true".equalsIgnoreCase(da.getBootable()) ? 1 : 0).append("</BootOrder>");
+            sb.append("<IsPlugged>true</IsPlugged>");
+            sb.append("<IsReadOnly>").append("true".equalsIgnoreCase(da.getReadOnly())).append("</IsReadOnly>");
+            sb.append("<Alias>").append(escapeText("ua-" + href)).append("</Alias>");
+            sb.append("</Item>");
+            diskUnit++;
+        }
+
+        // NICs as Items
+        int nicSlot = 0;
+        for (Nic nic : nics) {
+            if (nic == null) {
+                continue;
+            }
+            final String nicId = firstNonBlank(nic.getId(), UUID.nameUUIDFromBytes(("nic-" + vmId + "-" + nicSlot).getBytes(StandardCharsets.UTF_8)).toString());
+            final String nicName = firstNonBlank(nic.getName(), "nic" + (nicSlot + 1));
+            final String mac = nic.getMac() != null ? defaultString(nic.getMac().getAddress()) : "";
+            final String elementName = nic.getVnicProfile() != null ? defaultString(nic.getVnicProfile().getId()) : nicName;
+
+            sb.append("<Item>");
+            sb.append("<rasd:Caption>Ethernet adapter - ").append(nic.getName()).append("</rasd:Caption>");
+            sb.append("<rasd:InstanceId>").append(escapeText(nicId)).append("</rasd:InstanceId>");
+            sb.append("<rasd:ResourceType>10</rasd:ResourceType>");
+            sb.append("<rasd:OtherResourceType></rasd:OtherResourceType>");
+            sb.append("<rasd:ResourceSubType>").append(mapNicResourceSubType(nic.getInterfaceType())).append("</rasd:ResourceSubType>");
+            sb.append("<rasd:Connection>").append(escapeText(defaultString(inferNetworkName(nic)))).append("</rasd:Connection>");
+            sb.append("<rasd:Linked>").append(escapeText(booleanString(nic.getLinked(), "true"))).append("</rasd:Linked>");
+            sb.append("<rasd:Name>").append(escapeText(nicName)).append("</rasd:Name>");
+            sb.append("<rasd:ElementName>").append(escapeText(elementName)).append("</rasd:ElementName>");
+            sb.append("<rasd:MACAddress>").append(escapeText(mac)).append("</rasd:MACAddress>");
+            sb.append("<rasd:speed>10000</rasd:speed>");
+            sb.append("<Type>interface</Type>");
+            sb.append("<Device>bridge</Device>");
+            sb.append("<rasd:Address>").append(escapeText("{type=pci, slot=0x" + String.format("%02x", nicSlot) + ", bus=0x01, domain=0x0000, function=0x0}")).append("</rasd:Address>");
+            sb.append("<BootOrder>0</BootOrder>");
+            sb.append("<IsPlugged>").append(escapeText(booleanString(nic.getPlugged(), "true"))).append("</IsPlugged>");
+            sb.append("<IsReadOnly>false</IsReadOnly>");
+            sb.append("<Alias>").append(escapeText("ua-" + nicId)).append("</Alias>");
+            sb.append("</Item>");
+            nicSlot++;
+        }
+
+        // A few common devices that some consumers expect to exist (kept minimal)
+        // USB controller
+        sb.append("<Item>");
+        sb.append("<rasd:Caption>USB Controller</rasd:Caption>");
+        sb.append("<rasd:InstanceId>3</rasd:InstanceId>");
+        sb.append("<rasd:ResourceType>23</rasd:ResourceType>");
+        sb.append("<rasd:UsbPolicy>DISABLED</rasd:UsbPolicy>");
+        sb.append("</Item>");
+
+        // RNG device
+        sb.append("<Item>");
+        sb.append("<rasd:ResourceType>0</rasd:ResourceType>");
+        sb.append("<rasd:InstanceId>").append(UUID.nameUUIDFromBytes(("rng-" + vmId).getBytes(StandardCharsets.UTF_8))).append("</rasd:InstanceId>");
+        sb.append("<Type>rng</Type>");
+        sb.append("<Device>virtio</Device>");
+        sb.append("<rasd:Address>{type=pci, slot=0x00, bus=0x06, domain=0x0000, function=0x0}</rasd:Address>");
+        sb.append("<BootOrder>0</BootOrder>");
+        sb.append("<IsPlugged>true</IsPlugged>");
+        sb.append("<IsReadOnly>false</IsReadOnly>");
+        sb.append("<Alias></Alias>");
+        sb.append("<SpecParams><source>urandom</source></SpecParams>");
+        sb.append("</Item>");
+
+        sb.append("</Section>");
+        sb.append("</Content>");
+        sb.append("</ovf:Envelope>");
+
+        return sb.toString();
+    }
+
+    private static void addCloudStackMetadata(Vm vm, UserVmJoinVO vo, StringBuilder sb) {
+        if (vo != null) {
+            // -- Add a section for CloudStack-specific metadata that some consumers might look for (e.g. for import back into CloudStack) ---
+            // Add CloudStack-specific metadata section
+            sb.append("<Section xsi:type=\"ovf:CloudStackMetadata_Type\">");
+            sb.append("<Info>CloudStack specific metadata</Info>");
+            sb.append("<CloudStack>");
+            sb.append("<InstanceId>").append(vm.getInstanceId()).append("</InstanceId>");
+            sb.append("<InstanceName>").append(vm.getInstanceName()).append("</InstanceName>");
+            sb.append("<InstanceGroupId>").append(vm.getInstanceGroupId()).append("</InstanceGroupId>");
+            sb.append("<AccountId>").append(vo.getAccountUuid()).append("</AccountId>");
+            sb.append("<DomainId>").append(vo.getDomainUuid()).append("</DomainId>");
+            sb.append("<ProjectId>").append(escapeText(vo.getProjectUuid())).append("</ProjectId>");
+            if (vm.getCpuProfile() != null && StringUtils.isNotBlank(vm.getCpuProfile().getId())) {
+                sb.append("<ServiceOfferingId>").append(vm.getCpuProfile().getId()).append("</ServiceOfferingId>");
+            }
+            sb.append("<DataDiskOfferingIdMap>");
+            for (DiskAttachment da : diskAttachments(vm)) {
+                if (da == null || da.getDisk() == null || StringUtils.isBlank(da.getDisk().getId())) {
+                    continue;
+                }
+                final Disk d = da.getDisk();
+                sb.append("<Entry>");
+                sb.append("<DiskId>").append(escapeText(d.getId())).append("</DiskId>");
+                sb.append("<OfferingId>").append(d.getDiskProfile().getId()).append("</OfferingId>");
+                sb.append("</Entry>");
+            }
+            sb.append("</DataDiskOfferingIdMap>");
+            if (MapUtils.isNotEmpty(vm.getDetails())) {
+                sb.append("<Details>");
+                for (Map.Entry<String, String> entry : vm.getDetails().entrySet()) {
+                    sb.append("<Detail>");
+                    sb.append("<Key>").append(escapeText(entry.getKey())).append("</Key>");
+                    sb.append("<Value>").append(escapeText(entry.getValue())).append("</Value>");
+                    sb.append("</Detail>");
+                }
+                sb.append("</Details>");
+            }
+            if (vo.getUserDataId() != null) {
+                sb.append("<UserDataId>").append(escapeText(vo.getUserDataUuid())).append("</UserDataId>");
+            }
+            if (vo.getAffinityGroupId() != null) {
+                sb.append("<AffinityGroupId>").append(escapeText(vo.getAffinityGroupUuid())).append("</AffinityGroupId>");
+            }
+            if (vm.getNics() != null && CollectionUtils.isNotEmpty(vm.getNics().getItems())) {
+                sb.append("<Nics>");
+                for (Nic nic : nics(vm)) {
+                    if (nic == null || StringUtils.isBlank(nic.getId())) {
+                        continue;
+                    }
+                    String networkId = nicNetworkId(nic);
+                    if (networkId == null) {
+                        continue;
+                    }
+                    sb.append("<Nic>");
+                    sb.append("<Id>").append(escapeText(nic.getId())).append("</Id>");
+                    sb.append("<NetworkId>").append(escapeText(networkId)).append("</NetworkId>");
+                    sb.append("<MACAddress>").append(escapeText(nicMac(nic))).append("</MACAddress>");
+                    sb.append("<Ip4Address>").append(escapeText(nicIp(nic, "v4"))).append("</Ip4Address>");
+                    sb.append("<Ip6Address>").append(escapeText(nicIp(nic, "v6"))).append("</Ip6Address>");
+                    sb.append("</Nic>");
+                }
+                sb.append("</Nics>");
+            }
+            if (StringUtils.isNotBlank(vm.getSshKeyPairNames())) {
+                sb.append("<SshKeyPairs>").append(escapeText(vm.getSshKeyPairNames())).append("</SshKeyPairs>");
+            }
+            if (StringUtils.isNotBlank(vm.getGuestOsId())) {
+                sb.append("<GuestOsId>").append(escapeText(vm.getGuestOsId())).append("</GuestOsId>");
+            }
+            if (StringUtils.isNotBlank(vm.getGuestOsName())) {
+                sb.append("<GuestOsName>").append(escapeText(vm.getGuestOsName())).append("</GuestOsName>");
+            }
+            if (StringUtils.isNotBlank(vm.getInstanceType())) {
+                sb.append("<Type>").append(escapeText(vm.getInstanceType())).append("</Type>");
+            }
+            if (StringUtils.isNoneBlank(vm.getSharedFSId(), vm.getSharedFsVolumeName())) {
+                sb.append("<SharedFSId>").append(escapeText(vm.getSharedFSId())).append("</SharedFSId>");
+                sb.append("<SharedFSVolumeName>").append(escapeText(vm.getSharedFsVolumeName())).append("</SharedFSVolumeName>");
+            }
+            if (CollectionUtils.isNotEmpty(vm.getSecurityGroupIds())) {
+                sb.append("<SecurityGroupIds>").append(escapeText(StringUtils.join(vm.getSecurityGroupIds(), ","))).append("</SecurityGroupIds>");
+            }
+            sb.append("</CloudStack>");
+            sb.append("</Section>");
+        }
+    }
+
+    protected static String getVmConfigurationData(Vm vm) {
+        Vm.Initialization initialization = vm.getInitialization();
+        if (initialization == null) {
+            return null;
+        }
+        Vm.Initialization.Configuration configuration = initialization.getConfiguration();
+        if (configuration == null) {
+            return null;
+        }
+        if (!"ovf".equalsIgnoreCase(configuration.getType())) {
+            return null;
+        }
+        return configuration.getData();
+    }
+
+    public static void updateFromConfiguration(Vm vm) {
+        String configurationData = getVmConfigurationData(vm);
+        OvfXmlUtil.updateFromXml(vm, configurationData);
+    }
+
+    public static String getConfigMetadataXml(Vm vm, Logger logger) {
+        String configurationData = getVmConfigurationData(vm);
+        if (StringUtils.isBlank(configurationData)) {
+            return null;
+        }
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setNamespaceAware(true);
+            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(new ByteArrayInputStream(configurationData.getBytes(StandardCharsets.UTF_8)));
+
+            XPathFactory xpf = XPathFactory.newInstance();
+            XPath xpath = xpf.newXPath();
+
+            // Persist only the CloudStack metadata section from the source OVF.
+            Node metadataSection = (Node) xpath.evaluate(
+                    "//*[local-name()='Section' and @*[local-name()='type']='ovf:CloudStackMetadata_Type']",
+                    doc,
+                    XPathConstants.NODE
+            );
+
+            if (metadataSection == null) {
+                return null;
+            }
+
+            // Wrap section payload so it remains standalone XML with namespace declarations.
+            StringBuilder sb = new StringBuilder(2048);
+            sb.append("<?xml version=\"1.0\" encoding=\"UTF-8\"?>");
+            sb.append("<Sections")
+              .append(" xmlns:rasd=\"").append(NS_RASD).append("\"")
+              .append(" xmlns:ovf=\"").append(NS_OVF).append("\"")
+              .append(" xmlns:xsi=\"").append(NS_XSI).append("\"")
+              .append(">");
+            sb.append(nodeToString(metadataSection));
+            sb.append("</Sections>");
+
+            return sb.toString();
+        } catch (ParserConfigurationException | XPathExpressionException | IOException | SAXException  e) {
+            logger.error("Failed to parse VM configuration data for VM id {}: {}", vm.getId(), e.getMessage());
+            return null;
+        }
+    }
+
+    public static Pair<String, String> getVmNicDetailFromStoredConfig(String xmlConfig, String networkId, Logger logger) {
+        if (StringUtils.isAnyBlank(xmlConfig, networkId)) {
+            return new Pair<>(null, null);
+        }
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setNamespaceAware(true);
+            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(new ByteArrayInputStream(xmlConfig.getBytes(StandardCharsets.UTF_8)));
+
+            XPathFactory xpf = XPathFactory.newInstance();
+            XPath xpath = xpf.newXPath();
+
+            // Preferred format: CloudStack metadata section with CloudStack/Nics/Nic records.
+            NodeList nicNodes = (NodeList) xpath.evaluate(
+                    "//*[local-name()='Section' and @*[local-name()='type']='ovf:CloudStackMetadata_Type']/*[local-name()='CloudStack']/*[local-name()='Nics']/*[local-name()='Nic']",
+                    doc,
+                    XPathConstants.NODESET
+            );
+            if (nicNodes != null && nicNodes.getLength() > 0) {
+                for (int i = 0; i < nicNodes.getLength(); i++) {
+                    Node nicNode = nicNodes.item(i);
+                    String nicNetworkId = xpathString(xpath, nicNode, "./*[local-name()='NetworkId']/text()");
+                    if (StringUtils.equals(nicNetworkId, networkId)) {
+                        return new Pair<>(
+                                xpathString(xpath, nicNode, "./*[local-name()='MACAddress' or local-name()='MACAddress']/text()"),
+                                xpathString(xpath, nicNode, "./*[local-name()='Ip4Address' or local-name()='Ip4Address']/text()")
+                        );
+                    }
+                }
+            }
+        } catch (ParserConfigurationException | XPathExpressionException | IOException | SAXException e) {
+            logger.error("Failed to parse VM configuration XML to retrieve details for NIC for network ID {}: {}",
+                    networkId, e.getMessage());
+        }
+        return new Pair<>(null, null);
+    }
+
+    public static Vm parseVmRestoreConfig(String xmlConfig, Logger logger) {
+        Vm vm = new Vm();
+        if (StringUtils.isBlank(xmlConfig)) {
+            logger.error("No XML configuration provided for VM restore");
+            return vm;
+        }
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setNamespaceAware(true);
+            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(new ByteArrayInputStream(xmlConfig.getBytes(StandardCharsets.UTF_8)));
+
+            XPathFactory xpf = XPathFactory.newInstance();
+            XPath xpath = xpf.newXPath();
+            Node metadataSection = (Node) xpath.evaluate(
+                    "//*[local-name()='Section' and @*[local-name()='type']='ovf:CloudStackMetadata_Type']",
+                    doc,
+                    XPathConstants.NODE
+            );
+            updateFromXmlCloudStackMetadataSection(vm, metadataSection, xpath);
+        } catch (ParserConfigurationException | XPathExpressionException | IOException | SAXException e) {
+            logger.error("Failed to parse VM configuration XML for restore: {}", e.getMessage());
+        }
+        return vm;
+    }
+
+    private static String nodeToString(Node node) {
+        try {
+            // Implementation using string manipulation
+            StringBuilder sb = new StringBuilder();
+            serializeNodeToString(node, sb);
+            return sb.toString();
+        } catch (Exception e) {
+            return "";
+        }
+    }
+
+    private static void serializeNodeToString(Node node, StringBuilder sb) {
+        if (node == null) {
+            return;
+        }
+
+        short nodeType = node.getNodeType();
+        switch (nodeType) {
+            case Node.ELEMENT_NODE:
+                sb.append("<").append(node.getNodeName());
+                NamedNodeMap attrs = node.getAttributes();
+                if (attrs != null) {
+                    for (int i = 0; i < attrs.getLength(); i++) {
+                        Node attr = attrs.item(i);
+                        sb.append(" ").append(attr.getNodeName()).append("=\"")
+                                .append(escapeAttr(attr.getNodeValue())).append("\"");
+                    }
+                }
+                sb.append(">");
+                NodeList children = node.getChildNodes();
+                for (int i = 0; i < children.getLength(); i++) {
+                    serializeNodeToString(children.item(i), sb);
+                }
+                sb.append("</").append(node.getNodeName()).append(">");
+                break;
+            case Node.TEXT_NODE:
+                String text = node.getNodeValue();
+                if (StringUtils.isNotBlank(text)) {
+                    sb.append(escapeText(text));
+                }
+                break;
+            case Node.CDATA_SECTION_NODE:
+                sb.append("<![CDATA[").append(node.getNodeValue()).append("]]>");
+                break;
+            default:
+                break;
+        }
+    }
+
+    protected static void updateFromXml(Vm vm, String ovfXml) {
+        if (vm == null || StringUtils.isBlank(ovfXml)) {
+            return;
+        }
+        try {
+            DocumentBuilderFactory dbf = DocumentBuilderFactory.newInstance();
+            dbf.setNamespaceAware(true);
+            dbf.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+            DocumentBuilder db = dbf.newDocumentBuilder();
+            Document doc = db.parse(new ByteArrayInputStream(ovfXml.getBytes(StandardCharsets.UTF_8)));
+
+            XPathFactory xpf = XPathFactory.newInstance();
+            XPath xpath = xpf.newXPath();
+
+            // Register namespace context for XPath
+            xpath.setNamespaceContext(new OvfNamespaceContext());
+
+
+            Node contentNode = (Node) xpath.evaluate(
+                    "//*[local-name()='Content']",
+                    doc,
+                    XPathConstants.NODE
+            );
+            updateFromXmlContentNode(vm, contentNode, xpath);
+
+            Node hwSection = (Node) xpath.evaluate(
+                "//*[local-name()='Section' and @*[local-name()='type']='ovf:VirtualHardwareSection_Type']",
+                doc,
+                XPathConstants.NODE
+            );
+            updateFromXmlHardwareSection(vm, hwSection, xpath);
+
+            Node metadataSection = (Node) xpath.evaluate(
+                "//*[local-name()='Section' and @*[local-name()='type']='ovf:CloudStackMetadata_Type']",
+                doc,
+                XPathConstants.NODE
+            );
+            updateFromXmlCloudStackMetadataSection(vm, metadataSection, xpath);
+        } catch (Exception e) {
+            // Ignore parsing errors and keep original VM configuration
+        }
+    }
+
+    private static void updateFromXmlContentNode(Vm vm, Node contentNode, XPath xpath) {
+        if (contentNode == null) {
+            return;
+        }
+        String userId = xpathString(xpath, contentNode, "./*[local-name()='CreatedByUserId']/text()");
+        if (StringUtils.isNotBlank(userId)) {
+            vm.setAccountId(userId);
+        }
+        String templateId = xpathString(xpath, contentNode, "./*[local-name()='TemplateId']/text()");
+        if (StringUtils.isNotBlank(templateId)) {
+            vm.setTemplate(Ref.of("", templateId));
+        }
+        String biosType = xpathString(xpath, contentNode, "./*[local-name()='BiosType']/text()");
+        Vm.Bios bios = Vm.Bios.getBiosFromOrdinal(biosType);
+        vm.setBios(bios);
+    }
+
+    private static void updateFromXmlHardwareSection(Vm vm, Node hwSection, XPath xpath) throws XPathExpressionException {
+        if (hwSection == null) {
+            return;
+        }
+        // Memory
+        NodeList memItems = (NodeList) xpath.evaluate(
+            ".//*[local-name()='Item'][*[local-name()='ResourceType' and text()='4']]",
+                hwSection,
+            XPathConstants.NODESET
+        );
+        if (memItems != null && memItems.getLength() > 0) {
+            Node memItem = memItems.item(0);
+            String memStr = childText(memItem, "VirtualQuantity");
+            String memAllocationUnitsStr = childText(memItem, "AllocationUnits");
+            updateVmMemory(vm, memStr, memAllocationUnitsStr);
+        }
+
+        // CPU
+        NodeList cpuItems = (NodeList) xpath.evaluate(
+            ".//*[local-name()='Item'][*[local-name()='ResourceType' and text()='3']]",
+                hwSection,
+            XPathConstants.NODESET
+        );
+        if (cpuItems != null && cpuItems.getLength() > 0) {
+            Node cpuItem = cpuItems.item(0);
+            String socketsStr = childText(cpuItem, "num_of_sockets");
+            String coresStr = childText(cpuItem, "cpu_per_socket");
+            String threadsStr = childText(cpuItem, "threads_per_cpu");
+
+            if (vm.getCpu() == null) {
+                vm.setCpu(new Cpu());
+            }
+            if (vm.getCpu().getTopology() == null) {
+                vm.getCpu().setTopology(new Topology());
+            }
+
+            if (StringUtils.isNotBlank(socketsStr)) {
+                vm.getCpu().getTopology().setSockets(socketsStr);
+            }
+            if (StringUtils.isNotBlank(coresStr)) {
+                vm.getCpu().getTopology().setCores(coresStr);
+            }
+            if (StringUtils.isNotBlank(threadsStr)) {
+                vm.getCpu().getTopology().setThreads(threadsStr);
+            }
+        }
+    }
+
+    private static void updateVmMemory(Vm vm, String memStr, String memAllocationUnitsStr) {
+        if (StringUtils.isAnyBlank(memStr, memAllocationUnitsStr)) {
+            return;
+        }
+        MemoryAllocationUnit memoryAllocationUnit = MemoryAllocationUnit.fromString(memAllocationUnitsStr);
+        if (memoryAllocationUnit == null) {
+            return;
+        }
+        long memory = parseLong(memStr, 0);
+        if (memory == 0) {
+            return;
+        }
+        vm.setMemory(String.valueOf(memory * memoryAllocationUnit.getBytesMultiplier()));
+    }
+
+    private static void updateFromXmlCloudStackMetadataSection(Vm vm, Node metadataSection, XPath xpath) {
+        if (metadataSection == null) {
+            return;
+        }
+        String instanceId = xpathString(xpath, metadataSection, ".//*[local-name()='InstanceId']/text()");
+        if (StringUtils.isNotBlank(instanceId) && vm.isSameLocationRestore()) {
+            vm.setInstanceId(instanceId);
+        }
+        String instanceName = xpathString(xpath, metadataSection, ".//*[local-name()='InstanceName']/text()");
+        if (StringUtils.isNotBlank(instanceName) && vm.isSameLocationRestore()) {
+            vm.setInstanceName(instanceName);
+        }
+        String instanceGroupId = xpathString(xpath, metadataSection, ".//*[local-name()='InstanceGroupId']/text()");
+        if (StringUtils.isNotBlank(instanceGroupId)) {
+            vm.setInstanceGroupId(instanceGroupId);
+        }
+        String serviceOfferingId = xpathString(xpath, metadataSection, ".//*[local-name()='ServiceOfferingId']/text()");
+        if (StringUtils.isNotBlank(serviceOfferingId)) {
+            vm.setCpuProfile(Ref.of("", serviceOfferingId));
+        }
+        String affinityGroupId = xpathString(xpath, metadataSection, ".//*[local-name()='AffinityGroupId']/text()");
+        if (StringUtils.isNotBlank(affinityGroupId)) {
+            vm.setAffinityGroupId(affinityGroupId);
+        }
+        String userDataId = xpathString(xpath, metadataSection, ".//*[local-name()='UserDataId']/text()");
+        if (StringUtils.isNotBlank(userDataId)) {
+            vm.setUserDataId(userDataId);
+        }
+        String sshKeyPairs = xpathString(xpath, metadataSection, ".//*[local-name()='SshKeyPairs']/text()");
+        if (StringUtils.isNotBlank(sshKeyPairs)) {
+            vm.setSshKeyPairNames(sshKeyPairs);
+        }
+        String guestOsId = xpathString(xpath, metadataSection, ".//*[local-name()='GuestOsId']/text()");
+        if (StringUtils.isNotBlank(guestOsId)) {
+            vm.setGuestOsId(guestOsId);
+        }
+        String guestOsName = xpathString(xpath, metadataSection, ".//*[local-name()='GuestOsName']/text()");
+        if (StringUtils.isNotBlank(guestOsName)) {
+            vm.setGuestOsName(guestOsName);
+        }
+        String instanceType = xpathString(xpath, metadataSection, ".//*[local-name()='Type']/text()");
+        if (StringUtils.isNotBlank(instanceType)) {
+            vm.setInstanceType(instanceType);
+        }
+        String sharedFSId = xpathString(xpath, metadataSection, ".//*[local-name()='SharedFSId']/text()");
+        if (StringUtils.isNotBlank(sharedFSId)) {
+            vm.setSharedFSId(sharedFSId);
+        }
+        String sharedFSVolumeName = xpathString(xpath, metadataSection, ".//*[local-name()='SharedFSVolumeName']/text()");
+        if (StringUtils.isNotBlank(sharedFSVolumeName)) {
+            vm.setSharedFsVolumeName(sharedFSVolumeName);
+        }
+        String securityGroupIds = xpathString(xpath, metadataSection, ".//*[local-name()='SecurityGroupIds']/text()");
+        if (StringUtils.isNotBlank(securityGroupIds)) {
+            vm.setSecurityGroupIds(Arrays.asList(StringUtils.split(securityGroupIds, ",")));
+        }
+        final Map<String, String> details = new HashMap<>();
+        try {
+            NodeList detailNodes = (NodeList) xpath.evaluate(
+                    ".//*[local-name()='Details']/*[local-name()='Detail']",
+                    metadataSection,
+                    XPathConstants.NODESET
+            );
+
+            for (int i = 0; i < detailNodes.getLength(); i++) {
+                Node detailNode = detailNodes.item(i);
+                String key = xpathString(xpath, detailNode, "./*[local-name()='Key']/text()");
+                if (StringUtils.isBlank(key)) {
+                    continue;
+                }
+                String value = xpathString(xpath, detailNode, "./*[local-name()='Value']/text()");
+                details.put(key, defaultString(value));
+            }
+        } catch (XPathExpressionException ignored) {
+        }
+        if (!details.isEmpty()) {
+            vm.setDetails(details);
+        }
+    }
+
+    private static String xpathString(XPath xpath, Node node, String expression) {
+        if (node == null) {
+            return null;
+        }
+        try {
+            String value = (String) xpath.evaluate(expression, node, XPathConstants.STRING);
+            return StringUtils.isBlank(value) ? null : value.trim();
+        } catch (XPathExpressionException e) {
+            return null;
+        }
+    }
+
+    private static String childText(Node parent, String localName) {
+        if (parent == null || StringUtils.isBlank(localName)) {
+            return null;
+        }
+        NodeList children = parent.getChildNodes();
+        for (int i = 0; i < children.getLength(); i++) {
+            Node child = children.item(i);
+            if (child.getNodeType() != Node.ELEMENT_NODE) {
+                continue;
+            }
+            String ln = child.getLocalName();
+            if (StringUtils.isBlank(ln)) {
+                ln = child.getNodeName();
+            }
+            if (localName.equalsIgnoreCase(ln)) {
+                return StringUtils.trim(child.getTextContent());
+            }
+        }
+        return null;
+    }
+
+    private static List<DiskAttachment> diskAttachments(Vm vm) {
+        if (vm.getDiskAttachments() == null) {
+            return List.of();
+        }
+        return vm.getDiskAttachments().getItems();
+    }
+
+    private static List<Nic> nics(Vm vm) {
+        if (vm.getNics() == null) {
+            return List.of();
+        }
+        return vm.getNics().getItems();
+    }
+
+    private static String nicNetworkId(Nic nic) {
+        if (nic == null || nic.getVnicProfile() == null || StringUtils.isEmpty(nic.getVnicProfile().getId())) {
+            return null;
+        }
+        return nic.getVnicProfile().getId();
+    }
+
+    private static ReportedDevice getNicReportedDevice(Nic nic) {
+        if (nic == null || nic.getReportedDevices() == null || CollectionUtils.isEmpty(nic.getReportedDevices().getItems())) {
+            return null;
+        }
+        return nic.getReportedDevices().getItems().get(0);
+    }
+
+    private static String nicMac(Nic nic) {
+        if (nic == null || nic.getMac() == null || StringUtils.isBlank(nic.getMac().getAddress())) {
+            return "";
+        }
+        return nic.getMac().getAddress();
+    }
+
+    private static String nicIp(Nic nic, String version) {
+        ReportedDevice device = getNicReportedDevice(nic);
+        if (device == null || device.getIps() == null || CollectionUtils.isEmpty(device.getIps().getItems())) {
+            return "";
+        }
+        for (Ip ip : device.getIps().getItems()) {
+            if (version.equalsIgnoreCase(ip.getVersion())) {
+                return ip.getAddress();
+            }
+        }
+        return "";
+    }
+
+    private static String inferOsDescription(Vm vm) {
+        if (vm.getOs() == null) {
+            return "other";
+        }
+        String t = vm.getOs().getType();
+        if (StringUtils.isBlank(t)) {
+            return "other";
+        }
+        if (t.toLowerCase(Locale.ROOT).contains("win")) {
+            return "windows";
+        }
+        if (t.toLowerCase(Locale.ROOT).contains("linux")) {
+            return "linux";
+        }
+        return t;
+    }
+
+    private static String inferNetworkName(Nic nic) {
+        return "Network-" + nic.getId();
+    }
+
+    private static String firstStorageDomainId(Disk d) {
+        if (ObjectUtils.allNotNull(d, d.getStorageDomains()) && CollectionUtils.isNotEmpty(d.getStorageDomains().getItems())) {
+            return d.getStorageDomains().getItems().get(0).getId();
+        }
+        return UUID.randomUUID().toString();
+    }
+
+    private static String mapDiskInterface(String iface) {
+        if (StringUtils.isBlank(iface)) {
+            return "VirtIO";
+        }
+        String v = iface.toLowerCase(Locale.ROOT);
+        if (v.contains("virtio") && v.contains("scsi")) {
+            return "VirtIO_SCSI";
+        }
+        if (v.contains("virtio")) {
+            return "VirtIO";
+        }
+        if (v.contains("ide")) {
+            return "IDE";
+        }
+        if (v.contains("sata")) {
+            return "SATA";
+        }
+        return iface;
+    }
+
+    private static String mapOvfDiskFormat(String format, String sparse) {
+        if ("true".equalsIgnoreCase(sparse)) {
+            return "http://www.vmware.com/specifications/vmdk.html#sparse";
+        }
+        return "http://www.vmware.com/specifications/vmdk.html#sparse";
+    }
+
+    private static String mapVolumeFormat(String format) {
+        if (StringUtils.isBlank(format)) {
+            return "RAW";
+        }
+        String f = format.toLowerCase(Locale.ROOT);
+        if (f.contains("cow") || f.contains("qcow")) {
+            return "COW";
+        }
+        if (f.contains("raw")) {
+            return "RAW";
+        }
+        return format.toUpperCase(Locale.ROOT);
+    }
+
+    private static String mapVolumeType(String sparse) {
+        return "true".equalsIgnoreCase(sparse) ? "Sparse" : "Preallocated";
+    }
+
+    private static String mapBalloonEnabled(Vm vm) {
+        if (vm.getMemoryPolicy() == null || vm.getMemoryPolicy().getBallooning() == null) {
+            return "true";
+        }
+        return Boolean.toString("true".equalsIgnoreCase(vm.getMemoryPolicy().getBallooning()));
+    }
+
+    private static int mapNicResourceSubType(String iface) {
+        if (StringUtils.isBlank(iface)) {
+            return 3;
+        }
+        String v = iface.toLowerCase(Locale.ROOT);
+        if (v.contains("virtio")) {
+            return 3;
+        }
+        return 3;
+    }
+
+    private static String booleanString(String v, String def) {
+        if (StringUtils.isBlank(v)) {
+            return def;
+        }
+        if ("true".equalsIgnoreCase(v)) {
+            return "true";
+        }
+        if ("false".equalsIgnoreCase(v)) {
+            return "false";
+        }
+        return def;
+    }
+
+    private static String firstNonBlank(String... vals) {
+        for (String v : vals) {
+            if (StringUtils.isNotBlank(v)) {
+                return v;
+            }
+        }
+        return "";
+    }
+
+    private static String defaultString(String s) {
+        return s == null ? "" : s;
+    }
+
+    private static long parseLong(String s, long def) {
+        if (StringUtils.isBlank(s)) {
+            return def;
+        }
+        try {
+            return Long.parseLong(s);
+        } catch (Exception ignored) {
+            return def;
+        }
+    }
+
+    private static long bytesToGibCeil(long bytes) {
+        if (bytes <= 0) {
+            return 0;
+        }
+        final long gib = MemoryAllocationUnit.Gigabytes.getBytesMultiplier();
+        return (bytes + gib - 1) / gib;
+    }
+
+    private static String formatDate(long epochMillis) {
+        return OVIRT_DTF.get().format(new Date(epochMillis));
+    }
+
+    private static String escapeText(String s) {
+        if (s == null) {
+            return "";
+        }
+        return s.replace("&", "&amp;")
+                .replace("<", "&lt;")
+                .replace(">", "&gt;")
+                .replace("\"", "&quot;")
+                .replace("'", "&apos;");
+    }
+
+    private static String escapeAttr(String s) {
+        return escapeText(s);
+    }
+
+    protected static class OvfNamespaceContext implements NamespaceContext {
+        @Override
+        public String getNamespaceURI(String prefix) {
+            if ("ovf".equals(prefix)) return NS_OVF;
+            if ("rasd".equals(prefix)) return NS_RASD;
+            if ("vssd".equals(prefix)) return NS_VSSD;
+            if ("xsi".equals(prefix)) return NS_XSI;
+            return XMLConstants.NULL_NS_URI;
+        }
+        @Override
+        public String getPrefix(String namespaceURI) {
+            return null;
+        }
+        @Override
+        public java.util.Iterator<String> getPrefixes(String namespaceURI) {
+            return null;
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ProductInfo.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ProductInfo.java
new file mode 100644
index 000000000000..7f696a309798
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ProductInfo.java
@@ -0,0 +1,52 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class ProductInfo {
+
+    private String instanceId;
+    public String name;
+    public Version version;
+
+    public String getInstanceId() {
+        return instanceId;
+    }
+
+    public void setInstanceId(String instanceId) {
+        this.instanceId = instanceId;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public Version getVersion() {
+        return version;
+    }
+
+    public void setVersion(Version version) {
+        this.version = version;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ref.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ref.java
new file mode 100644
index 000000000000..4eefbde8ebf6
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Ref.java
@@ -0,0 +1,31 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Ref extends BaseDto {
+
+    public static Ref of(final String href, final String id) {
+        Ref ref = new Ref();
+        ref.setHref(href);
+        ref.setId(id);
+        return ref;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ReportedDevice.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ReportedDevice.java
new file mode 100644
index 000000000000..2e23f019f1a8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ReportedDevice.java
@@ -0,0 +1,84 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class ReportedDevice extends BaseDto {
+    private String comment;
+    private String description;
+    private NamedList<Ip> ips;
+    private Mac mac;
+    private String name;
+    private String type;
+    private Vm vm;
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public NamedList<Ip> getIps() {
+        return ips;
+    }
+
+    public void setIps(NamedList<Ip> ips) {
+        this.ips = ips;
+    }
+
+    public Mac getMac() {
+        return mac;
+    }
+
+    public void setMac(Mac mac) {
+        this.mac = mac;
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ResourceAction.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ResourceAction.java
new file mode 100644
index 000000000000..ed6c39240369
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/ResourceAction.java
@@ -0,0 +1,39 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class ResourceAction extends BaseDto {
+    private Ref job;
+    private String status;
+
+    public Ref getJob() {
+        return job;
+    }
+
+    public void setJob(Ref job) {
+        this.job = job;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Snapshot.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Snapshot.java
new file mode 100644
index 000000000000..616e6317d90d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Snapshot.java
@@ -0,0 +1,105 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class Snapshot extends BaseDto {
+
+    // epoch millis
+    private Long date;
+    private String persistMemorystate;
+    private String snapshotStatus;
+    private String snapshotType;
+    private NamedList<Link> actions;
+    private String description;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+    private Vm vm;
+
+    public Snapshot() {
+    }
+
+    public Long getDate() {
+        return date;
+    }
+
+    public void setDate(final Long date) {
+        this.date = date;
+    }
+
+    public String getPersistMemorystate() {
+        return persistMemorystate;
+    }
+
+    public void setPersistMemorystate(final String persistMemorystate) {
+        this.persistMemorystate = persistMemorystate;
+    }
+
+    public String getSnapshotStatus() {
+        return snapshotStatus;
+    }
+
+    public void setSnapshotStatus(final String snapshotStatus) {
+        this.snapshotStatus = snapshotStatus;
+    }
+
+    public String getSnapshotType() {
+        return snapshotType;
+    }
+
+    public void setSnapshotType(final String snapshotType) {
+        this.snapshotType = snapshotType;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(final NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(final String description) {
+        this.description = description;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(final List<Link> link) {
+        this.link = link;
+    }
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SpecialObjects.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SpecialObjects.java
new file mode 100644
index 000000000000..0ed2297eaad9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SpecialObjects.java
@@ -0,0 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class SpecialObjects {
+
+    private Ref blankTemplate;
+    private Ref rootTag;
+
+    public Ref getBlankTemplate() {
+        return blankTemplate;
+    }
+
+    public void setBlankTemplate(Ref blankTemplate) {
+        this.blankTemplate = blankTemplate;
+    }
+
+    public Ref getRootTag() {
+        return rootTag;
+    }
+
+    public void setRootTag(Ref rootTag) {
+        this.rootTag = rootTag;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Storage.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Storage.java
new file mode 100644
index 000000000000..4631df35ec67
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Storage.java
@@ -0,0 +1,70 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Storage {
+
+    private String type;
+    private String address;
+    private String path;
+    private String mountOptions;
+    private String nfsVersion;
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getAddress() {
+        return address;
+    }
+
+    public void setAddress(String address) {
+        this.address = address;
+    }
+
+    public String getPath() {
+        return path;
+    }
+
+    public void setPath(String path) {
+        this.path = path;
+    }
+
+    public String getMountOptions() {
+        return mountOptions;
+    }
+
+    public void setMountOptions(String mountOptions) {
+        this.mountOptions = mountOptions;
+    }
+
+    public String getNfsVersion() {
+        return nfsVersion;
+    }
+
+    public void setNfsVersion(String nfsVersion) {
+        this.nfsVersion = nfsVersion;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/StorageDomain.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/StorageDomain.java
new file mode 100644
index 000000000000..fff9d5f75ce8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/StorageDomain.java
@@ -0,0 +1,236 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class StorageDomain extends BaseDto {
+
+    private String name;
+    private String description;
+    private String comment;
+    private String available;
+    private String used;
+    private String committed;
+    private String blockSize;
+    private String warningLowSpaceIndicator;
+    private String criticalSpaceActionBlocker;
+    private String status;          // e.g. "unattached" (optional in your first object)
+    private String type;            // data / image / iso / export
+    private String master;          // "true"/"false"
+    private String backup;          // "true"/"false"
+    private String externalStatus;  // "ok"
+    private String storageFormat;   // v5 / v1
+    private String discardAfterDelete;
+    private String wipeAfterDelete;
+    private String supportsDiscard;
+    private String supportsDiscardZeroesData;
+    private Storage storage;
+    private NamedList<DataCenter> dataCenters;
+    private NamedList<Link> actions;
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getComment() {
+        return comment;
+    }
+
+    public void setComment(String comment) {
+        this.comment = comment;
+    }
+
+    public String getAvailable() {
+        return available;
+    }
+
+    public void setAvailable(String available) {
+        this.available = available;
+    }
+
+    public String getUsed() {
+        return used;
+    }
+
+    public void setUsed(String used) {
+        this.used = used;
+    }
+
+    public String getCommitted() {
+        return committed;
+    }
+
+    public void setCommitted(String committed) {
+        this.committed = committed;
+    }
+
+    public String getBlockSize() {
+        return blockSize;
+    }
+
+    public void setBlockSize(String blockSize) {
+        this.blockSize = blockSize;
+    }
+
+    public String getWarningLowSpaceIndicator() {
+        return warningLowSpaceIndicator;
+    }
+
+    public void setWarningLowSpaceIndicator(String warningLowSpaceIndicator) {
+        this.warningLowSpaceIndicator = warningLowSpaceIndicator;
+    }
+
+    public String getCriticalSpaceActionBlocker() {
+        return criticalSpaceActionBlocker;
+    }
+
+    public void setCriticalSpaceActionBlocker(String criticalSpaceActionBlocker) {
+        this.criticalSpaceActionBlocker = criticalSpaceActionBlocker;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getMaster() {
+        return master;
+    }
+
+    public void setMaster(String master) {
+        this.master = master;
+    }
+
+    public String getBackup() {
+        return backup;
+    }
+
+    public void setBackup(String backup) {
+        this.backup = backup;
+    }
+
+    public String getExternalStatus() {
+        return externalStatus;
+    }
+
+    public void setExternalStatus(String externalStatus) {
+        this.externalStatus = externalStatus;
+    }
+
+    public String getStorageFormat() {
+        return storageFormat;
+    }
+
+    public void setStorageFormat(String storageFormat) {
+        this.storageFormat = storageFormat;
+    }
+
+    public String getDiscardAfterDelete() {
+        return discardAfterDelete;
+    }
+
+    public void setDiscardAfterDelete(String discardAfterDelete) {
+        this.discardAfterDelete = discardAfterDelete;
+    }
+
+    public String getWipeAfterDelete() {
+        return wipeAfterDelete;
+    }
+
+    public void setWipeAfterDelete(String wipeAfterDelete) {
+        this.wipeAfterDelete = wipeAfterDelete;
+    }
+
+    public String getSupportsDiscard() {
+        return supportsDiscard;
+    }
+
+    public void setSupportsDiscard(String supportsDiscard) {
+        this.supportsDiscard = supportsDiscard;
+    }
+
+    public String getSupportsDiscardZeroesData() {
+        return supportsDiscardZeroesData;
+    }
+
+    public void setSupportsDiscardZeroesData(String supportsDiscardZeroesData) {
+        this.supportsDiscardZeroesData = supportsDiscardZeroesData;
+    }
+
+    public Storage getStorage() {
+        return storage;
+    }
+
+    public void setStorage(Storage storage) {
+        this.storage = storage;
+    }
+
+    public NamedList<DataCenter> getDataCenters() {
+        return dataCenters;
+    }
+
+    public void setDataCenters(NamedList<DataCenter> dataCenters) {
+        this.dataCenters = dataCenters;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SummaryCount.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SummaryCount.java
new file mode 100644
index 000000000000..ac26619ff026
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SummaryCount.java
@@ -0,0 +1,43 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class SummaryCount {
+
+    private String active;
+    private String total;
+
+    public SummaryCount() {
+    }
+
+    public SummaryCount(Integer active, Integer total) {
+        this.active = String.valueOf(active);
+        this.total = String.valueOf(total);
+    }
+
+    public String getActive() {
+        return active;
+    }
+
+    public String getTotal() {
+        return total;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SupportedVersions.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SupportedVersions.java
new file mode 100644
index 000000000000..26cfff65620e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/SupportedVersions.java
@@ -0,0 +1,38 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class SupportedVersions {
+
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Version> version;
+
+    public SupportedVersions(final List<Version> version) {
+        this.version = version;
+    }
+
+    public List<Version> getVersion() {
+        return version;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Tag.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Tag.java
new file mode 100644
index 000000000000..1a9493160b6e
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Tag.java
@@ -0,0 +1,57 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class Tag extends BaseDto {
+    private String name;
+    private String description;
+    private Ref parent;
+    private Ref vm;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public Ref getParent() {
+        return parent;
+    }
+
+    public void setParent(Ref parent) {
+        this.parent = parent;
+    }
+
+    public Ref getVm() {
+        return vm;
+    }
+
+    public void setVm(Ref vm) {
+        this.vm = vm;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Topology.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Topology.java
new file mode 100644
index 000000000000..fa20db9d658c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Topology.java
@@ -0,0 +1,60 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Topology {
+    public String sockets;
+    public String cores;
+    public String threads;
+
+    public Topology() {
+    }
+
+    public Topology(final Integer sockets, final Integer cores, final Integer threads) {
+        this.sockets = String.valueOf(sockets);
+        this.cores = String.valueOf(cores);
+        this.threads = String.valueOf(threads);
+    }
+
+    public String getSockets() {
+        return sockets;
+    }
+
+    public void setSockets(String sockets) {
+        this.sockets = sockets;
+    }
+
+    public String getCores() {
+        return cores;
+    }
+
+    public void setCores(String cores) {
+        this.cores = cores;
+    }
+
+    public String getThreads() {
+        return threads;
+    }
+
+    public void setThreads(String threads) {
+        this.threads = threads;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Version.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Version.java
new file mode 100644
index 000000000000..7b7d80a0f16c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Version.java
@@ -0,0 +1,94 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import org.apache.cloudstack.utils.CloudStackVersion;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.commons.lang3.StringUtils;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public final class Version {
+
+    private String build;
+    private String fullVersion;
+    private String major;
+    private String minor;
+    private String revision;
+
+    public Version() {
+    }
+
+    public String getBuild() {
+        return build;
+    }
+
+    public void setBuild(String build) {
+        this.build = build;
+    }
+
+    public String getFullVersion() {
+        return fullVersion;
+    }
+
+    public void setFullVersion(String fullVersion) {
+        this.fullVersion = fullVersion;
+    }
+
+    public String getMajor() {
+        return major;
+    }
+
+    public void setMajor(String major) {
+        this.major = major;
+    }
+
+    public String getMinor() {
+        return minor;
+    }
+
+    public void setMinor(String minor) {
+        this.minor = minor;
+    }
+
+    public String getRevision() {
+        return revision;
+    }
+
+    public void setRevision(String revision) {
+        this.revision = revision;
+    }
+
+    public static Version fromPackageAndCSVersion(boolean complete) {
+        Version version = new Version();
+        String packageVersion = VeeamControlService.getPackageVersion();
+        if (StringUtils.isNotBlank(packageVersion) && complete) {
+            version.setFullVersion(packageVersion);
+        }
+        CloudStackVersion csVersion = VeeamControlService.getCSVersion();
+        if (csVersion == null) {
+            return version;
+        }
+        version.setMajor(String.valueOf(csVersion.getMajorRelease()));
+        version.setMinor(String.valueOf(csVersion.getMinorRelease()));
+        version.setBuild(String.valueOf(csVersion.getPatchRelease()));
+        version.setRevision(String.valueOf(csVersion.getSecurityRelease()));
+        return version;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Vm.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Vm.java
new file mode 100644
index 000000000000..bde648d911f4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/Vm.java
@@ -0,0 +1,643 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.api.ApiConstants;
+
+import com.cloud.utils.EnumUtils;
+import com.cloud.utils.Pair;
+import com.cloud.utils.StringUtils;
+import com.fasterxml.jackson.annotation.JsonIgnore;
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlElementWrapper;
+import com.fasterxml.jackson.dataformat.xml.annotation.JacksonXmlRootElement;
+
+/**
+ * VM DTO intentionally uses snake_case field names to match the required JSON.
+ * Configure Jackson globally with SNAKE_CASE or keep as-is.
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+@JacksonXmlRootElement(localName = "vm")
+public final class Vm extends BaseDto {
+    private String name;
+    private String description;
+    private String status;        // "up", "down", ...
+    private String stopReason;   // empty string allowed
+    private Long creationTime;
+    private Long stopTime;       // epoch millis
+    private Long startTime;       // epoch millis
+    private Ref template;
+    private Ref originalTemplate;
+    private Ref cluster;
+    private Ref host;
+    private String memory;          // bytes
+    private MemoryPolicy memoryPolicy;
+    private Cpu cpu;
+    private Os os;
+    private Bios bios;
+    private String stateless;  // true|false
+    private String type;    // "server"
+    private String origin;  // "ovirt"
+    private NamedList<Link> actions;      // actions.link[]
+    @JacksonXmlElementWrapper(useWrapping = false)
+    private List<Link> link;
+    private NamedList<Tag> tags;
+    private NamedList<DiskAttachment> diskAttachments;
+    private NamedList<Nic> nics;
+    private Initialization initialization;
+
+    private Ref cpuProfile;
+
+    public EmptyElement io = new EmptyElement();
+    public EmptyElement migration = new EmptyElement();
+    public EmptyElement sso = new EmptyElement();
+    public EmptyElement usb = new EmptyElement();
+    public EmptyElement quota = new EmptyElement();
+    public EmptyElement highAvailability = new EmptyElement();
+    public EmptyElement largeIcon = new EmptyElement();
+    public EmptyElement smallIcon = new EmptyElement();
+    public EmptyElement placementPolicy = new EmptyElement();
+    public EmptyElement timeZone = new EmptyElement();
+    public EmptyElement display = new EmptyElement();
+
+    // CloudStack-specific fields
+    private String instanceId;
+    private String instanceName;
+    private String instanceGroupId;
+    private String accountId;
+    private String affinityGroupId;
+    private String userDataId;
+    private Map<String, String> details;
+    private String sshKeyPairNames;
+    private String guestOsId;
+    private String guestOsName;
+    private String instanceType;
+    private String sharedFSId;
+    private String sharedFsVolumeName;
+    private List<String> securityGroupIds;
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(String description) {
+        this.description = description;
+    }
+
+    public String getStatus() {
+        return status;
+    }
+
+    public void setStatus(String status) {
+        this.status = status;
+    }
+
+    public String getStopReason() {
+        return stopReason;
+    }
+
+    public void setStopReason(String stopReason) {
+        this.stopReason = stopReason;
+    }
+
+    public Long getCreationTime() {
+        return creationTime;
+    }
+
+    public void setCreationTime(Long creationTime) {
+        this.creationTime = creationTime;
+    }
+
+    public Long getStopTime() {
+        return stopTime;
+    }
+
+    public void setStopTime(Long stopTime) {
+        this.stopTime = stopTime;
+    }
+
+    public Long getStartTime() {
+        return startTime;
+    }
+
+    public void setStartTime(Long startTime) {
+        this.startTime = startTime;
+    }
+
+    public Ref getTemplate() {
+        return template;
+    }
+
+    public void setTemplate(Ref template) {
+        this.template = template;
+    }
+
+    public Ref getOriginalTemplate() {
+        return originalTemplate;
+    }
+
+    public void setOriginalTemplate(Ref originalTemplate) {
+        this.originalTemplate = originalTemplate;
+    }
+
+    public Ref getCluster() {
+        return cluster;
+    }
+
+    public void setCluster(Ref cluster) {
+        this.cluster = cluster;
+    }
+
+    public Ref getHost() {
+        return host;
+    }
+
+    public void setHost(Ref host) {
+        this.host = host;
+    }
+
+    public String getMemory() {
+        return memory;
+    }
+
+    public void setMemory(String memory) {
+        this.memory = memory;
+    }
+
+    public MemoryPolicy getMemoryPolicy() {
+        return memoryPolicy;
+    }
+
+    public void setMemoryPolicy(MemoryPolicy memoryPolicy) {
+        this.memoryPolicy = memoryPolicy;
+    }
+
+    public Cpu getCpu() {
+        return cpu;
+    }
+
+    public void setCpu(Cpu cpu) {
+        this.cpu = cpu;
+    }
+
+    public Os getOs() {
+        return os;
+    }
+
+    public void setOs(Os os) {
+        this.os = os;
+    }
+
+    public Bios getBios() {
+        return bios;
+    }
+
+    public void setBios(Bios bios) {
+        this.bios = bios;
+    }
+
+    public String getStateless() {
+        return stateless;
+    }
+
+    public void setStateless(String stateless) {
+        this.stateless = stateless;
+    }
+
+    public String getType() {
+        return type;
+    }
+
+    public void setType(String type) {
+        this.type = type;
+    }
+
+    public String getOrigin() {
+        return origin;
+    }
+
+    public void setOrigin(String origin) {
+        this.origin = origin;
+    }
+
+    public NamedList<Link> getActions() {
+        return actions;
+    }
+
+    public void setActions(NamedList<Link> actions) {
+        this.actions = actions;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(List<Link> link) {
+        this.link = link;
+    }
+
+    public NamedList<Tag> getTags() {
+        return tags;
+    }
+
+    public void setTags(NamedList<Tag> tags) {
+        this.tags = tags;
+    }
+
+    public NamedList<DiskAttachment> getDiskAttachments() {
+        return diskAttachments;
+    }
+
+    public void setDiskAttachments(NamedList<DiskAttachment> diskAttachments) {
+        this.diskAttachments = diskAttachments;
+    }
+
+    public NamedList<Nic> getNics() {
+        return nics;
+    }
+
+    public void setNics(NamedList<Nic> nics) {
+        this.nics = nics;
+    }
+
+    public Initialization getInitialization() {
+        return initialization;
+    }
+
+    public void setInitialization(Initialization initialization) {
+        this.initialization = initialization;
+    }
+
+    public Ref getCpuProfile() {
+        return cpuProfile;
+    }
+
+    public void setCpuProfile(Ref cpuProfile) {
+        this.cpuProfile = cpuProfile;
+    }
+
+    @JsonIgnore
+    public String getInstanceId() {
+        return instanceId;
+    }
+
+    public void setInstanceId(String instanceId) {
+        this.instanceId = instanceId;
+    }
+
+    @JsonIgnore
+    public String getInstanceName() {
+        return instanceName;
+    }
+
+    public void setInstanceName(String instanceName) {
+        this.instanceName = instanceName;
+    }
+
+    @JsonIgnore
+    public String getInstanceGroupId() {
+        return instanceGroupId;
+    }
+
+    public void setInstanceGroupId(String instanceGroupId) {
+        this.instanceGroupId = instanceGroupId;
+    }
+
+    @JsonIgnore
+    public String getAccountId() {
+        return accountId;
+    }
+
+    public void setAccountId(String accountId) {
+        this.accountId = accountId;
+    }
+
+    @JsonIgnore
+    public String getAffinityGroupId() {
+        return affinityGroupId;
+    }
+
+    public void setAffinityGroupId(String affinityGroupId) {
+        this.affinityGroupId = affinityGroupId;
+    }
+
+    @JsonIgnore
+    public String getUserDataId() {
+        return userDataId;
+    }
+
+    public void setUserDataId(String userDataId) {
+        this.userDataId = userDataId;
+    }
+
+    @JsonIgnore
+    public Map<String, String> getDetails() {
+        return details;
+    }
+
+    public void setDetails(Map<String, String> details) {
+        this.details = details;
+    }
+
+    @JsonIgnore
+    public String getSshKeyPairNames() {
+        return sshKeyPairNames;
+    }
+
+    public void setSshKeyPairNames(String sshKeyPairNames) {
+        this.sshKeyPairNames = sshKeyPairNames;
+    }
+
+    @JsonIgnore
+    public String getGuestOsId() {
+        return guestOsId;
+    }
+
+    public void setGuestOsId(String guestOsId) {
+        this.guestOsId = guestOsId;
+    }
+
+    @JsonIgnore
+    public String getGuestOsName() {
+        return guestOsName;
+    }
+
+    public void setGuestOsName(String guestOsName) {
+        this.guestOsName = guestOsName;
+    }
+
+    @JsonIgnore
+    public String getInstanceType() {
+        return instanceType;
+    }
+
+    public void setInstanceType(String instanceType) {
+        this.instanceType = instanceType;
+    }
+
+    @JsonIgnore
+    public String getSharedFSId() {
+        return sharedFSId;
+    }
+
+    public void setSharedFSId(String sharedFSId) {
+        this.sharedFSId = sharedFSId;
+    }
+
+    @JsonIgnore
+    public String getSharedFsVolumeName() {
+        return sharedFsVolumeName;
+    }
+
+    public void setSharedFsVolumeName(String sharedFsVolumeName) {
+        this.sharedFsVolumeName = sharedFsVolumeName;
+    }
+
+    @JsonIgnore
+    public List<String> getSecurityGroupIds() {
+        return securityGroupIds;
+    }
+
+    public void setSecurityGroupIds(List<String> securityGroupIds) {
+        this.securityGroupIds = securityGroupIds;
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class Bios {
+
+        public enum Type {
+            cluster_default,
+            i440fx_sea_bios,
+            q35_ovmf,
+            q35_sea_bios,
+            q35_secure_boot
+        }
+
+        private String type; // "uefi" or "bios" or whatever mapping you choose
+        private BootMenu bootMenu = new BootMenu();
+
+        public String getType() {
+            return type;
+        }
+
+        @JsonIgnore
+        public int getTypeOrdinal() {
+            Type enumType = EnumUtils.getEnum(Type.class, type, Type.q35_sea_bios);
+            return enumType.ordinal();
+        }
+
+        public void setType(String type) {
+            this.type = type;
+        }
+
+        public BootMenu getBootMenu() {
+            return bootMenu;
+        }
+
+        public void setBootMenu(BootMenu bootMenu) {
+            this.bootMenu = bootMenu;
+        }
+
+        @JsonInclude(JsonInclude.Include.NON_NULL)
+        public static class BootMenu {
+
+            private String enabled;
+
+            public String getEnabled() {
+                return enabled;
+            }
+
+            public void setEnabled(String enabled) {
+                this.enabled = enabled;
+            }
+        }
+
+        public static Bios getDefault() {
+            Bios bios = new Bios();
+            bios.setType(Type.q35_sea_bios.name());
+            BootMenu bootMenu = new BootMenu();
+            bootMenu.setEnabled("false");
+            bios.setBootMenu(bootMenu);
+            return bios;
+        }
+
+        public static void updateBios(Bios bios, String bootMode) {
+            if (StringUtils.isEmpty(bootMode)) {
+                return;
+            }
+            if (ApiConstants.BootMode.SECURE.toString().equals(bootMode)) {
+                bios.setType(Type.q35_secure_boot.name());
+                return;
+            }
+            bios.setType(Type.q35_ovmf.name());
+        }
+
+        public static Bios getBiosFromOrdinal(String bootTypeStr) {
+            Bios bios = getDefault();
+            if (StringUtils.isEmpty(bootTypeStr)) {
+                return bios;
+            }
+            int  type = 1;
+            try {
+                type = Integer.parseInt(bootTypeStr);
+            } catch (NumberFormatException e) {
+                return bios;
+            }
+
+            if (type == Type.q35_ovmf.ordinal()) {
+                bios.setType(Type.q35_ovmf.name());
+            } else if (type == Type.q35_secure_boot.ordinal()) {
+                bios.setType(Type.q35_secure_boot.name());
+            }
+            return bios;
+        }
+
+        public static Pair<ApiConstants.BootType, ApiConstants.BootMode> retrieveBootOptions(Bios bios) {
+            Pair<ApiConstants.BootType, ApiConstants.BootMode> defaultValue =
+                    new Pair<>(ApiConstants.BootType.BIOS, ApiConstants.BootMode.LEGACY);
+            if (bios == null || StringUtils.isEmpty(bios.getType())) {
+                return defaultValue;
+            }
+            if (Type.q35_secure_boot.name().equals(bios.getType())) {
+                return new Pair<>(ApiConstants.BootType.UEFI, ApiConstants.BootMode.SECURE);
+            }
+            if (Type.q35_ovmf.name().equals(bios.getType())) {
+                return new Pair<>(ApiConstants.BootType.UEFI, ApiConstants.BootMode.LEGACY);
+            }
+            return defaultValue;
+        }
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static final class MemoryPolicy {
+
+        private String guaranteed;
+        private String max;
+        private String ballooning;
+
+        public String getGuaranteed() {
+            return guaranteed;
+        }
+
+        public void setGuaranteed(String guaranteed) {
+            this.guaranteed = guaranteed;
+        }
+
+        public String getMax() {
+            return max;
+        }
+
+        public void setMax(String max) {
+            this.max = max;
+        }
+
+        public String getBallooning() {
+            return ballooning;
+        }
+
+        public void setBallooning(String ballooning) {
+            this.ballooning = ballooning;
+        }
+    }
+
+    @JsonInclude(JsonInclude.Include.NON_NULL)
+    public static class Initialization {
+
+        private String customScript;
+        private Configuration configuration;
+        private Boolean regenerateIds;
+
+        public String getCustomScript() {
+            return customScript;
+        }
+
+        public void setCustomScript(String customScript) {
+            this.customScript = customScript;
+        }
+
+        public Configuration getConfiguration() {
+            return configuration;
+        }
+
+        public void setConfiguration(Configuration configuration) {
+            this.configuration = configuration;
+        }
+
+        public Boolean isRegenerateIds() {
+            return regenerateIds;
+        }
+
+        public void setRegenerateIds(boolean regenerateIds) {
+            this.regenerateIds = regenerateIds;
+        }
+
+        @JsonInclude(JsonInclude.Include.NON_NULL)
+        public static class Configuration {
+
+            private String data;
+            private String type;
+
+            public String getData() {
+                return data;
+            }
+
+            public void setData(String data) {
+                this.data = data;
+            }
+
+            public String getType() {
+                return type;
+            }
+
+            public void setType(String type) {
+                this.type = type;
+            }
+        }
+    }
+
+    /**
+     * Assumes that any request carrying a non-empty custom script represents a worker VM.
+     */
+    @JsonIgnore
+    public boolean isWorkerVm() {
+        return initialization != null && StringUtils.isNotEmpty(initialization.getCustomScript());
+    }
+
+    /**
+     * Whether restoring same VM. We need to preserve IDs in that case
+     */
+    @JsonIgnore
+    public boolean isSameLocationRestore() {
+        return initialization != null && !Boolean.TRUE.equals(initialization.isRegenerateIds());
+    }
+
+    public static Vm of(String href, String id) {
+        return withHrefAndId(new Vm(), href, id);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VmAction.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VmAction.java
new file mode 100644
index 000000000000..2fb5d11d0789
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VmAction.java
@@ -0,0 +1,30 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+public class VmAction extends ResourceAction {
+    private Vm vm;
+
+    public Vm getVm() {
+        return vm;
+    }
+
+    public void setVm(Vm vm) {
+        this.vm = vm;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VnicProfile.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VnicProfile.java
new file mode 100644
index 000000000000..efc42ed1c88a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/dto/VnicProfile.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import java.util.List;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+
+/**
+ * oVirt-like vNIC profile element.
+ * Every vNIC profile MUST reference exactly one network.
+ */
+@JsonInclude(JsonInclude.Include.NON_NULL)
+public class VnicProfile extends BaseDto {
+
+    private String name;
+    private String description;
+
+    private Ref network;
+    private Ref dataCenter;
+
+    private List<Link> link;
+
+    public VnicProfile() {
+    }
+
+    public String getName() {
+        return name;
+    }
+
+    public void setName(final String name) {
+        this.name = name;
+    }
+
+    public String getDescription() {
+        return description;
+    }
+
+    public void setDescription(final String description) {
+        this.description = description;
+    }
+
+    public Ref getNetwork() {
+        return network;
+    }
+
+    public void setNetwork(final Ref network) {
+        this.network = network;
+    }
+
+    public Ref getDataCenter() {
+        return dataCenter;
+    }
+
+    public void setDataCenter(final Ref dataCenter) {
+        this.dataCenter = dataCenter;
+    }
+
+    public List<Link> getLink() {
+        return link;
+    }
+
+    public void setLink(final List<Link> link) {
+        this.link = link;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/request/ListQuery.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/request/ListQuery.java
new file mode 100644
index 000000000000..f57edf76e04c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/api/request/ListQuery.java
@@ -0,0 +1,158 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.request;
+
+import java.util.Arrays;
+import java.util.LinkedHashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.stream.Collectors;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.jetbrains.annotations.NotNull;
+
+public class ListQuery {
+    boolean allContent;
+    Long max;
+    Long page;
+    Map<String, String> search;
+    List<String> follow;
+
+    public boolean isAllContent() {
+        return allContent;
+    }
+
+    public void setAllContent(boolean allContent) {
+        this.allContent = allContent;
+    }
+
+    public Long getMax() {
+        return max;
+    }
+
+    public void setMax(Long max) {
+        this.max = max;
+    }
+
+    public void setSearch(Map<String, String> search) {
+        this.search = search;
+    }
+
+    public void setFollow(String followStr) {
+        if (StringUtils.isBlank(followStr)) {
+            this.follow = null;
+            return;
+        }
+        this.follow = Arrays.stream(followStr.split(","))
+                .map(String::trim)
+                .filter(s -> !s.isEmpty())
+                .collect(Collectors.toList());
+    }
+
+    public Long getOffset() {
+        if (page == null || max == null) {
+            return null;
+        }
+        return Math.max(0,   (page - 1)) * max;
+    }
+
+    public Long getLimit() {
+        return max;
+    }
+
+    public boolean followContains(String part) {
+        if (CollectionUtils.isEmpty(follow)) {
+            return false;
+        }
+        return follow.contains(part);
+    }
+
+    public static ListQuery fromRequest(HttpServletRequest request) {
+        ListQuery query = new ListQuery();
+        if (MapUtils.isEmpty(request.getParameterMap())) {
+            return query;
+        }
+
+        String allContent = request.getParameter("all_content");
+        if (StringUtils.isNotBlank(allContent)) {
+            query.setAllContent(Boolean.parseBoolean(allContent));
+        }
+        String max = request.getParameter("max");
+        if (StringUtils.isNotBlank(max)) {
+            try {
+                query.setMax(Long.parseLong(max));
+            } catch (NumberFormatException e) {
+                // Ignore invalid max and keep default null value.
+            }
+        }
+        String follow = request.getParameter("follow");
+        query.setFollow(follow);
+        Map<String, String> searchItems = getSearchMap(request.getParameter("search"));
+        if (!searchItems.isEmpty()) {
+            try {
+                query.setMax(Long.parseLong(searchItems.get("page")));
+            } catch (NumberFormatException e) {
+                // Ignore invalid page and keep default null value.
+            }
+            query.setSearch(searchItems);
+        }
+
+        return query;
+    }
+
+    // Parse search clause. Only keep items which use simple '=' operator, and ignore others. For example:
+    //   name=myvm and status=up  --> {name=myvm, status=up}
+    //   name=myvm and status!=down --> {name=myvm} (ignore status!=down because it uses '!=' operator)
+    @NotNull
+    private static Map<String, String> getSearchMap(String searchClause) {
+        Map<String, String> searchItems = new LinkedHashMap<>();
+        if (StringUtils.isBlank(searchClause)) {
+            return searchItems;
+        }
+        String[] terms = searchClause.trim().split("(?i)\\s+and\\s+");
+        for (String term : terms) {
+            if (term == null) {
+                continue;
+            }
+            String trimmedTerm = term.trim();
+            if (trimmedTerm.isEmpty()) {
+                continue;
+            }
+
+            int eqIdx = trimmedTerm.indexOf('=');
+            if (eqIdx <= 0 || eqIdx != trimmedTerm.lastIndexOf('=')) {
+                continue;
+            }
+            char prev = trimmedTerm.charAt(eqIdx - 1);
+            if (prev == '!' || prev == '<' || prev == '>') {
+                continue;
+            }
+
+            String key = trimmedTerm.substring(0, eqIdx).trim();
+            String value = trimmedTerm.substring(eqIdx + 1).trim();
+            if (!key.isEmpty() && !value.isEmpty()) {
+                searchItems.put(key, value);
+            }
+        }
+        return searchItems;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilter.java
new file mode 100644
index 000000000000..424a105525b2
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilter.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.filter;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.util.List;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+import com.cloud.utils.net.NetUtils;
+
+public class AllowedClientCidrsFilter implements Filter {
+
+    private static final Logger LOGGER = LogManager.getLogger(AllowedClientCidrsFilter.class);
+
+    private final VeeamControlService veeamControlService;
+
+    public AllowedClientCidrsFilter(VeeamControlService veeamControlService) {
+        this.veeamControlService = veeamControlService;
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) {
+        // no-op
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        if (!(request instanceof HttpServletRequest) || !(response instanceof HttpServletResponse)) {
+            chain.doFilter(request, response);
+            return;
+        }
+
+        final HttpServletRequest req = (HttpServletRequest) request;
+        final HttpServletResponse resp = (HttpServletResponse) response;
+
+        if (veeamControlService == null) {
+            LOGGER.error("Failed to inject VeeamControlService, rejecting request because allowed client CIDRs cannot be evaluated");
+            resp.sendError(HttpServletResponse.SC_SERVICE_UNAVAILABLE, "Service Unavailable");
+            return;
+        }
+
+        final List<String> cidrList = veeamControlService.getAllowedClientCidrs();
+        if (CollectionUtils.isEmpty(cidrList)) {
+            chain.doFilter(request, response);
+            return;
+        }
+
+        final String remoteAddr = req.getRemoteAddr();
+        try {
+            final InetAddress clientIp = InetAddress.getByName(remoteAddr);
+            final boolean allowed = NetUtils.isIpInCidrList(clientIp, cidrList.toArray(new String[0]));
+            if (!allowed) {
+                LOGGER.warn("Rejected request from client IP {} not in allowed CIDRs {}", remoteAddr, cidrList);
+                resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Forbidden");
+                return;
+            }
+        } catch (Exception e) {
+            LOGGER.warn("Rejected request failed to parse client IP {}: {}", remoteAddr, e.getMessage());
+            resp.sendError(HttpServletResponse.SC_FORBIDDEN, "Forbidden");
+            return;
+        }
+
+        chain.doFilter(request, response);
+    }
+
+    @Override
+    public void destroy() {
+        // no-op
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilter.java
new file mode 100644
index 000000000000..ed8552fb0c88
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilter.java
@@ -0,0 +1,220 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.filter;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.Base64;
+import java.util.Map;
+
+import javax.servlet.Filter;
+import javax.servlet.FilterChain;
+import javax.servlet.FilterConfig;
+import javax.servlet.ServletException;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.sso.SsoService;
+import org.apache.cloudstack.veeam.utils.DataUtil;
+import org.apache.cloudstack.veeam.utils.JwtUtil;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.type.TypeReference;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+public class BearerOrBasicAuthFilter implements Filter {
+    private static final ObjectMapper JSON_MAPPER = new ObjectMapper();
+
+    private final VeeamControlService veeamControlService;
+
+    public BearerOrBasicAuthFilter(VeeamControlService veeamControlService) {
+        this.veeamControlService = veeamControlService;
+    }
+
+    @Override
+    public void init(FilterConfig filterConfig) {
+    }
+
+    @Override
+    public void destroy() {
+    }
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+
+        final HttpServletRequest req = (HttpServletRequest) request;
+        final HttpServletResponse resp = (HttpServletResponse) response;
+
+        final String auth = req.getHeader("Authorization");
+        if (auth != null && auth.regionMatches(true, 0, "Bearer ", 0, 7)) {
+            final String token = auth.substring(7).trim();
+            if (token.isEmpty()) {
+                unauthorized(req, resp, "invalid_token", "Missing Bearer token");
+                return;
+            }
+            if (!verifyJwtHs256(token)) {
+                unauthorized(req, resp, "invalid_token", "Invalid or expired token");
+                return;
+            }
+            chain.doFilter(request, response);
+            return;
+        }
+
+        // Optional fallback: Basic (handy for manual testing).
+        if (auth != null && auth.regionMatches(true, 0, "Basic ", 0, 6)) {
+            if (!verifyBasic(auth.substring(6))) {
+                unauthorized(req, resp, "invalid_client", "Invalid Basic credentials");
+                return;
+            }
+            chain.doFilter(request, response);
+            return;
+        }
+
+        unauthorized(req, resp, "invalid_token", "Missing Authorization");
+    }
+
+    private boolean verifyBasic(String b64) {
+        final String decoded;
+        try {
+            decoded = new String(Base64.getDecoder().decode(b64), StandardCharsets.UTF_8);
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+
+        final int idx = decoded.indexOf(':');
+        if (idx <= 0) return false;
+
+        final String user = decoded.substring(0, idx);
+        final String pass = decoded.substring(idx + 1);
+
+        return veeamControlService != null && veeamControlService.validateCredentials(user, pass);
+    }
+
+    /**
+     * Minimal JWT verification:
+     * - HS256 signature
+     * - "iss" matches
+     * - "exp" not expired
+     * - "scope" contains REQUIRED_SCOPES (space-separated)
+     */
+    private boolean verifyJwtHs256(String token) {
+        final String[] parts = token.split("\\.");
+        if (parts.length != 3) return false;
+
+        final String headerB64 = parts[0];
+        final String payloadB64 = parts[1];
+        final String sigB64 = parts[2];
+
+        final byte[] expectedSig;
+        try {
+            expectedSig = JwtUtil.hmacSha256((headerB64 + "." + payloadB64).getBytes(StandardCharsets.UTF_8),
+                    veeamControlService.getHmacSecret().getBytes(StandardCharsets.UTF_8));
+        } catch (Exception e) {
+            return false;
+        }
+
+        final byte[] providedSig;
+        try {
+            providedSig = Base64.getUrlDecoder().decode(sigB64);
+        } catch (IllegalArgumentException e) {
+            return false;
+        }
+
+        if (!DataUtil.constantTimeEquals(expectedSig, providedSig)) return false;
+
+        Map<String, Object> payloadMap;
+        try {
+            String payloadJson = new String(Base64.getUrlDecoder().decode(payloadB64), StandardCharsets.UTF_8);
+            payloadMap = JSON_MAPPER.readValue(
+                    payloadJson,
+                    new TypeReference<>() {
+                    }
+            );
+        } catch (IllegalArgumentException | JsonProcessingException e) {
+            return false;
+        }
+
+        final String iss = (String) payloadMap.get("iss");
+        final String scope = (String) payloadMap.get("scope");
+        final Object expObj = payloadMap.get("exp");
+        Long exp = null;
+        if (expObj instanceof Number) {
+            exp = ((Number) expObj).longValue();
+        } else if (expObj instanceof String) {
+            try {
+                exp = Long.parseLong((String) expObj);
+            } catch (NumberFormatException ignored) {
+            }
+        }
+
+        if (!JwtUtil.ISSUER.equals(iss)) {
+            return false;
+        }
+        if (exp == null || Instant.now().getEpochSecond() >= exp) {
+            return false;
+        }
+        return scope != null && hasRequiredScopes(scope);
+    }
+
+    private static boolean hasRequiredScopes(String scope) {
+        String[] scopes = scope.split("\\s+");
+        for (String required : SsoService.REQUIRED_SCOPES) {
+            if (!hasScope(scopes, required)) return false;
+        }
+        return true;
+    }
+
+    private static boolean hasScope(String[] scopes, String required) {
+        for (String scope : scopes) {
+            if (scope.equals(required)) {
+                return true;
+            }
+        }
+        return false;
+    }
+
+    private static void unauthorized(HttpServletRequest req, HttpServletResponse resp,
+                                     String error, String desc) throws IOException {
+        resp.resetBuffer();
+        resp.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
+
+        // Helpful for OAuth clients:
+        resp.setHeader("WWW-Authenticate",
+                "Bearer realm=\"Veeam Integration\", error=\"" + DataUtil.jsonEscape(error) +
+                        "\", error_description=\"" + DataUtil.jsonEscape(desc) + "\"");
+
+        final String accept = req.getHeader("Accept");
+        final boolean wantsJson = accept != null && accept.toLowerCase().contains("application/json");
+
+        resp.setCharacterEncoding("UTF-8");
+        if (wantsJson) {
+            resp.setContentType("application/json; charset=UTF-8");
+            resp.getWriter().write("{\"error\":\"" + DataUtil.jsonEscape(error) +
+                    "\",\"error_description\":\"" + DataUtil.jsonEscape(desc) + "\"}");
+        } else {
+            resp.setContentType("text/html; charset=UTF-8");
+            resp.getWriter().write("<html><head><title>Error</title></head><body>Unauthorized</body></html>");
+        }
+        resp.getWriter().flush();
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandler.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandler.java
new file mode 100644
index 000000000000..e3373d5edf58
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandler.java
@@ -0,0 +1,106 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.services;
+
+import java.io.IOException;
+import java.io.OutputStream;
+import java.nio.charset.Charset;
+import java.nio.charset.StandardCharsets;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.ca.CAManager;
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.component.ManagerBase;
+
+public class PkiResourceRouteHandler extends ManagerBase implements RouteHandler {
+    private static final String BASE_ROUTE = "/services/pki-resource";
+    private static final String RESOURCE_KEY = "resource";
+    private static final String RESOURCE_VALUE = "ca-certificate";
+    private static final String FORMAT_KEY = "format";
+    private static final String FORMAT_VALUE = "X509-PEM-CA";
+    private static final Charset OUTPUT_CHARSET = StandardCharsets.ISO_8859_1;
+
+    @Inject
+    CAManager caManager;
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE) && "GET".equalsIgnoreCase(req.getMethod())) {
+            handleGet(req, resp, outFormat, io);
+            return;
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleGet(HttpServletRequest req, HttpServletResponse resp,
+                 Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+        try {
+            final String resource = req.getParameter(RESOURCE_KEY);
+            final String format = req.getParameter(FORMAT_KEY);
+
+            if (StringUtils.isNotBlank(resource) && !RESOURCE_VALUE.equals(resource)) {
+                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Unsupported resource");
+                return;
+            }
+
+            if (StringUtils.isNotBlank(format) && !FORMAT_VALUE.equals(format)) {
+                resp.sendError(HttpServletResponse.SC_BAD_REQUEST, "Unsupported format");
+                return;
+            }
+
+            byte[] pemBytes = returnCACertificate();
+            if (pemBytes.length == 0) {
+                resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "No certificate data available");
+                return;
+            }
+            resp.setStatus(HttpServletResponse.SC_OK);
+            resp.setHeader("Cache-Control", "no-store");
+            resp.setContentType("application/x-x509-ca-cert; charset=" + OUTPUT_CHARSET.name());
+            resp.setHeader("Content-Disposition",
+                    "attachment; filename=\"pki-resource.cer\"");
+            resp.setContentLength(pemBytes.length);
+
+            try (OutputStream os = resp.getOutputStream()) {
+                os.write(pemBytes);
+            }
+        } catch (IOException e) {
+            String msg = "Failed to retrieve server CA certificate";
+            logger.error(msg, e);
+            resp.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, msg);
+        }
+    }
+
+    private byte[] returnCACertificate() throws IOException {
+        String tlsCaCert = caManager.getCaCertificate(null);
+        return tlsCaCert.getBytes(OUTPUT_CHARSET);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/sso/SsoService.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/sso/SsoService.java
new file mode 100644
index 000000000000..f68097ab1f89
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/sso/SsoService.java
@@ -0,0 +1,136 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.sso;
+
+import java.io.IOException;
+import java.time.Instant;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import javax.inject.Inject;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.RouteHandler;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.utils.JwtUtil;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.component.ManagerBase;
+
+public class SsoService extends ManagerBase implements RouteHandler {
+    private static final String BASE_ROUTE = "/sso";
+    private static final long DEFAULT_TTL_SECONDS = 3600;
+    public static final List<String> REQUIRED_SCOPES = List.of("ovirt-app-admin", "ovirt-app-portal");
+
+    @Inject
+    VeeamControlService veeamControlService;
+
+    @Override
+    public boolean canHandle(String method, String path) {
+        return getSanitizedPath(path).startsWith(BASE_ROUTE);
+    }
+
+    @Override
+    public void handle(HttpServletRequest req, HttpServletResponse resp, String path, Negotiation.OutFormat outFormat,
+                       VeeamControlServlet io) throws IOException {
+        final String sanitizedPath = getSanitizedPath(path);
+        if (sanitizedPath.equals(BASE_ROUTE + "/oauth/token")) {
+            handleToken(req, resp, outFormat, io);
+            return;
+        }
+
+        io.notFound(resp, null, outFormat);
+    }
+
+    protected void handleToken(HttpServletRequest req, HttpServletResponse resp,
+                               Negotiation.OutFormat outFormat, VeeamControlServlet io) throws IOException {
+
+        if (!"POST".equalsIgnoreCase(req.getMethod())) {
+            resp.setHeader("Allow", "POST");
+            io.getWriter().write(resp, HttpServletResponse.SC_METHOD_NOT_ALLOWED,
+                    Map.of("error", "method_not_allowed",
+                            "message", "token endpoint requires POST"), outFormat);
+            return;
+        }
+
+        final String grantType = trimToNull(req.getParameter("grant_type"));
+        final String scope = trimToNull(req.getParameter("scope"));
+        final String username = trimToNull(req.getParameter("username"));
+        final String password = trimToNull(req.getParameter("password"));
+
+        if (grantType == null) {
+            io.getWriter().write(resp, HttpServletResponse.SC_BAD_REQUEST,
+                    Map.of("error", "invalid_request",
+                            "error_description", "Missing parameter: grant_type"), outFormat);
+            return;
+        }
+        if (!"password".equals(grantType)) {
+            io.getWriter().write(resp, HttpServletResponse.SC_BAD_REQUEST,
+                    Map.of("error", "unsupported_grant_type",
+                            "error_description", "Only grant_type=password is supported"), outFormat);
+            return;
+        }
+        if (username == null || password == null) {
+            io.getWriter().write(resp, HttpServletResponse.SC_BAD_REQUEST,
+                    Map.of("error", "invalid_request",
+                            "error_description", "Missing username/password"), outFormat);
+            return;
+        }
+
+        if (!veeamControlService.validateCredentials(username, password)) {
+            io.getWriter().write(resp, HttpServletResponse.SC_UNAUTHORIZED,
+                    Map.of("error", "invalid_grant",
+                            "error_description", "Invalid credentials"), outFormat);
+            return;
+        }
+
+        final String effectiveScope = (scope == null) ? StringUtils.join(REQUIRED_SCOPES, " ") : scope;
+
+        final long ttl = DEFAULT_TTL_SECONDS;
+        long nowMillis = Instant.now().toEpochMilli();
+        long expMillis = nowMillis + ttl * 1000L;
+        final String token;
+        try {
+            token = JwtUtil.issueHs256Jwt(username, effectiveScope, ttl, veeamControlService.getHmacSecret());
+        } catch (Exception e) {
+            io.getWriter().write(resp, HttpServletResponse.SC_INTERNAL_SERVER_ERROR,
+                    Map.of("error", "server_error",
+                            "error_description", "Failed to issue token"), outFormat);
+            return;
+        }
+
+        final Map<String, Object> payload = new HashMap<>();
+        payload.put("access_token", token);
+        payload.put("token_type", "bearer");
+        payload.put("expires_in", ttl);
+        payload.put("exp", expMillis);
+        payload.put("scope", effectiveScope);
+
+        io.getWriter().write(resp, HttpServletResponse.SC_OK, payload, outFormat);
+    }
+
+    private static String trimToNull(String s) {
+        if (s == null) return null;
+        s = s.trim();
+        return s.isEmpty() ? null : s;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/CloudConfigUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/CloudConfigUtil.java
new file mode 100644
index 000000000000..d1e76f766da9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/CloudConfigUtil.java
@@ -0,0 +1,156 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Optional;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.net.NetUtils;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
+
+public final class CloudConfigUtil {
+
+    private static final String NETWORK_CONFIG_PATH = "network_config.yml";
+    private static final ObjectMapper YAML_MAPPER = new ObjectMapper(new YAMLFactory());
+
+    private CloudConfigUtil() {
+    }
+
+    public static Optional<String> extractIpv4Address(String userData) {
+        if (userData == null || userData.isBlank()) {
+            return Optional.empty();
+        }
+
+        String normalizedUserData = normalize(userData);
+
+        Map<String, Object> cloudConfig = parseYamlMap(normalizedUserData);
+        if (cloudConfig == null) {
+            return Optional.empty();
+        }
+
+        Object writeFilesObj = cloudConfig.get("write_files");
+        if (!(writeFilesObj instanceof List)) {
+            return Optional.empty();
+        }
+        List<?> writeFiles = (List<?>) writeFilesObj;
+
+        for (Object item : writeFiles) {
+            if (!(item instanceof Map)) {
+                continue;
+            }
+            Map<?, ?> fileEntry = (Map<?, ?>) item;
+
+            Object pathObj = fileEntry.get("path");
+            Object contentObj = fileEntry.get("content");
+            String configPath = String.valueOf(pathObj);
+
+            if (StringUtils.isBlank(configPath) || !configPath.endsWith(NETWORK_CONFIG_PATH)) {
+                continue;
+            }
+
+            if (contentObj == null) {
+                return Optional.empty();
+            }
+
+            return extractIpv4FromNetworkConfig(String.valueOf(contentObj));
+        }
+
+        return Optional.empty();
+    }
+
+    private static Optional<String> extractIpv4FromNetworkConfig(String networkConfigYaml) {
+        Map<String, Object> networkConfig = parseYamlMap(networkConfigYaml);
+        if (networkConfig == null) {
+            return Optional.empty();
+        }
+
+        Object interfacesObj = networkConfig.get("interfaces");
+        if (!(interfacesObj instanceof List)) {
+            return Optional.empty();
+        }
+        List<?> interfaces = (List<?>) interfacesObj;
+
+        for (Object item : interfaces) {
+            if (!(item instanceof Map)) {
+                continue;
+            }
+            Map<?, ?> iface = (Map<?, ?>) item;
+
+            Object ipv4Obj = iface.get("ipv4");
+            if (!(ipv4Obj instanceof Map)) {
+                continue;
+            }
+            Map<?, ?> ipv4 = (Map<?, ?>) ipv4Obj;
+
+            Object enabledObj = ipv4.get("enabled");
+            if (Boolean.FALSE.equals(enabledObj)) {
+                continue;
+            }
+
+            Object dhcpObj = ipv4.get("dhcp");
+            if (Boolean.TRUE.equals(dhcpObj)) {
+                continue;
+            }
+
+            Object addressObj = ipv4.get("address");
+            if (!(addressObj instanceof List)) {
+                continue;
+            }
+            List<?> addresses = (List<?>) addressObj;
+
+            for (Object addressItem : addresses) {
+                if (!(addressItem instanceof Map)) {
+                    continue;
+                }
+                Map<?, ?> address = (Map<?, ?>) addressItem;
+
+                Object ipObj = address.get("ip");
+                if (ipObj != null && NetUtils.isIpv4(String.valueOf(ipObj))) {
+                    return Optional.of(String.valueOf(ipObj));
+                }
+            }
+        }
+
+        return Optional.empty();
+    }
+
+    @SuppressWarnings("unchecked")
+    private static Map<String, Object> parseYamlMap(String yamlContent) {
+        try {
+            Object parsed = YAML_MAPPER.readValue(yamlContent, Object.class);
+            if (parsed instanceof Map) {
+                return (Map<String, Object>) parsed;
+            }
+        } catch (Exception ignored) {
+            // Invalid or unsupported YAML
+        }
+        return null;
+    }
+
+    private static String normalize(String data) {
+        return data
+                .replace("\\r\\n", "\n")
+                .replace("\\n", "\n")
+                .replace("\r\n", "\n")
+                .replace("\r", "\n");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/DataUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/DataUtil.java
new file mode 100644
index 000000000000..9e0eef768d03
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/DataUtil.java
@@ -0,0 +1,44 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+public class DataUtil {
+
+    public static String b64Url(byte[] in) {
+        return Base64.getUrlEncoder().withoutPadding().encodeToString(in);
+    }
+
+    public static String jsonEscape(String s) {
+        return s == null ? "" : s.replace("\\", "\\\\").replace("\"", "\\\"");
+    }
+
+    public static boolean constantTimeEquals(String a, String b) {
+        if (a == null || b == null) return false;
+        return constantTimeEquals(a.getBytes(StandardCharsets.UTF_8), b.getBytes(StandardCharsets.UTF_8));
+    }
+
+    public static boolean constantTimeEquals(byte[] x, byte[] y) {
+        if (x.length != y.length) return false;
+        int r = 0;
+        for (int i = 0; i < x.length; i++) r |= x[i] ^ y[i];
+        return r == 0;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/JwtUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/JwtUtil.java
new file mode 100644
index 000000000000..a12b4d4e0da7
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/JwtUtil.java
@@ -0,0 +1,61 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+
+import javax.crypto.Mac;
+import javax.crypto.spec.SecretKeySpec;
+
+import com.google.gson.JsonObject;
+
+public class JwtUtil {
+    public static final String ALGORITHM = "HmacSHA256";
+    public static final String ISSUER = "veeam-control";
+
+    public static String issueHs256Jwt(String subject, String scope, long ttlSeconds, String secret) throws Exception {
+        long now = Instant.now().getEpochSecond();
+        long exp = now + ttlSeconds;
+
+        JsonObject headerObject = new JsonObject();
+        headerObject.addProperty("alg", "HS256");
+        headerObject.addProperty("typ", "JWT");
+        String headerJson = headerObject.toString();
+        JsonObject payloadObject = new JsonObject();
+        payloadObject.addProperty("iss", ISSUER);
+        payloadObject.addProperty("sub", subject);
+        payloadObject.addProperty("scope", scope);
+        payloadObject.addProperty("iat", now);
+        payloadObject.addProperty("exp", exp);
+        String payloadJson = payloadObject.toString();
+
+        String header = DataUtil.b64Url(headerJson.getBytes(StandardCharsets.UTF_8));
+        String payload = DataUtil.b64Url(payloadJson.getBytes(StandardCharsets.UTF_8));
+        String signingInput = header + "." + payload;
+
+        byte[] sig = hmacSha256(signingInput.getBytes(StandardCharsets.UTF_8), secret.getBytes(StandardCharsets.UTF_8));
+        return signingInput + "." + DataUtil.b64Url(sig);
+    }
+
+    public static byte[] hmacSha256(byte[] data, byte[] key) throws Exception {
+        final Mac mac = Mac.getInstance(ALGORITHM);
+        mac.init(new SecretKeySpec(key, ALGORITHM));
+        return mac.doFinal(data);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Mapper.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Mapper.java
new file mode 100644
index 000000000000..933e57b202a3
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Mapper.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import com.fasterxml.jackson.annotation.JsonInclude;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import com.fasterxml.jackson.dataformat.xml.XmlMapper;
+
+public class Mapper {
+    private final ObjectMapper json;
+    private final XmlMapper xml;
+
+    public Mapper() {
+        this.json = new ObjectMapper();
+        this.xml = new XmlMapper();
+
+        configure(json);
+        configure(xml);
+    }
+
+    private static void configure(final ObjectMapper mapper) {
+        mapper.setSerializationInclusion(JsonInclude.Include.NON_NULL);
+        mapper.setPropertyNamingStrategy(PropertyNamingStrategies.SNAKE_CASE);
+        mapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, false);
+        // If you ever add enums etc:
+        // mapper.enable(SerializationFeature.WRITE_ENUMS_USING_TO_STRING);
+        // mapper.enable(DeserializationFeature.READ_ENUMS_USING_TO_STRING);
+    }
+
+    public String toJson(final Object value) throws JsonProcessingException {
+        return json.writeValueAsString(value);
+    }
+
+    public String toXml(final Object value) throws JsonProcessingException {
+        return xml.writeValueAsString(value);
+    }
+
+    public ObjectMapper jsonMapper() {
+        return json;
+    }
+
+    public XmlMapper xmlMapper() {
+        return xml;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Negotiation.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Negotiation.java
new file mode 100644
index 000000000000..1c82216f113b
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/Negotiation.java
@@ -0,0 +1,45 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+
+import javax.servlet.http.HttpServletRequest;
+
+public final class Negotiation {
+
+    public enum OutFormat { XML, JSON }
+
+    public static OutFormat responseFormat(HttpServletRequest req) {
+        String accept = req.getHeader("Accept");
+        if (accept == null || accept.isBlank() || accept.contains("*/*")) {
+            return OutFormat.XML;
+        }
+        accept = accept.toLowerCase();
+        if (accept.contains("application/json")) return OutFormat.JSON;
+        if (accept.contains("application/xml") || accept.contains("text/xml")) {
+            return OutFormat.XML;
+        }
+        return OutFormat.XML;
+    }
+
+    public static String contentType(OutFormat fmt) {
+        return fmt == OutFormat.JSON
+                ? "application/json"
+                : "application/xml";
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/PathUtil.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/PathUtil.java
new file mode 100644
index 000000000000..5cf558cdd778
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/PathUtil.java
@@ -0,0 +1,75 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.commons.lang3.StringUtils;
+
+import com.cloud.utils.UuidUtils;
+
+public class PathUtil {
+    private static final boolean CONSIDER_ONLY_UUID_AS_ID = false;
+
+    public static List<String> extractIdAndSubPath(final String path, final String baseRoute) {
+
+        if (StringUtils.isBlank(path)) {
+            return null;
+        }
+
+        // Remove base route (be tolerant of trailing slash in baseRoute)
+        String rest = path;
+        if (StringUtils.isNotBlank(baseRoute)) {
+            String normalizedBase = baseRoute.endsWith("/") && baseRoute.length() > 1
+                    ? baseRoute.substring(0, baseRoute.length() - 1)
+                    : baseRoute;
+            if (rest.startsWith(normalizedBase)) {
+                rest = rest.substring(normalizedBase.length());
+            }
+        }
+
+        // Expect "/{id}" or "/{id}/..." (no empty segments)
+        if (StringUtils.isBlank(rest) || !rest.startsWith("/")) {
+            return null; // /api/datacenters (no id) or invalid format
+        }
+
+        rest = rest.substring(1); // remove leading '/'
+
+        if (StringUtils.isBlank(rest)) {
+            return null;
+        }
+
+        final String[] parts = rest.split("/", -1);
+
+        // Collect non-blank segments
+        List<String> validParts = new ArrayList<>();
+        for (String part : parts) {
+            if (StringUtils.isNotBlank(part)) {
+                validParts.add(part);
+            }
+        }
+
+        // Validate first segment, check if it is a UUID if enabled
+        if (validParts.isEmpty() || (CONSIDER_ONLY_UUID_AS_ID && !UuidUtils.isUuid(validParts.get(0)))) {
+            return null;
+        }
+
+        return validParts;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/ResponseWriter.java b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/ResponseWriter.java
new file mode 100644
index 000000000000..63e3c98aa7f0
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/java/org/apache/cloudstack/veeam/utils/ResponseWriter.java
@@ -0,0 +1,87 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.dto.Fault;
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+public final class ResponseWriter {
+    private static final Logger LOGGER = LogManager.getLogger(ResponseWriter.class);
+
+    private final Mapper mapper;
+
+    public ResponseWriter(final Mapper mapper) {
+        this.mapper = mapper;
+    }
+
+    public void write(final HttpServletResponse resp, final int status, final Object body, final Negotiation.OutFormat fmt)
+            throws IOException {
+
+        resp.setStatus(status);
+
+        if (body == null) {
+            resp.setContentLength(0);
+            return;
+        }
+
+        final String payload;
+        final String contentType;
+
+        try {
+            if (fmt == Negotiation.OutFormat.XML) {
+                contentType = "application/xml";
+                payload = mapper.toXml(body);
+            } else {
+                contentType = "application/json";
+                payload = mapper.toJson(body);
+            }
+        } catch (Exception e) {
+            // Last-resort fallback
+            resp.setStatus(500);
+            resp.setHeader("Content-Type", "text/plain");
+            resp.getWriter().write("Internal Server Error");
+            return;
+        }
+
+        if (VeeamControlService.DeveloperLogs.value()) {
+            LOGGER.debug("Writing response: status={}, contentType={}, payloadLength={}\n{}",
+                    status, contentType, payload.length(), payload);
+        }
+
+        resp.setCharacterEncoding(StandardCharsets.UTF_8.name());
+        resp.setHeader("Content-Type", contentType);
+        resp.getWriter().write(payload);
+    }
+
+    public void writeFault(final HttpServletResponse resp, final int status, final String reason, final String detail, final Negotiation.OutFormat fmt)
+            throws IOException {
+        Fault fault = new Fault(reason, detail);
+        if (fmt == Negotiation.OutFormat.XML) {
+            write(resp, status, fault, fmt);
+        } else {
+            write(resp, status, fault, fmt);
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/module.properties b/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/module.properties
new file mode 100644
index 000000000000..453e40dee69d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/module.properties
@@ -0,0 +1,18 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+name=veeam-control-service
+parent=backup
diff --git a/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/spring-veeam-control-service-context.xml b/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/spring-veeam-control-service-context.xml
new file mode 100644
index 000000000000..83d100ec76e8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/main/resources/META-INF/cloudstack/veeam-control-service/spring-veeam-control-service-context.xml
@@ -0,0 +1,66 @@
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements. See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership. The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License. You may obtain a copy of the License at
+
+  http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied. See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<beans xmlns="http://www.springframework.org/schema/beans"
+       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns:aop="http://www.springframework.org/schema/aop"
+       xsi:schemaLocation="http://www.springframework.org/schema/beans
+                      http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
+                      http://www.springframework.org/schema/aop
+                      http://www.springframework.org/schema/aop/spring-aop.xsd"
+>
+
+    <bean id="routeHandlerRegistry"
+          class="org.apache.cloudstack.spring.lifecycle.registry.ExtensionRegistry">
+    </bean>
+
+    <bean class="org.apache.cloudstack.spring.lifecycle.registry.RegistryLifecycle">
+        <property name="registry" ref="routeHandlerRegistry" />
+        <property name="typeClass" value="org.apache.cloudstack.veeam.RouteHandler" />
+    </bean>
+
+    <bean id="veeamControlSsoService" class="org.apache.cloudstack.veeam.sso.SsoService"/>
+    <bean id="pkiResourceRouteHandler" class="org.apache.cloudstack.veeam.services.PkiResourceRouteHandler"/>
+    <bean id="apiRouteHandler" class="org.apache.cloudstack.veeam.api.ApiRouteHandler" />
+    <bean id="dataCentersRouteHandler" class="org.apache.cloudstack.veeam.api.DataCentersRouteHandler"/>
+    <bean id="clustersRouteHandler" class="org.apache.cloudstack.veeam.api.ClustersRouteHandler"/>
+    <bean id="hostsRouteHandler" class="org.apache.cloudstack.veeam.api.HostsRouteHandler"/>
+    <bean id="networksRouteHandler" class="org.apache.cloudstack.veeam.api.NetworksRouteHandler"/>
+    <bean id="vnicProfilesRouteHandler" class="org.apache.cloudstack.veeam.api.VnicProfilesRouteHandler"/>
+    <bean id="vmsRouteHandler" class="org.apache.cloudstack.veeam.api.VmsRouteHandler"/>
+    <bean id="disksRouteHandler" class="org.apache.cloudstack.veeam.api.DisksRouteHandler"/>
+    <bean id="imageTransfersRouteHandler" class="org.apache.cloudstack.veeam.api.ImageTransfersRouteHandler"/>
+    <bean id="jobsRouteHandler" class="org.apache.cloudstack.veeam.api.JobsRouteHandler"/>
+    <bean id="tagsRouteHandler" class="org.apache.cloudstack.veeam.api.TagsRouteHandler"/>
+
+    <bean id="veeamControlService" class="org.apache.cloudstack.veeam.VeeamControlServiceImpl" >
+        <property name="routeHandlers" value="#{routeHandlerRegistry.registered}" />
+    </bean>
+
+    <bean id="serverAdapter" class="org.apache.cloudstack.veeam.adapter.ServerAdapter"/>
+    <bean id="apiAccessInterceptor" class="org.apache.cloudstack.veeam.adapter.ApiAccessInterceptor"/>
+
+    <!--
+      AOP
+    -->
+    <aop:config proxy-target-class="true">
+        <aop:advisor advice-ref="apiAccessInterceptor"
+                     pointcut="execution(public * org.apache.cloudstack.veeam.adapter.ServerAdapter.*(..)) &amp;&amp; @annotation(org.apache.cloudstack.veeam.adapter.ApiAccess)" />
+    </aop:config>
+
+</beans>
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServerTest.java
new file mode 100644
index 000000000000..6fe382873223
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServerTest.java
@@ -0,0 +1,227 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.lang.reflect.Field;
+import java.lang.reflect.Method;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Properties;
+import java.util.concurrent.atomic.AtomicReference;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.ConfigKey.Scope;
+import org.apache.cloudstack.framework.config.impl.ConfigDepotImpl;
+import org.apache.cloudstack.utils.server.ServerPropertiesUtil;
+import org.eclipse.jetty.server.Server;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.mockito.Mockito;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+public class VeeamControlServerTest {
+
+    private static final String KEY_ENABLED = "integration.veeam.control.enabled";
+    private static final String KEY_PORT = "integration.veeam.control.port";
+    private static final String KEY_CONTEXT_PATH = "integration.veeam.control.context.path";
+    private static final String KEY_DEVELOPER_LOGS = "integration.veeam.control.developer.logs";
+
+    private ConfigDepotImpl previousDepot;
+    private Properties previousServerProperties;
+    private final Map<String, String> globalValues = new HashMap<>();
+
+    @Before
+    public void setUp() throws Exception {
+        previousDepot = getConfigDepot();
+        final ConfigDepotImpl depot = mock(ConfigDepotImpl.class);
+        when(depot.getConfigStringValue(Mockito.anyString(), Mockito.any(), Mockito.any())).thenAnswer(invocation -> {
+            final String key = invocation.getArgument(0);
+            final Scope scope = invocation.getArgument(1);
+            if (scope == Scope.Global) {
+                return globalValues.get(key);
+            }
+            return null;
+        });
+        setConfigDepot(depot);
+
+        previousServerProperties = getServerProperties();
+        Properties props = new Properties();
+        props.setProperty("https.keystore", "");
+        props.setProperty("https.keystore.password", "");
+        setServerProperties(props);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        setConfigDepot(previousDepot);
+        setServerProperties(previousServerProperties);
+        resetConfigKeyCache(VeeamControlService.Enabled);
+        resetConfigKeyCache(VeeamControlService.Port);
+        resetConfigKeyCache(VeeamControlService.ContextPath);
+        resetConfigKeyCache(VeeamControlService.DeveloperLogs);
+    }
+
+    @Test
+    public void testConstructorSortsHandlersByPriorityDescending() throws Exception {
+        final RouteHandler low = mock(RouteHandler.class);
+        final RouteHandler high = mock(RouteHandler.class);
+        when(low.priority()).thenReturn(1);
+        when(high.priority()).thenReturn(10);
+
+        final VeeamControlServer server = new VeeamControlServer(List.of(low, high), mock(VeeamControlService.class));
+        final List<RouteHandler> handlers = getRouteHandlers(server);
+
+        assertEquals(high, handlers.get(0));
+        assertEquals(low, handlers.get(1));
+    }
+
+    @Test
+    public void testStartIfEnabledReturnsWithoutStartingWhenDisabled() throws Exception {
+        globalValues.put(KEY_ENABLED, "false");
+        resetConfigKeyCache(VeeamControlService.Enabled);
+
+        final VeeamControlServer server = new VeeamControlServer(List.of(), mock(VeeamControlService.class));
+        server.startIfEnabled();
+
+        assertNull(getJettyServer(server));
+    }
+
+    @Test
+    public void testStartIfEnabledStartsHttpServerWhenEnabled() throws Exception {
+        globalValues.put(KEY_ENABLED, "true");
+        globalValues.put(KEY_PORT, "0");
+        globalValues.put(KEY_CONTEXT_PATH, "/ovirt-engine");
+        resetConfigKeyCache(VeeamControlService.Enabled);
+        resetConfigKeyCache(VeeamControlService.Port);
+        resetConfigKeyCache(VeeamControlService.ContextPath);
+
+        final VeeamControlService service = mock(VeeamControlService.class);
+        when(service.getCurrentManagementServerHostId()).thenReturn(1L);
+
+        final VeeamControlServer server = new VeeamControlServer(List.of(), service);
+        try {
+            server.startIfEnabled();
+            final Server jetty = getJettyServer(server);
+            assertNotNull(jetty);
+            assertTrue(jetty.isStarted());
+        } finally {
+            server.stop();
+        }
+    }
+
+    @Test
+    public void testStopStopsExistingJettyServerAndClearsReference() throws Exception {
+        final VeeamControlServer server = new VeeamControlServer(List.of(), mock(VeeamControlService.class));
+        final Server jetty = mock(Server.class);
+        setJettyServer(server, jetty);
+
+        server.stop();
+
+        verify(jetty).stop();
+        assertNull(getJettyServer(server));
+    }
+
+    @Test
+    public void testGetRequestResponseMetadataIncludesHeadersWhenDeveloperLogsEnabled() throws Exception {
+        globalValues.put(KEY_DEVELOPER_LOGS, "true");
+        resetConfigKeyCache(VeeamControlService.DeveloperLogs);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/api");
+        request.setRemoteAddr("127.0.0.1");
+        request.setQueryString("x=1");
+        request.addHeader("X-Test", "abc");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        response.setStatus(202);
+
+        final Method metadataMethod = VeeamControlServer.class.getDeclaredMethod("getRequestResponseMetadata",
+                HttpServletRequest.class, HttpServletResponse.class);
+        metadataMethod.setAccessible(true);
+        final String metadata = (String) metadataMethod.invoke(null, request, response);
+
+        assertTrue(metadata.contains("remote address: 127.0.0.1"));
+        assertTrue(metadata.contains("uri: /api?x=1"));
+        assertTrue(metadata.contains("headers: [X-Test=abc;"));
+        assertTrue(metadata.contains("status: 202"));
+    }
+
+    @SuppressWarnings("unchecked")
+    private static List<RouteHandler> getRouteHandlers(final VeeamControlServer server) throws Exception {
+        final Field field = VeeamControlServer.class.getDeclaredField("routeHandlers");
+        field.setAccessible(true);
+        return (List<RouteHandler>) field.get(server);
+    }
+
+    private static Server getJettyServer(final VeeamControlServer server) throws Exception {
+        final Field field = VeeamControlServer.class.getDeclaredField("server");
+        field.setAccessible(true);
+        return (Server) field.get(server);
+    }
+
+    private static void setJettyServer(final VeeamControlServer server, final Server jetty) throws Exception {
+        final Field field = VeeamControlServer.class.getDeclaredField("server");
+        field.setAccessible(true);
+        field.set(server, jetty);
+    }
+
+    private static ConfigDepotImpl getConfigDepot() throws Exception {
+        final Field field = ConfigKey.class.getDeclaredField("s_depot");
+        field.setAccessible(true);
+        return (ConfigDepotImpl) field.get(null);
+    }
+
+    private static void setConfigDepot(final ConfigDepotImpl depot) throws Exception {
+        final Field field = ConfigKey.class.getDeclaredField("s_depot");
+        field.setAccessible(true);
+        field.set(null, depot);
+    }
+
+    @SuppressWarnings("unchecked")
+    private static Properties getServerProperties() throws Exception {
+        final Field field = ServerPropertiesUtil.class.getDeclaredField("propertiesRef");
+        field.setAccessible(true);
+        final AtomicReference<Properties> ref = (AtomicReference<Properties>) field.get(null);
+        return ref.get();
+    }
+
+    @SuppressWarnings("unchecked")
+    private static void setServerProperties(final Properties properties) throws Exception {
+        final Field field = ServerPropertiesUtil.class.getDeclaredField("propertiesRef");
+        field.setAccessible(true);
+        final AtomicReference<Properties> ref = (AtomicReference<Properties>) field.get(null);
+        ref.set(properties);
+    }
+
+    private static void resetConfigKeyCache(final ConfigKey<?> configKey) throws Exception {
+        final Field valueField = ConfigKey.class.getDeclaredField("_value");
+        valueField.setAccessible(true);
+        valueField.set(configKey, null);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServiceImplTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServiceImplTest.java
new file mode 100644
index 000000000000..a4dd970c9cfb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServiceImplTest.java
@@ -0,0 +1,185 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.lang.reflect.Field;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.ConfigKey.Scope;
+import org.apache.cloudstack.framework.config.impl.ConfigDepotImpl;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+import com.cloud.utils.UuidUtils;
+
+@RunWith(MockitoJUnitRunner.class)
+public class VeeamControlServiceImplTest {
+
+    private static final String KEY_ENABLED = "integration.veeam.control.enabled";
+    private static final String KEY_PORT = "integration.veeam.control.port";
+    private static final String KEY_USERNAME = "integration.veeam.control.api.username";
+    private static final String KEY_PASSWORD = "integration.veeam.control.api.password";
+    private static final String KEY_ALLOWED_CIDRS = "integration.veeam.control.allowed.client.cidrs";
+
+    private ConfigDepotImpl previousDepot;
+    private final Map<String, String> globalValues = new HashMap<>();
+
+    @Before
+    public void setUp() throws Exception {
+        previousDepot = getConfigDepot();
+        final ConfigDepotImpl depot = mock(ConfigDepotImpl.class);
+        when(depot.getConfigStringValue(Mockito.anyString(), Mockito.any(), Mockito.any())).thenAnswer(invocation -> {
+            final String key = invocation.getArgument(0);
+            final Scope scope = invocation.getArgument(1);
+            if (scope == Scope.Global) {
+                return globalValues.get(key);
+            }
+            return null;
+        });
+        setConfigDepot(depot);
+    }
+
+    @After
+    public void tearDown() throws Exception {
+        setConfigDepot(previousDepot);
+        resetConfigKeyCache(VeeamControlService.Enabled);
+        resetConfigKeyCache(VeeamControlService.Port);
+        resetConfigKeyCache(VeeamControlService.Username);
+        resetConfigKeyCache(VeeamControlService.Password);
+        resetConfigKeyCache(VeeamControlService.AllowedClientCidrs);
+    }
+
+    @Test
+    public void testParseImageTransfer() {
+        String data = "{\"active\":false,\"direction\":\"upload\",\"format\":\"cow\",\"inactivity_timeout\":3600,\"phase\":\"cancelled\",\"shallow\":false,\"transferred\":0,\"link\":[],\"disk\":{\"id\":\"dba4d72d-01de-4267-aa8e-305996b53599\"},\"image\":{},\"backup\":{\"creation_date\":0}}";
+        Mapper mapper = new Mapper();
+        try {
+            mapper.jsonMapper().readValue(data, ImageTransfer.class);
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    @Test
+    public void testGetAllowedClientCidrsInternalSanitizesAndFiltersInvalidEntries() throws Exception {
+        globalValues.put(KEY_ALLOWED_CIDRS, " 10.0.0.0/24,invalid-cidr, ,192.168.1.100/32 ");
+        resetConfigKeyCache(VeeamControlService.AllowedClientCidrs);
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+
+        final List<String> cidrs = service.getAllowedClientCidrsInternal();
+
+        assertEquals(List.of("10.0.0.0/24", "192.168.1.100/32"), cidrs);
+    }
+
+    @Test
+    public void testGetAllowedClientCidrsInternalReturnsEmptyListForBlankValue() throws Exception {
+        globalValues.put(KEY_ALLOWED_CIDRS, "   ");
+        resetConfigKeyCache(VeeamControlService.AllowedClientCidrs);
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+
+        assertTrue(service.getAllowedClientCidrsInternal().isEmpty());
+    }
+
+    @Test
+    public void testValidateCredentials() throws Exception {
+        globalValues.put(KEY_USERNAME, "veeam-user");
+        globalValues.put(KEY_PASSWORD, "veeam-pass");
+        resetConfigKeyCache(VeeamControlService.Username);
+        resetConfigKeyCache(VeeamControlService.Password);
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+
+        assertTrue(service.validateCredentials("veeam-user", "veeam-pass"));
+        assertFalse(service.validateCredentials("veeam-user", "wrong"));
+        assertFalse(service.validateCredentials("wrong", "veeam-pass"));
+    }
+
+    @Test
+    public void testGetInstanceIdReturnsSystemAccountUuid() {
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+        final AccountService accountService = mock(AccountService.class);
+        final Account account = mock(Account.class);
+        service.accountService = accountService;
+        when(accountService.getSystemAccount()).thenReturn(account);
+        when(account.getUuid()).thenReturn("system-account-uuid");
+
+        assertEquals("system-account-uuid", service.getInstanceId());
+    }
+
+    @Test
+    public void testGetHmacSecretUsesConfiguredInputs() throws Exception {
+        globalValues.put(KEY_PORT, "8095");
+        globalValues.put(KEY_USERNAME, "api-user");
+        globalValues.put(KEY_PASSWORD, "api-pass");
+        resetConfigKeyCache(VeeamControlService.Port);
+        resetConfigKeyCache(VeeamControlService.Username);
+        resetConfigKeyCache(VeeamControlService.Password);
+
+        final VeeamControlServiceImpl service = Mockito.spy(new VeeamControlServiceImpl());
+        Mockito.doReturn("instance-uuid").when(service).getInstanceId();
+
+        final String expected = UuidUtils.nameUUIDFromBytes(
+                "instance-uuid:8095:api-userapi-pass".getBytes(StandardCharsets.UTF_8)).toString();
+        assertEquals(expected, service.getHmacSecret());
+    }
+
+    @Test
+    public void testGetConfigKeysContainsExpectedEntries() {
+        final VeeamControlServiceImpl service = new VeeamControlServiceImpl();
+
+        final ConfigKey<?>[] keys = service.getConfigKeys();
+
+        assertEquals(11, keys.length);
+        assertEquals(KEY_ENABLED, keys[0].key());
+    }
+
+    private static ConfigDepotImpl getConfigDepot() throws Exception {
+        final Field field = ConfigKey.class.getDeclaredField("s_depot");
+        field.setAccessible(true);
+        return (ConfigDepotImpl) field.get(null);
+    }
+
+    private static void setConfigDepot(final ConfigDepotImpl depot) throws Exception {
+        final Field field = ConfigKey.class.getDeclaredField("s_depot");
+        field.setAccessible(true);
+        field.set(null, depot);
+    }
+
+    private static void resetConfigKeyCache(final ConfigKey<?> configKey) throws Exception {
+        final Field valueField = ConfigKey.class.getDeclaredField("_value");
+        valueField.setAccessible(true);
+        valueField.set(configKey, null);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServletTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServletTest.java
new file mode 100644
index 000000000000..c788613e52cf
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/VeeamControlServletTest.java
@@ -0,0 +1,121 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+public class VeeamControlServletTest {
+
+    @Test
+    public void testServiceHandlesRootRequestForGet() throws Exception {
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.emptyList());
+        final HttpServletRequest request = new MockHttpServletRequest("GET", "/");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        servlet.service(request, response);
+
+        assertEquals(200, response.getStatus());
+        assertTrue(response.getContentAsString().contains("CloudStack Veeam Control Service"));
+    }
+
+    @Test
+    public void testServiceReturnsBadRequestForUnsupportedRootMethod() throws Exception {
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.emptyList());
+        final HttpServletRequest request = new MockHttpServletRequest("PUT", "/");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        servlet.service(request, response);
+
+        assertEquals(400, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Unsupported method for root"));
+    }
+
+    @Test
+    public void testServiceDelegatesToMatchingRouteHandler() throws Exception {
+        final RouteHandler handler = mock(RouteHandler.class);
+        final String path = "/api/path";
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.singletonList(handler));
+        final HttpServletRequest request = new MockHttpServletRequest("GET", path);
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        when(handler.canHandle("GET", path)).thenReturn(true);
+
+        servlet.service(request, response);
+
+        verify(handler).handle(request, response, path, Negotiation.OutFormat.XML, servlet);
+    }
+
+    @Test
+    public void testServiceReturnsNotFoundWhenNoHandlerMatches() throws Exception {
+        final RouteHandler handler = mock(RouteHandler.class);
+        final String path = "/api/path";
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.singletonList(handler));
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", path);
+        request.setPathInfo(path);
+        request.addHeader("Accept", "application/json");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        when(handler.canHandle("GET", path)).thenReturn(false);
+
+        servlet.service(request, response);
+
+        assertEquals(404, response.getStatus());
+        assertTrue(response.getContentAsString().contains("\"reason\":\"Not found\""));
+        verify(handler).canHandle("GET", path);
+    }
+
+    @Test
+    public void testServiceConvertsHandlerErrorToFaultResponse() throws Exception {
+        final RouteHandler handler = mock(RouteHandler.class);
+        final String path = "/api/faultpath";
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.singletonList(handler));
+        final HttpServletRequest request = new MockHttpServletRequest("GET", path);
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        when(handler.canHandle("GET", path)).thenReturn(true);
+        doThrow(VeeamControlServlet.Error.unauthorized("denied")).when(handler)
+                .handle(request, response, path, Negotiation.OutFormat.XML, servlet);
+
+        servlet.service(request, response);
+
+        assertEquals(401, response.getStatus());
+        assertTrue(response.getContentAsString().contains("denied"));
+    }
+
+    @Test
+    public void testMethodNotAllowedWritesAllowHeaderAndFault() throws Exception {
+        final VeeamControlServlet servlet = new VeeamControlServlet(Collections.emptyList());
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        servlet.methodNotAllowed(response, "GET, POST", Negotiation.OutFormat.JSON);
+
+        assertEquals(405, response.getStatus());
+        assertEquals("GET, POST", response.getHeader("Allow"));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptorTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptorTest.java
new file mode 100644
index 000000000000..16fafb9034bd
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ApiAccessInterceptorTest.java
@@ -0,0 +1,204 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertSame;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.lang.reflect.Method;
+
+import org.aopalliance.intercept.MethodInvocation;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.command.user.zone.ListZonesCmd;
+import org.apache.cloudstack.context.CallContext;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+
+public class ApiAccessInterceptorTest {
+
+    private static final long BASE_USER_ID = 100L;
+    private static final long BASE_ACCOUNT_ID = 200L;
+    private static final long SERVICE_USER_ID = 300L;
+    private static final long SERVICE_ACCOUNT_ID = 400L;
+
+    private final ApiAccessInterceptor interceptor = new ApiAccessInterceptor();
+    private final AccountManager accountManager = mock(AccountManager.class);
+
+    @Before
+    public void setUp() {
+        interceptor.accountManager = accountManager;
+        CallContext.unregisterAll();
+    }
+
+    @After
+    public void tearDown() {
+        CallContext.unregisterAll();
+    }
+
+    @Test
+    public void testInvokePassesThroughWhenTargetIsNull() throws Throwable {
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        when(invocation.getThis()).thenReturn(null);
+        when(invocation.proceed()).thenReturn("ok");
+
+        final Object result = interceptor.invoke(invocation);
+
+        assertEquals("ok", result);
+        verify(invocation).proceed();
+        verifyNoInteractions(accountManager);
+    }
+
+    @Test
+    public void testInvokePassesThroughWhenMethodHasNoApiAccessAnnotation() throws Throwable {
+        final TestServerAdapter adapter = new TestServerAdapter(serviceUserAccount());
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        when(invocation.getThis()).thenReturn(adapter);
+        when(invocation.getMethod()).thenReturn(TestServerAdapter.class.getMethod("noApiAccess"));
+        when(invocation.proceed()).thenReturn("done");
+
+        final Object result = interceptor.invoke(invocation);
+
+        assertEquals("done", result);
+        verify(invocation).proceed();
+        verifyNoInteractions(accountManager);
+    }
+
+    @Test
+    public void testInvokeChecksApiAccessForDirectlyAnnotatedMethodAndRestoresCallContext() throws Throwable {
+        registerBaseContext();
+
+        final TestServerAdapter adapter = new TestServerAdapter(serviceUserAccount());
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        when(invocation.getThis()).thenReturn(adapter);
+        when(invocation.getMethod()).thenReturn(TestServerAdapter.class.getMethod("classAnnotated"));
+        when(invocation.proceed()).thenAnswer(i -> {
+            assertEquals(SERVICE_USER_ID, CallContext.current().getCallingUserId());
+            assertEquals(SERVICE_ACCOUNT_ID, CallContext.current().getCallingAccountId());
+            return "secured";
+        });
+
+        final Object result = interceptor.invoke(invocation);
+
+        assertEquals("secured", result);
+        verify(accountManager).checkApiAccess(adapter.getServiceAccount().second(),
+                BaseCmd.getCommandNameByClass(ListZonesCmd.class));
+        assertEquals(BASE_USER_ID, CallContext.current().getCallingUserId());
+        assertEquals(BASE_ACCOUNT_ID, CallContext.current().getCallingAccountId());
+    }
+
+    @Test
+    public void testInvokeFindsAnnotationOnImplementationWhenInterfaceMethodIsUnannotated() throws Throwable {
+        registerBaseContext();
+
+        final TestServerAdapter adapter = new TestServerAdapter(serviceUserAccount());
+        final Method interfaceMethod = ApiContract.class.getMethod("implAnnotatedThroughInterface");
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        when(invocation.getThis()).thenReturn(adapter);
+        when(invocation.getMethod()).thenReturn(interfaceMethod);
+        when(invocation.proceed()).thenReturn("ok");
+
+        final Object result = interceptor.invoke(invocation);
+
+        assertEquals("ok", result);
+        verify(accountManager).checkApiAccess(adapter.getServiceAccount().second(),
+                BaseCmd.getCommandNameByClass(ListZonesCmd.class));
+        assertEquals(BASE_USER_ID, CallContext.current().getCallingUserId());
+        assertEquals(BASE_ACCOUNT_ID, CallContext.current().getCallingAccountId());
+    }
+
+    @Test
+    public void testInvokeUnregistersServiceContextWhenProceedThrows() throws Throwable {
+        registerBaseContext();
+
+        final TestServerAdapter adapter = new TestServerAdapter(serviceUserAccount());
+        final MethodInvocation invocation = mock(MethodInvocation.class);
+        final RuntimeException expected = new RuntimeException("boom");
+        when(invocation.getThis()).thenReturn(adapter);
+        when(invocation.getMethod()).thenReturn(TestServerAdapter.class.getMethod("classAnnotated"));
+        when(invocation.proceed()).thenThrow(expected);
+
+        try {
+            interceptor.invoke(invocation);
+        } catch (RuntimeException e) {
+            assertSame(expected, e);
+        }
+
+        verify(accountManager).checkApiAccess(adapter.getServiceAccount().second(),
+                BaseCmd.getCommandNameByClass(ListZonesCmd.class));
+        assertEquals(BASE_USER_ID, CallContext.current().getCallingUserId());
+        assertEquals(BASE_ACCOUNT_ID, CallContext.current().getCallingAccountId());
+    }
+
+    private static void registerBaseContext() {
+        final User baseUser = mock(User.class);
+        final Account baseAccount = mock(Account.class);
+        when(baseUser.getId()).thenReturn(BASE_USER_ID);
+        when(baseAccount.getId()).thenReturn(BASE_ACCOUNT_ID);
+        CallContext.register(baseUser, baseAccount);
+    }
+
+    private static Pair<User, Account> serviceUserAccount() {
+        final User serviceUser = mock(User.class);
+        final Account serviceAccount = mock(Account.class);
+        when(serviceUser.getId()).thenReturn(SERVICE_USER_ID);
+        when(serviceAccount.getId()).thenReturn(SERVICE_ACCOUNT_ID);
+        return new Pair<>(serviceUser, serviceAccount);
+    }
+
+    private interface ApiContract {
+        String implAnnotatedThroughInterface();
+    }
+
+    private static class TestServerAdapter extends ServerAdapter implements ApiContract {
+        private final Pair<User, Account> serviceAccount;
+
+        private TestServerAdapter(final Pair<User, Account> serviceAccount) {
+            this.serviceAccount = serviceAccount;
+        }
+
+        @Override
+        public Pair<User, Account> getServiceAccount() {
+            return serviceAccount;
+        }
+
+        @ApiAccess(command = ListZonesCmd.class)
+        public String classAnnotated() {
+            return "classAnnotated";
+        }
+
+        @Override
+        @ApiAccess(command = ListZonesCmd.class)
+        public String implAnnotatedThroughInterface() {
+            return "implAnnotatedThroughInterface";
+        }
+
+        public String noApiAccess() {
+            return "noApiAccess";
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java
new file mode 100644
index 000000000000..f3f1f45584f4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/adapter/ServerAdapterTest.java
@@ -0,0 +1,1140 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.adapter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.anyList;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doNothing;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.spy;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.backup.KVMBackupExportService;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.ImageTransferDao;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.jobs.dao.AsyncJobDao;
+import org.apache.cloudstack.framework.jobs.impl.AsyncJobVO;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.OvfXmlUtil;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.logging.log4j.Logger;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.api.query.dao.AsyncJobJoinDao;
+import com.cloud.api.query.dao.DataCenterJoinDao;
+import com.cloud.api.query.dao.HostJoinDao;
+import com.cloud.api.query.dao.StoragePoolJoinDao;
+import com.cloud.api.query.dao.UserVmJoinDao;
+import com.cloud.api.query.dao.VolumeJoinDao;
+import com.cloud.api.query.vo.AsyncJobJoinVO;
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.dc.DataCenterVO;
+import com.cloud.dc.dao.ClusterDao;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.domain.dao.DomainDao;
+import com.cloud.exception.InvalidParameterValueException;
+import com.cloud.exception.PermissionDeniedException;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.network.NetworkModel;
+import com.cloud.network.Networks;
+import com.cloud.network.dao.NetworkDao;
+import com.cloud.network.dao.NetworkVO;
+import com.cloud.projects.Project;
+import com.cloud.projects.ProjectManager;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.service.dao.ServiceOfferingDao;
+import com.cloud.storage.Storage;
+import com.cloud.storage.VMTemplateVO;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.VMTemplateDao;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+import com.cloud.utils.Ternary;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.NicVO;
+import com.cloud.vm.UserVmManager;
+import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.NicDao;
+import com.cloud.vm.dao.UserVmDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+import com.cloud.vm.snapshot.dao.VMSnapshotDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class ServerAdapterTest {
+
+    @InjectMocks
+    ServerAdapter serverAdapter;
+
+    @Mock AccountService accountService;
+    @Mock DataCenterDao dataCenterDao;
+    @Mock DataCenterJoinDao dataCenterJoinDao;
+    @Mock StoragePoolJoinDao storagePoolJoinDao;
+    @Mock ClusterDao clusterDao;
+    @Mock HostJoinDao hostJoinDao;
+    @Mock NetworkDao networkDao;
+    @Mock UserVmDao userVmDao;
+    @Mock UserVmJoinDao userVmJoinDao;
+    @Mock VMInstanceDetailsDao vmInstanceDetailsDao;
+    @Mock VolumeDao volumeDao;
+    @Mock VolumeJoinDao volumeJoinDao;
+    // kept minimal: only mocks used directly by tests
+    @Mock com.cloud.storage.VolumeApiService volumeApiService;
+    @Mock PrimaryDataStoreDao primaryDataStoreDao;
+    @Mock ImageTransferDao imageTransferDao;
+    @Mock ServiceOfferingDao serviceOfferingDao;
+    @Mock VMTemplateDao templateDao;
+    @Mock UserVmManager userVmManager;
+    @Mock NicDao nicDao;
+    @Mock AsyncJobDao asyncJobDao;
+    @Mock AsyncJobJoinDao asyncJobJoinDao;
+    @Mock VMSnapshotDao vmSnapshotDao;
+    @Mock BackupDao backupDao;
+    @Mock NetworkModel networkModel;
+    @Mock ProjectManager projectManager;
+    @Mock DomainDao domainDao;
+    @Mock
+    KVMBackupExportService kvmBackupExportService;
+
+    @Before
+    public void setupCallContext() {
+        CallContext.register(Mockito.mock(User.class), Mockito.mock(Account.class));
+    }
+
+    @After
+    public void cleanupCallContext() {
+        CallContext.unregister();
+    }
+
+
+
+    @Test
+    public void testGetProvisionedSizeInGb_ExactlyOneGB() {
+        long gb = 1024L * 1024L * 1024L;
+        assertEquals(1L, ServerAdapter.getProvisionedSizeInGb(String.valueOf(gb)));
+    }
+
+    @Test
+    public void testGetProvisionedSizeInGb_MultipleGB() {
+        long gb = 1024L * 1024L * 1024L;
+        assertEquals(5L, ServerAdapter.getProvisionedSizeInGb(String.valueOf(5 * gb)));
+    }
+
+    @Test
+    public void testGetProvisionedSizeInGb_LessThanOneGB_RoundsUpToOne() {
+        assertEquals(1L, ServerAdapter.getProvisionedSizeInGb("512"));
+    }
+
+    @Test
+    public void testGetProvisionedSizeInGb_NotExactGB_RoundsUp() {
+        long gb = 1024L * 1024L * 1024L;
+        assertEquals(2L, ServerAdapter.getProvisionedSizeInGb(String.valueOf(gb + gb / 2)));
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetProvisionedSizeInGb_InvalidString_Throws() {
+        ServerAdapter.getProvisionedSizeInGb("not-a-number");
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetProvisionedSizeInGb_Zero_Throws() {
+        ServerAdapter.getProvisionedSizeInGb("0");
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetProvisionedSizeInGb_Negative_Throws() {
+        ServerAdapter.getProvisionedSizeInGb("-1073741824");
+    }
+
+
+    @Test
+    public void testGetDetailsForInstanceCreation_WorkerVm_AddsCpuMode() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(false);
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(true);
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, null);
+
+        assertEquals("host-passthrough", result.get(VmDetailConstants.GUEST_CPU_MODE));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_NotWorkerVm_NoCpuMode() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(false);
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, null);
+
+        assertFalse(result.containsKey(VmDetailConstants.GUEST_CPU_MODE));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_CustomizedOffering_AddsDetails() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(true);
+        when(offering.getCpu()).thenReturn(4);
+        when(offering.getRamSize()).thenReturn(2048);
+        when(offering.getSpeed()).thenReturn(null);
+
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, null);
+
+        assertEquals("4", result.get(VmDetailConstants.CPU_NUMBER));
+        assertEquals("2048", result.get(VmDetailConstants.MEMORY));
+        assertEquals("1000", result.get(VmDetailConstants.CPU_SPEED));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_CustomizedOffering_WithSpeed_DoesNotAddDefaultCpuSpeed() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(true);
+        when(offering.getCpu()).thenReturn(2);
+        when(offering.getRamSize()).thenReturn(1024);
+        when(offering.getSpeed()).thenReturn(2000);
+
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, null);
+
+        assertFalse(result.containsKey(VmDetailConstants.CPU_SPEED));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_SkipsBiosAndUefiKeys() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(false);
+
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> existingDetails = new HashMap<>();
+        existingDetails.put("BIOS", "bios_value");
+        existingDetails.put("UEFI", "uefi_value");
+        existingDetails.put("custom_key", "custom_value");
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, existingDetails);
+
+        assertFalse(result.containsKey("BIOS"));
+        assertFalse(result.containsKey("UEFI"));
+        assertEquals("custom_value", result.get("custom_key"));
+    }
+
+    @Test
+    public void testGetDetailsForInstanceCreation_PreservesExistingCpuSpeed() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        when(offering.isCustomized()).thenReturn(true);
+        when(offering.getCpu()).thenReturn(2);
+        when(offering.getRamSize()).thenReturn(1024);
+        when(offering.getSpeed()).thenReturn(null);
+
+        Vm request = mock(Vm.class);
+        when(request.isWorkerVm()).thenReturn(false);
+
+        Map<String, String> existingDetails = new HashMap<>();
+        existingDetails.put(VmDetailConstants.CPU_SPEED, "3000");
+
+        Map<String, String> result = ServerAdapter.getDetailsForInstanceCreation(request, offering, existingDetails);
+
+        assertEquals("3000", result.get(VmDetailConstants.CPU_SPEED));
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_NullVm_ReturnsNullPair() {
+        NetworkVO network = mock(NetworkVO.class);
+
+        Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails(null, network);
+
+        assertNull(result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_NullNetwork_ReturnsNullPair() {
+        Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("config", null);
+
+        assertNull(result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_NoRestoreConfig_ReturnsNullPair() {
+        NetworkVO network = mock(NetworkVO.class);
+
+        Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails(null, network);
+
+        assertNull(result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_BlankRestoreConfig_ReturnsNullPair() {
+        NetworkVO network = mock(NetworkVO.class);
+
+        Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("   ", network);
+
+        assertNull(result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_BlankMacAndIpFromConfig_ReturnsNullPair() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("  ", "\t"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertNull(result.first());
+            assertNull(result.second());
+        }
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_NoConflicts_ReturnsMacAndIp() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getId()).thenReturn(30L);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        when(nicDao.findByNetworkIdAndMacAddress(30L, "02:00:00:00:00:01")).thenReturn(null);
+        when(nicDao.findNonPlaceHolderByIp4AddressAndNetworkId("10.0.0.10", 30L)).thenReturn(null);
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("02:00:00:00:00:01", "10.0.0.10"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertEquals("02:00:00:00:00:01", result.first());
+            assertEquals("10.0.0.10", result.second());
+        }
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_MacConflictWithSameIp_ClearsBoth() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getId()).thenReturn(31L);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        NicVO conflictingNic = mock(NicVO.class);
+        when(conflictingNic.getIPv4Address()).thenReturn("10.0.0.11");
+        when(nicDao.findByNetworkIdAndMacAddress(31L, "02:00:00:00:00:02")).thenReturn(conflictingNic);
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("02:00:00:00:00:02", "10.0.0.11"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertNull(result.first());
+            assertNull(result.second());
+        }
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_MacConflictWithDifferentIp_ClearsOnlyMac() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getId()).thenReturn(32L);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        NicVO conflictingNic = mock(NicVO.class);
+        when(conflictingNic.getIPv4Address()).thenReturn("10.0.0.99");
+        when(nicDao.findByNetworkIdAndMacAddress(32L, "02:00:00:00:00:03")).thenReturn(conflictingNic);
+        when(nicDao.findNonPlaceHolderByIp4AddressAndNetworkId("10.0.0.12", 32L)).thenReturn(null);
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("02:00:00:00:00:03", "10.0.0.12"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertNull(result.first());
+            assertEquals("10.0.0.12", result.second());
+        }
+    }
+
+    @Test
+    public void testGetValidatedInstanceNicDetails_IpConflict_ClearsIpAndMac() {
+        NetworkVO network = mock(NetworkVO.class);
+        when(network.getId()).thenReturn(33L);
+        when(network.getUuid()).thenReturn("network-uuid");
+
+        when(nicDao.findByNetworkIdAndMacAddress(33L, "02:00:00:00:00:04")).thenReturn(null);
+        NicVO conflictingIpNic = mock(NicVO.class);
+        when(conflictingIpNic.getIPv4Address()).thenReturn("10.0.0.13");
+        when(nicDao.findNonPlaceHolderByIp4AddressAndNetworkId("10.0.0.13", 33L)).thenReturn(conflictingIpNic);
+
+        try (MockedStatic<OvfXmlUtil> ovfXmlUtil = Mockito.mockStatic(OvfXmlUtil.class)) {
+            ovfXmlUtil.when(() -> OvfXmlUtil.getVmNicDetailFromStoredConfig(eq("restore-xml"), eq("network-uuid"), any(Logger.class)))
+                    .thenReturn(new Pair<>("02:00:00:00:00:04", "10.0.0.13"));
+
+            Pair<String, String> result = serverAdapter.getValidatedInstanceNicDetails("restore-xml", network);
+
+            assertNull(result.first());
+            assertNull(result.second());
+        }
+    }
+
+
+    @Test
+    public void testGetDummyTags_ContainsRootTag() {
+        Map<String, Tag> tags = ServerAdapter.getDummyTags();
+        assertNotNull(tags);
+        assertFalse(tags.isEmpty());
+    }
+
+
+    @Test
+    public void testGetTemplateForInstanceCreation_NullUuid_ReturnsNull() {
+        assertNull(serverAdapter.getTemplateForInstanceCreation(null, null));
+    }
+
+    @Test
+    public void testGetTemplateForInstanceCreation_BlankUuid_ReturnsNull() {
+        assertNull(serverAdapter.getTemplateForInstanceCreation("   ", null));
+    }
+
+    @Test
+    public void testGetTemplateForInstanceCreation_TemplateNotFound_ReturnsNull() {
+        when(templateDao.findByUuid("missing-uuid")).thenReturn(null);
+        assertNull(serverAdapter.getTemplateForInstanceCreation("missing-uuid", null));
+    }
+
+    @Test
+    public void testGetTemplateForInstanceCreation_TemplateFound_ReturnsTemplate() {
+        VMTemplateVO template = mock(VMTemplateVO.class);
+        when(templateDao.findByUuid("valid-uuid")).thenReturn(template);
+        assertEquals(template, serverAdapter.getTemplateForInstanceCreation("valid-uuid", null));
+    }
+
+
+    @Test
+    public void testGetZoneById_NullId_ReturnsNull() {
+        assertNull(serverAdapter.getZoneById(null));
+    }
+
+    @Test
+    public void testGetZoneById_ReturnsVoFromDao() {
+        DataCenterJoinVO vo = mock(DataCenterJoinVO.class);
+        when(dataCenterJoinDao.findById(1L)).thenReturn(vo);
+        assertEquals(vo, serverAdapter.getZoneById(1L));
+    }
+
+    @Test
+    public void testGetHostById_NullId_ReturnsNull() {
+        assertNull(serverAdapter.getHostById(null));
+    }
+
+    @Test
+    public void testGetHostById_ReturnsVoFromDao() {
+        HostJoinVO vo = mock(HostJoinVO.class);
+        when(hostJoinDao.findById(2L)).thenReturn(vo);
+        assertEquals(vo, serverAdapter.getHostById(2L));
+    }
+
+    @Test
+    public void testGetVolumeById_NullId_ReturnsNull() {
+        assertNull(serverAdapter.getVolumeById(null));
+    }
+
+    @Test
+    public void testGetVolumeById_ReturnsVoFromDao() {
+        VolumeJoinVO vo = mock(VolumeJoinVO.class);
+        when(volumeJoinDao.findById(3L)).thenReturn(vo);
+        assertEquals(vo, serverAdapter.getVolumeById(3L));
+    }
+
+    @Test
+    public void testGetNetworkById_NullId_ReturnsNull() {
+        assertNull(serverAdapter.getNetworkById(null));
+    }
+
+    @Test
+    public void testGetNetworkById_ReturnsVoFromDao() {
+        NetworkVO vo = mock(NetworkVO.class);
+        when(networkDao.findById(4L)).thenReturn(vo);
+        assertEquals(vo, serverAdapter.getNetworkById(4L));
+    }
+
+
+    @Test
+    public void testWaitForJobCompletion_JobNotFound_Returns() {
+        when(asyncJobDao.findByIdIncludingRemoved(99L)).thenReturn(null);
+        serverAdapter.waitForJobCompletion(99L);
+        verify(asyncJobDao).findByIdIncludingRemoved(99L);
+    }
+
+    @Test
+    public void testWaitForJobCompletion_JobAlreadySucceeded_Returns() {
+        AsyncJobVO job = mock(AsyncJobVO.class);
+        when(job.getStatus()).thenReturn(AsyncJobVO.Status.SUCCEEDED);
+        when(asyncJobDao.findByIdIncludingRemoved(1L)).thenReturn(job);
+        serverAdapter.waitForJobCompletion(1L);
+    }
+
+    @Test
+    public void testWaitForJobCompletion_JobAlreadyFailed_Returns() {
+        AsyncJobVO job = mock(AsyncJobVO.class);
+        when(job.getStatus()).thenReturn(AsyncJobVO.Status.FAILED);
+        when(asyncJobDao.findByIdIncludingRemoved(2L)).thenReturn(job);
+        serverAdapter.waitForJobCompletion(2L);
+    }
+
+
+    @Test
+    public void testWaitForJobCompletion_NullJobJoinVO_Returns() {
+        AsyncJobJoinVO job = null;
+        serverAdapter.waitForJobCompletion(job);
+    }
+
+    @Test
+    public void testWaitForJobCompletion_CompletedJobJoinVO_DelegatesById() {
+        AsyncJobJoinVO jobVO = mock(AsyncJobJoinVO.class);
+        when(jobVO.getStatus()).thenReturn(AsyncJobVO.Status.SUCCEEDED.ordinal());
+        when(jobVO.getId()).thenReturn(5L);
+
+        AsyncJobVO job = mock(AsyncJobVO.class);
+        when(job.getStatus()).thenReturn(AsyncJobVO.Status.SUCCEEDED);
+        when(asyncJobDao.findByIdIncludingRemoved(5L)).thenReturn(job);
+
+        serverAdapter.waitForJobCompletion(jobVO);
+
+        verify(asyncJobDao).findByIdIncludingRemoved(5L);
+    }
+
+
+    @Test
+    public void testGetOwnerDetailsForInstanceCreation_NullAccount_ReturnsAllNulls() {
+        Ternary<Long, String, Long> result = serverAdapter.getOwnerDetailsForInstanceCreation(null);
+        assertNull(result.first());
+        assertNull(result.second());
+        assertNull(result.third());
+    }
+
+    @Test
+    public void testGetOwnerDetailsForInstanceCreation_NormalAccount_ReturnsDomainAndName() {
+        Account account = mock(Account.class);
+        when(account.getType()).thenReturn(Account.Type.NORMAL);
+        when(account.getDomainId()).thenReturn(2L);
+        when(account.getAccountName()).thenReturn("myaccount");
+
+        Ternary<Long, String, Long> result = serverAdapter.getOwnerDetailsForInstanceCreation(account);
+
+        assertEquals(Long.valueOf(2L), result.first());
+        assertEquals("myaccount", result.second());
+        assertNull(result.third());
+    }
+
+    @Test
+    public void testGetOwnerDetailsForInstanceCreation_ProjectAccount_ProjectNotFound_ReturnsAllNulls() {
+        Account account = mock(Account.class);
+        when(account.getType()).thenReturn(Account.Type.PROJECT);
+        when(account.getId()).thenReturn(10L);
+        when(projectManager.findByProjectAccountId(10L)).thenReturn(null);
+
+        Ternary<Long, String, Long> result = serverAdapter.getOwnerDetailsForInstanceCreation(account);
+
+        assertNull(result.first());
+        assertNull(result.second());
+        assertNull(result.third());
+    }
+
+    @Test
+    public void testGetOwnerDetailsForInstanceCreation_ProjectAccount_ProjectFound_ReturnsProjectId() {
+        Account account = mock(Account.class);
+        when(account.getType()).thenReturn(Account.Type.PROJECT);
+        when(account.getId()).thenReturn(10L);
+        when(account.getDomainId()).thenReturn(1L);
+
+        Project project = mock(Project.class);
+        when(project.getId()).thenReturn(5L);
+        when(projectManager.findByProjectAccountId(10L)).thenReturn(project);
+
+        Ternary<Long, String, Long> result = serverAdapter.getOwnerDetailsForInstanceCreation(account);
+
+        assertEquals(Long.valueOf(1L), result.first());
+        assertNull(result.second());
+        assertEquals(Long.valueOf(5L), result.third());
+    }
+
+
+    @Test
+    public void testGetServiceOfferingFromRequest_BlankUuid_ReturnsNull() {
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, null, "", 2, 1024));
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, null, null, 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_OfferingNotFound_ReturnsNull() {
+        when(serviceOfferingDao.findByUuid("uuid1")).thenReturn(null);
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, null, "uuid1", 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_AccessDenied_ReturnsNull() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid2")).thenReturn(offering);
+        doThrow(new PermissionDeniedException("denied"))
+                .when(accountService).checkAccess(eq(account), eq(offering), any());
+
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, account, "uuid2", 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_NotCustomized_CpuMemoryMismatch_ReturnsNull() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid3")).thenReturn(offering);
+        doNothing().when(accountService).checkAccess(eq(account), eq(offering), any());
+        when(offering.isCustomized()).thenReturn(false);
+        when(offering.getCpu()).thenReturn(4);
+
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, account, "uuid3", 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_NotCustomized_CpuMemoryMatch_ReturnsOffering() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid4")).thenReturn(offering);
+        doNothing().when(accountService).checkAccess(eq(account), eq(offering), any());
+        when(offering.isCustomized()).thenReturn(false);
+        when(offering.getCpu()).thenReturn(2);
+        when(offering.getRamSize()).thenReturn(1024);
+        DataCenterVO zone = mock(DataCenterVO.class);
+
+        assertEquals(offering, serverAdapter.getServiceOfferingFromRequest(zone, account, "uuid4", 2, 1024));
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_Customized_ValidParams_SetsAndReturnsOffering() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid5")).thenReturn(offering);
+        doNothing().when(accountService).checkAccess(eq(account), eq(offering), any());
+        when(offering.isCustomized()).thenReturn(true);
+        doNothing().when(userVmManager).validateCustomParameters(eq(offering), any());
+        DataCenterVO zone = mock(DataCenterVO.class);
+
+        ServiceOfferingVO result = serverAdapter.getServiceOfferingFromRequest(zone, account, "uuid5", 2, 1024);
+
+        assertEquals(offering, result);
+        verify(offering).setCpu(2);
+        verify(offering).setRamSize(1024);
+    }
+
+    @Test
+    public void testGetServiceOfferingFromRequest_Customized_InvalidParams_ReturnsNull() {
+        ServiceOfferingVO offering = mock(ServiceOfferingVO.class);
+        Account account = mock(Account.class);
+        when(serviceOfferingDao.findByUuid("uuid6")).thenReturn(offering);
+        doNothing().when(accountService).checkAccess(eq(account), eq(offering), any());
+        when(offering.isCustomized()).thenReturn(true);
+        doThrow(new InvalidParameterValueException("invalid"))
+                .when(userVmManager).validateCustomParameters(eq(offering), any());
+
+        assertNull(serverAdapter.getServiceOfferingFromRequest(null, account, "uuid6", 2, 1024));
+    }
+
+
+    @Test
+    public void testAccountCannotAccessNetwork_CanAccess_ReturnsFalse() {
+        NetworkVO network = mock(NetworkVO.class);
+        Account account = mock(Account.class);
+        when(accountService.getActiveAccountById(1L)).thenReturn(account);
+        doNothing().when(networkModel).checkNetworkPermissions(account, network);
+
+        assertFalse(serverAdapter.accountCannotAccessNetwork(network, 1L));
+    }
+
+    @Test
+    public void testAccountCannotAccessNetwork_CannotAccess_ReturnsTrue() {
+        NetworkVO network = mock(NetworkVO.class);
+        Account account = mock(Account.class);
+        when(accountService.getActiveAccountById(1L)).thenReturn(account);
+        doThrow(new CloudRuntimeException("Access denied"))
+                .when(networkModel).checkNetworkPermissions(account, network);
+
+        assertTrue(serverAdapter.accountCannotAccessNetwork(network, 1L));
+    }
+
+
+    @Test
+    public void testValidateInstanceStorage_SupportedStorageType_NoException() {
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getId()).thenReturn(1L);
+        VolumeVO vol = mock(VolumeVO.class);
+        when(vol.getPoolId()).thenReturn(10L);
+        when(volumeDao.findUsableVolumesForInstance(1L)).thenReturn(List.of(vol));
+        StoragePoolVO pool = mock(StoragePoolVO.class);
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+        when(primaryDataStoreDao.listByIds(anyList())).thenReturn(List.of(pool));
+
+        serverAdapter.validateInstanceStorage(vm);
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testValidateInstanceStorage_UnsupportedStorageType_Throws() {
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getId()).thenReturn(2L);
+        VolumeVO vol = mock(VolumeVO.class);
+        when(vol.getPoolId()).thenReturn(20L);
+        when(volumeDao.findUsableVolumesForInstance(2L)).thenReturn(List.of(vol));
+        StoragePoolVO pool = mock(StoragePoolVO.class);
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.RBD);
+        when(pool.getName()).thenReturn("ceph-pool");
+        when(primaryDataStoreDao.listByIds(anyList())).thenReturn(List.of(pool));
+
+        serverAdapter.validateInstanceStorage(vm);
+    }
+
+    @Test
+    public void testValidateInstanceStorage_NoVolumes_NoException() {
+        UserVmVO vm = mock(UserVmVO.class);
+        when(vm.getId()).thenReturn(3L);
+        when(volumeDao.findUsableVolumesForInstance(3L)).thenReturn(Collections.emptyList());
+        when(primaryDataStoreDao.listByIds(anyList())).thenReturn(Collections.emptyList());
+
+        serverAdapter.validateInstanceStorage(vm);
+    }
+
+
+    @Test
+    public void testGetBackupDisks_NullVolumeInfos_ReturnsEmptyList() {
+        BackupVO backup = mock(BackupVO.class);
+        when(backup.getBackedUpVolumes()).thenReturn(null);
+
+        assertTrue(serverAdapter.getBackupDisks(backup).isEmpty());
+    }
+
+    @Test
+    public void testGetBackupDisks_EmptyVolumeInfos_ReturnsEmptyList() {
+        BackupVO backup = mock(BackupVO.class);
+        when(backup.getBackedUpVolumes()).thenReturn(Collections.emptyList());
+
+        assertTrue(serverAdapter.getBackupDisks(backup).isEmpty());
+    }
+
+
+    @Test
+    public void testGetResourceOwnerFiltersWithDomainIds_NullDomainPath_ReturnsNullDomainIds() {
+        ServerAdapter spyAdapter = spy(serverAdapter);
+        doReturn(new Pair<>(List.of(1L, 2L), (String) null)).when(spyAdapter).getResourceOwnerFilters();
+
+        Pair<List<Long>, List<Long>> result = spyAdapter.getResourceOwnerFiltersWithDomainIds();
+
+        assertEquals(List.of(1L, 2L), result.first());
+        assertNull(result.second());
+    }
+
+    @Test
+    public void testGetResourceOwnerFiltersWithDomainIds_WithDomainPath_ReturnsDomainIds() {
+        ServerAdapter spyAdapter = spy(serverAdapter);
+        doReturn(new Pair<>(List.of(1L), "ROOT/subdomain")).when(spyAdapter).getResourceOwnerFilters();
+        when(domainDao.getDomainChildrenIds("ROOT/subdomain")).thenReturn(List.of(10L, 11L));
+
+        Pair<List<Long>, List<Long>> result = spyAdapter.getResourceOwnerFiltersWithDomainIds();
+
+        assertEquals(List.of(10L, 11L), result.second());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetDataCenter_NotFound_Throws() {
+        when(dataCenterJoinDao.findByUuid("dc-uuid")).thenReturn(null);
+        serverAdapter.getDataCenter("dc-uuid");
+    }
+
+    @Test
+    public void testGetDataCenter_Found_ReturnsDataCenter() {
+        DataCenterJoinVO vo = mock(DataCenterJoinVO.class);
+        when(dataCenterJoinDao.findByUuid("dc-uuid")).thenReturn(vo);
+
+        DataCenter result = serverAdapter.getDataCenter("dc-uuid");
+
+        assertNotNull(result);
+    }
+
+
+    @Test
+    public void testListAllDataCenters_ReturnsConvertedList() {
+        DataCenterJoinVO vo = mock(DataCenterJoinVO.class);
+        when(dataCenterJoinDao.listByIds(anyList(), any())).thenReturn(List.of(vo));
+
+        List<DataCenter> result = serverAdapter.listAllDataCenters(0L, 10L);
+
+        assertNotNull(result);
+        assertEquals(1, result.size());
+    }
+
+    @Test
+    public void testListAllDataCenters_EmptyList_ReturnsEmpty() {
+        when(dataCenterJoinDao.listByIds(anyList(), any())).thenReturn(Collections.emptyList());
+
+        assertTrue(serverAdapter.listAllDataCenters(0L, 10L).isEmpty());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListStorageDomainsByDcId_DataCenterNotFound_Throws() {
+        when(dataCenterDao.findByUuid("dc-uuid")).thenReturn(null);
+        serverAdapter.listStorageDomainsByDcId("dc-uuid", 0L, 10L);
+    }
+
+    @Test
+    public void testListStorageDomainsByDcId_Found_ReturnsList() {
+        DataCenterVO dcVO = mock(DataCenterVO.class);
+        when(dcVO.getId()).thenReturn(1L);
+        when(dataCenterDao.findByUuid("dc-uuid")).thenReturn(dcVO);
+        StoragePoolJoinVO poolVO = mock(StoragePoolJoinVO.class);
+        when(storagePoolJoinDao.listAvailableByZoneHypervisorAndType(eq(1L), eq(Hypervisor.HypervisorType.KVM), any(), any())).thenReturn(List.of(poolVO));
+
+        assertNotNull(serverAdapter.listStorageDomainsByDcId("dc-uuid", 0L, 10L));
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListNetworksByDcId_DataCenterNotFound_Throws() {
+        when(dataCenterJoinDao.findByUuid("dc-uuid")).thenReturn(null);
+        serverAdapter.listNetworksByDcId("dc-uuid", 0L, 10L);
+    }
+
+    @Test
+    public void testListNetworksByDcId_Found_ReturnsEmptyListWhenNoNetworks() {
+        DataCenterJoinVO dcVO = mock(DataCenterJoinVO.class);
+        when(dcVO.getId()).thenReturn(1L);
+        when(dataCenterJoinDao.findByUuid("dc-uuid")).thenReturn(dcVO);
+        when(networkDao.listByZoneAndTrafficType(eq(1L), eq(Networks.TrafficType.Guest), any()))
+                .thenReturn(Collections.emptyList());
+        assertTrue(serverAdapter.listNetworksByDcId("dc-uuid", 0L, 10L).isEmpty());
+    }
+
+
+    @Test
+    public void testListAllClusters_ReturnsEmptyListWhenNoClusters() {
+        when(clusterDao.listByZonesAndHypervisorType(anyList(), any(), any())).thenReturn(Collections.emptyList());
+        assertTrue(serverAdapter.listAllClusters(0L, 10L).isEmpty());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetCluster_NotFound_Throws() {
+        when(clusterDao.findByUuid("cl-uuid")).thenReturn(null);
+        serverAdapter.getCluster("cl-uuid");
+    }
+
+
+    @Test
+    public void testListAllHosts_ReturnsList() {
+        HostJoinVO hostVO = mock(HostJoinVO.class);
+        when(hostJoinDao.listAvailableRoutingByZonesAndHypervisor(anyList(), any(), any())).thenReturn(List.of(hostVO));
+
+        assertEquals(1, serverAdapter.listAllHosts(0L, 10L).size());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetHost_NotFound_Throws() {
+        when(hostJoinDao.findByUuid("host-uuid")).thenReturn(null);
+        serverAdapter.getHost("host-uuid");
+    }
+
+    @Test
+    public void testGetHost_Found_ReturnsHost() {
+        HostJoinVO vo = mock(HostJoinVO.class);
+        when(hostJoinDao.findByUuid("host-uuid")).thenReturn(vo);
+
+        assertNotNull(serverAdapter.getHost("host-uuid"));
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetVnicProfile_NotFound_Throws() {
+        when(networkDao.findByUuid("net-uuid")).thenReturn(null);
+        serverAdapter.getVnicProfile("net-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetInstance_NotFound_Throws() {
+        when(userVmJoinDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.getInstance("vm-uuid", false, false, false, false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteInstance_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.deleteInstance("vm-uuid", true, false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testStartInstance_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.startInstance("vm-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testStopInstance_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.stopInstance("vm-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testShutdownInstance_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.shutdownInstance("vm-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetDisk_NotFound_Throws() {
+        when(volumeDao.findByUuid("vol-uuid")).thenReturn(null);
+        serverAdapter.getDisk("vol-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteDisk_NotFound_Throws() {
+        when(volumeDao.findByUuid("vol-uuid")).thenReturn(null);
+        serverAdapter.deleteDisk("vol-uuid");
+    }
+
+    @Test
+    public void testDeleteDisk_Found_DeletesVolume() {
+        VolumeVO vo = mock(VolumeVO.class);
+        when(vo.getId()).thenReturn(10L);
+        when(volumeDao.findByUuid("vol-uuid")).thenReturn(vo);
+        Account account = CallContext.current().getCallingAccount();
+
+        serverAdapter.deleteDisk("vol-uuid");
+
+        verify(volumeApiService).destroyVolume(10L, account, true, false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testCopyDisk_AlwaysThrows() {
+        serverAdapter.copyDisk("any-uuid");
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testReduceDisk_AlwaysThrows() {
+        serverAdapter.reduceDisk("any-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListNicsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listNicsByInstanceUuid("vm-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListDiskAttachmentsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listDiskAttachmentsByInstanceUuid("vm-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListSnapshotsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listSnapshotsByInstanceUuid("vm-uuid");
+    }
+
+    @Test
+    public void testListSnapshotsByInstanceUuid_Found_ReturnsEmptyList() {
+        UserVmVO vmVO = mock(UserVmVO.class);
+        when(vmVO.getId()).thenReturn(1L);
+        when(vmVO.getUuid()).thenReturn("vm-uuid");
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(vmVO);
+        when(vmSnapshotDao.findByVm(1L)).thenReturn(Collections.emptyList());
+
+        assertTrue(serverAdapter.listSnapshotsByInstanceUuid("vm-uuid").isEmpty());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetSnapshot_NotFound_Throws() {
+        when(vmSnapshotDao.findByUuid("snap-uuid")).thenReturn(null);
+        serverAdapter.getSnapshot("snap-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteSnapshot_NotFound_Throws() {
+        when(vmSnapshotDao.findByUuid("snap-uuid")).thenReturn(null);
+        serverAdapter.deleteSnapshot("snap-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testRevertInstanceToSnapshot_NotFound_Throws() {
+        when(vmSnapshotDao.findByUuid("snap-uuid")).thenReturn(null);
+        serverAdapter.revertInstanceToSnapshot("snap-uuid", false);
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListBackupsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listBackupsByInstanceUuid("vm-uuid");
+    }
+
+    @Test
+    public void testListBackupsByInstanceUuid_Found_ReturnsEmptyList() {
+        UserVmVO vmVO = mock(UserVmVO.class);
+        when(vmVO.getId()).thenReturn(1L);
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(vmVO);
+        when(backupDao.searchByVmIds(anyList())).thenReturn(Collections.emptyList());
+
+        assertTrue(serverAdapter.listBackupsByInstanceUuid("vm-uuid").isEmpty());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetBackup_NotFound_Throws() {
+        when(backupDao.findByUuidIncludingRemoved("backup-uuid")).thenReturn(null);
+        serverAdapter.getBackup("backup-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testFinalizeBackup_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.finalizeBackup("vm-uuid", "backup-uuid");
+    }
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testFinalizeBackup_BackupNotFound_Throws() {
+        UserVmVO vmVO = mock(UserVmVO.class);
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(vmVO);
+        when(backupDao.findByUuid("backup-uuid")).thenReturn(null);
+        serverAdapter.finalizeBackup("vm-uuid", "backup-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListCheckpointsByInstanceUuid_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.listCheckpointsByInstanceUuid("vm-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testDeleteCheckpoint_VmNotFound_Throws() {
+        when(userVmDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.deleteCheckpoint("vm-uuid", "chk-001");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetJob_NotFound_Throws() {
+        when(asyncJobJoinDao.findByUuidIncludingRemoved("job-uuid")).thenReturn(null);
+        serverAdapter.getJob("job-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testGetImageTransfer_NotFound_Throws() {
+        when(imageTransferDao.findByUuidIncludingRemoved("transfer-uuid")).thenReturn(null);
+        serverAdapter.getImageTransfer("transfer-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testCancelImageTransfer_NotFound_Throws() {
+        when(imageTransferDao.findByUuid("transfer-uuid")).thenReturn(null);
+        serverAdapter.cancelImageTransfer("transfer-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testFinalizeImageTransfer_NotFound_Throws() {
+        when(imageTransferDao.findByUuid("transfer-uuid")).thenReturn(null);
+        serverAdapter.finalizeImageTransfer("transfer-uuid");
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testUpdateInstance_VmNotFound_Throws() {
+        when(userVmJoinDao.findByUuid("vm-uuid")).thenReturn(null);
+        serverAdapter.updateInstance("vm-uuid", new Vm());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testUpdateDisk_NotFound_Throws() {
+        when(volumeDao.findByUuid("vol-uuid")).thenReturn(null);
+        serverAdapter.updateDisk("vol-uuid", new Disk());
+    }
+
+
+    @Test(expected = InvalidParameterValueException.class)
+    public void testListDisksByBackupUuid_AlwaysThrows() {
+        serverAdapter.listDisksByBackupUuid("backup-uuid");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ApiRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ApiRouteHandlerTest.java
new file mode 100644
index 000000000000..3a6b9cbe4002
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ApiRouteHandlerTest.java
@@ -0,0 +1,91 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import com.cloud.user.Account;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.api.dto.Api;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class ApiRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testCanHandleAndHandleRootApiRequest() throws Exception {
+        final ApiRouteHandler handler = new ApiRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        handler.veeamControlService = mock(VeeamControlService.class);
+
+        final User user = mock(User.class);
+        when(user.getUuid()).thenReturn("user-1");
+        when(handler.serverAdapter.getServiceAccount()).thenReturn(new Pair<>(user, mock(Account.class)));
+        when(handler.veeamControlService.getInstanceId()).thenReturn("instance-1");
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api", Negotiation.OutFormat.JSON, newServlet());
+
+        assertTrue(handler.canHandle("GET", "/api?x=1"));
+        verify(response.response).setStatus(200);
+        assertContains(response.body(), "\"instance_id\":\"instance-1\"");
+        assertContains(response.body(), "\"authenticated_user\"");
+        assertContains(response.body(), "clusters/search");
+    }
+
+    @Test
+    public void testCreateApiObjectBuildsLinksAndUserReferences() {
+        final ApiRouteHandler handler = new ApiRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        handler.veeamControlService = mock(VeeamControlService.class);
+
+        final User user = mock(User.class);
+        when(user.getUuid()).thenReturn("service-user");
+        when(handler.serverAdapter.getServiceAccount()).thenReturn(new Pair<>(user, mock(Account.class)));
+        when(handler.veeamControlService.getInstanceId()).thenReturn("instance-2");
+
+        final Api api = handler.createApiObject("/ctx/api");
+
+        assertNotNull(api.getLink());
+        assertTrue(!api.getLink().isEmpty());
+        assertEquals("instance-2", api.getProductInfo().getInstanceId());
+        assertEquals("service-user", api.getAuthenticatedUser().getId());
+        assertEquals("service-user", api.getEffectiveUser().getId());
+        assertNotNull(api.getTime());
+    }
+
+    @Test
+    public void testHandleUnknownPathReturnsNotFound() throws Exception {
+        final ApiRouteHandler handler = new ApiRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        handler.veeamControlService = mock(VeeamControlService.class);
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/unknown", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "\"reason\":\"Not found\"");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ClustersRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ClustersRouteHandlerTest.java
new file mode 100644
index 000000000000..a7ee380f137c
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ClustersRouteHandlerTest.java
@@ -0,0 +1,80 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class ClustersRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListReturnsNamedClusterList() throws Exception {
+        final ClustersRouteHandler handler = new ClustersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllClusters(null, 25L)).thenReturn(List.of(withId(new Cluster(), "cl-1")));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "25"), null, null), response.response,
+                "/api/clusters", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(handler.serverAdapter).listAllClusters(null, 25L);
+        verify(response.response).setStatus(200);
+        assertContains(response.body(), "\"cluster\":[");
+        assertContains(response.body(), "\"id\":\"cl-1\"");
+    }
+
+    @Test
+    public void testHandleGetByIdReturnsClusterAndMissingClusterIsNotFound() throws Exception {
+        final ClustersRouteHandler handler = new ClustersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getCluster("cl-1")).thenReturn(withId(new Cluster(), "cl-1"));
+        when(handler.serverAdapter.getCluster("missing")).thenThrow(new InvalidParameterValueException("missing"));
+
+        final ResponseCapture ok = newResponse();
+        handler.handle(newRequest("GET"), ok.response, "/api/clusters/cl-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(ok.response).setStatus(200);
+        assertContains(ok.body(), "\"id\":\"cl-1\"");
+
+        final ResponseCapture missing = newResponse();
+        handler.handle(newRequest("GET"), missing.response, "/api/clusters/missing", Negotiation.OutFormat.JSON, newServlet());
+        verify(missing.response).setStatus(404);
+        assertContains(missing.body(), "missing");
+    }
+
+    @Test
+    public void testHandleRejectsUnsupportedMethod() throws Exception {
+        final ClustersRouteHandler handler = new ClustersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("POST"), response.response, "/api/clusters", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setHeader("Allow", "GET");
+        verify(response.response).setStatus(405);
+        assertContains(response.body(), "Method Not Allowed");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandlerTest.java
new file mode 100644
index 000000000000..38ddbfad37b9
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DataCentersRouteHandlerTest.java
@@ -0,0 +1,91 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class DataCentersRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final DataCentersRouteHandler handler = new DataCentersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllDataCenters(null, 20L)).thenReturn(List.of(withId(new DataCenter(), "dc-1")));
+        when(handler.serverAdapter.getDataCenter("dc-1")).thenReturn(withId(new DataCenter(), "dc-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "20"), null, null), list.response,
+                "/api/datacenters", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"data_center\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/datacenters/dc-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"dc-1\"");
+    }
+
+    @Test
+    public void testHandleGetStorageDomainsAndNetworksByDataCenterId() throws Exception {
+        final DataCentersRouteHandler handler = new DataCentersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listStorageDomainsByDcId("dc-1", null, 15L))
+                .thenReturn(List.of(withId(new StorageDomain(), "sd-1")));
+        when(handler.serverAdapter.listNetworksByDcId("dc-1", null, 15L))
+                .thenReturn(List.of(withId(new Network(), "net-1")));
+
+        final ResponseCapture storageDomains = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "15"), null, null), storageDomains.response,
+                "/api/datacenters/dc-1/storagedomains", Negotiation.OutFormat.JSON, newServlet());
+        verify(storageDomains.response).setStatus(200);
+        assertContains(storageDomains.body(), "\"storage_domain\":[");
+        assertContains(storageDomains.body(), "sd-1");
+
+        final ResponseCapture networks = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "15"), null, null), networks.response,
+                "/api/datacenters/dc-1/networks", Negotiation.OutFormat.JSON, newServlet());
+        verify(networks.response).setStatus(200);
+        assertContains(networks.body(), "\"network\":[");
+        assertContains(networks.body(), "net-1");
+    }
+
+    @Test
+    public void testHandleMissingDataCenterReturnsNotFound() throws Exception {
+        final DataCentersRouteHandler handler = new DataCentersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getDataCenter("missing")).thenThrow(new InvalidParameterValueException("missing dc"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/datacenters/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing dc");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DisksRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DisksRouteHandlerTest.java
new file mode 100644
index 000000000000..f3872d0cd89d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/DisksRouteHandlerTest.java
@@ -0,0 +1,122 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+
+public class DisksRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndGetById() throws Exception {
+        final DisksRouteHandler handler = new DisksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllDisks(null, 10L)).thenReturn(List.of(withId(new Disk(), "disk-1")));
+        when(handler.serverAdapter.getDisk("disk-1")).thenReturn(withId(new Disk(), "disk-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "10"), null, null), list.response,
+                "/api/disks", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"disk\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/disks/disk-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"disk-1\"");
+    }
+
+    @Test
+    public void testHandlePostAndPutParseDiskJson() throws Exception {
+        final DisksRouteHandler handler = new DisksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ArgumentCaptor<Disk> createCaptor = ArgumentCaptor.forClass(Disk.class);
+        final Disk created = withId(new Disk(), "disk-created");
+        created.setName("created-disk");
+        when(handler.serverAdapter.createDisk(createCaptor.capture())).thenReturn(created);
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"name\":\"created-disk\"}"), post.response,
+                "/api/disks", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(201);
+        assertEquals("created-disk", createCaptor.getValue().getName());
+        assertContains(post.body(), "disk-created");
+
+        final ArgumentCaptor<Disk> updateCaptor = ArgumentCaptor.forClass(Disk.class);
+        final Disk updated = withId(new Disk(), "disk-1");
+        updated.setName("updated-disk");
+        when(handler.serverAdapter.updateDisk(org.mockito.ArgumentMatchers.eq("disk-1"), updateCaptor.capture())).thenReturn(updated);
+
+        final ResponseCapture put = newResponse();
+        handler.handle(newRequest("PUT", Map.of(), "application/json", "{\"name\":\"updated-disk\"}"), put.response,
+                "/api/disks/disk-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(put.response).setStatus(200);
+        assertEquals("updated-disk", updateCaptor.getValue().getName());
+        assertContains(put.body(), "updated-disk");
+    }
+
+    @Test
+    public void testHandleDeleteCopyAndReduceRoutes() throws Exception {
+        final DisksRouteHandler handler = new DisksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.copyDisk("disk-1")).thenReturn(withId(new Disk(), "copy-1"));
+        when(handler.serverAdapter.reduceDisk("disk-1")).thenReturn(withId(new Disk(), "reduced-1"));
+
+        final ResponseCapture delete = newResponse();
+        handler.handle(newRequest("DELETE"), delete.response, "/api/disks/disk-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).deleteDisk("disk-1");
+        verify(delete.response).setStatus(200);
+        assertContains(delete.body(), "Deleted disk ID: disk-1");
+
+        final ResponseCapture copy = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{}"), copy.response,
+                "/api/disks/disk-1/copy", Negotiation.OutFormat.JSON, newServlet());
+        verify(copy.response).setStatus(200);
+        assertContains(copy.body(), "copy-1");
+
+        final ResponseCapture reduce = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{}"), reduce.response,
+                "/api/disks/disk-1/reduce", Negotiation.OutFormat.JSON, newServlet());
+        verify(reduce.response).setStatus(200);
+        assertContains(reduce.body(), "reduced-1");
+    }
+
+    @Test
+    public void testHandleCopyRejectsUnsupportedMethod() throws Exception {
+        final DisksRouteHandler handler = new DisksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/disks/disk-1/copy", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setHeader("Allow", "POST");
+        verify(response.response).setStatus(405);
+        assertContains(response.body(), "Method Not Allowed");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/HostsRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/HostsRouteHandlerTest.java
new file mode 100644
index 000000000000..ef9370374726
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/HostsRouteHandlerTest.java
@@ -0,0 +1,64 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class HostsRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndGetById() throws Exception {
+        final HostsRouteHandler handler = new HostsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllHosts(null, null)).thenReturn(List.of(withId(new Host(), "host-1")));
+        when(handler.serverAdapter.getHost("host-1")).thenReturn(withId(new Host(), "host-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/hosts", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"host\":[");
+        assertContains(list.body(), "host-1");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/hosts/host-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"host-1\"");
+    }
+
+    @Test
+    public void testHandleGetByIdNotFound() throws Exception {
+        final HostsRouteHandler handler = new HostsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getHost("missing")).thenThrow(new InvalidParameterValueException("missing host"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/hosts/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing host");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandlerTest.java
new file mode 100644
index 000000000000..7ad85a4a4ee3
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/ImageTransfersRouteHandlerTest.java
@@ -0,0 +1,102 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.ImageTransfer;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+
+public class ImageTransfersRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final ImageTransfersRouteHandler handler = new ImageTransfersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllImageTransfers(null, 5L)).thenReturn(List.of(withId(new ImageTransfer(), "transfer-1")));
+        when(handler.serverAdapter.getImageTransfer("transfer-1")).thenReturn(withId(new ImageTransfer(), "transfer-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET", Map.of("max", "5"), null, null), list.response,
+                "/api/imagetransfers", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"image_transfer\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/imagetransfers/transfer-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"transfer-1\"");
+    }
+
+    @Test
+    public void testHandlePostParsesRequestAndCancelFinalizeActions() throws Exception {
+        final ImageTransfersRouteHandler handler = new ImageTransfersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ArgumentCaptor<ImageTransfer> captor = ArgumentCaptor.forClass(ImageTransfer.class);
+        final ImageTransfer created = withId(new ImageTransfer(), "transfer-created");
+        created.setPhase("transferring");
+        when(handler.serverAdapter.createImageTransfer(captor.capture())).thenReturn(created);
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"phase\":\"transferring\"}"), post.response,
+                "/api/imagetransfers", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(201);
+        assertEquals("transferring", captor.getValue().getPhase());
+        assertContains(post.body(), "transfer-created");
+
+        final ResponseCapture cancel = newResponse();
+        handler.handle(newRequest("POST"), cancel.response, "/api/imagetransfers/transfer-1/cancel", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).cancelImageTransfer("transfer-1");
+        verify(cancel.response).setStatus(200);
+        assertContains(cancel.body(), "cancelled successfully");
+
+        final ResponseCapture finalize = newResponse();
+        handler.handle(newRequest("POST"), finalize.response, "/api/imagetransfers/transfer-1/finalize", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).finalizeImageTransfer("transfer-1");
+        verify(finalize.response).setStatus(200);
+        assertContains(finalize.body(), "finalized successfully");
+    }
+
+    @Test
+    public void testHandleMissingTransferAndUnsupportedActionMethod() throws Exception {
+        final ImageTransfersRouteHandler handler = new ImageTransfersRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getImageTransfer("missing")).thenThrow(new InvalidParameterValueException("missing transfer"));
+
+        final ResponseCapture missing = newResponse();
+        handler.handle(newRequest("GET"), missing.response, "/api/imagetransfers/missing", Negotiation.OutFormat.JSON, newServlet());
+        verify(missing.response).setStatus(404);
+        assertContains(missing.body(), "missing transfer");
+
+        final ResponseCapture wrongMethod = newResponse();
+        handler.handle(newRequest("GET"), wrongMethod.response, "/api/imagetransfers/transfer-1/cancel", Negotiation.OutFormat.JSON, newServlet());
+        verify(wrongMethod.response).setHeader("Allow", "POST");
+        verify(wrongMethod.response).setStatus(405);
+        assertContains(wrongMethod.body(), "Method Not Allowed");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/JobsRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/JobsRouteHandlerTest.java
new file mode 100644
index 000000000000..f3236896d4b2
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/JobsRouteHandlerTest.java
@@ -0,0 +1,67 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class JobsRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndGetById() throws Exception {
+        final JobsRouteHandler handler = new JobsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listPendingJobs()).thenReturn(List.of(withId(new Job(), "job-1")));
+        when(handler.serverAdapter.getJob("job-1")).thenReturn(withId(new Job(), "job-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/jobs", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"job\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/jobs/job-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"job-1\"");
+    }
+
+    @Test
+    public void testHandleMissingJobAndUnsupportedMethod() throws Exception {
+        final JobsRouteHandler handler = new JobsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getJob("missing")).thenThrow(new InvalidParameterValueException("missing job"));
+
+        final ResponseCapture missing = newResponse();
+        handler.handle(newRequest("GET"), missing.response, "/api/jobs/missing", Negotiation.OutFormat.JSON, newServlet());
+        verify(missing.response).setStatus(404);
+        assertContains(missing.body(), "missing job");
+
+        final ResponseCapture wrongMethod = newResponse();
+        handler.handle(newRequest("POST"), wrongMethod.response, "/api/jobs", Negotiation.OutFormat.JSON, newServlet());
+        verify(wrongMethod.response).setStatus(405);
+        assertContains(wrongMethod.body(), "Method Not Allowed");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/NetworksRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/NetworksRouteHandlerTest.java
new file mode 100644
index 000000000000..35381b673c42
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/NetworksRouteHandlerTest.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class NetworksRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final NetworksRouteHandler handler = new NetworksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllNetworks(null, null)).thenReturn(List.of(withId(new Network(), "net-1")));
+        when(handler.serverAdapter.getNetwork("net-1")).thenReturn(withId(new Network(), "net-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/networks", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"network\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/networks/net-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"net-1\"");
+    }
+
+    @Test
+    public void testHandleMissingNetworkReturnsNotFound() throws Exception {
+        final NetworksRouteHandler handler = new NetworksRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getNetwork("missing")).thenThrow(new InvalidParameterValueException("missing network"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/networks/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing network");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/RouteHandlerTestSupport.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/RouteHandlerTestSupport.java
new file mode 100644
index 000000000000..ff0a6d822237
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/RouteHandlerTestSupport.java
@@ -0,0 +1,102 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.io.BufferedReader;
+import java.io.PrintWriter;
+import java.io.StringReader;
+import java.io.StringWriter;
+import java.util.Collections;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+
+class RouteHandlerTestSupport {
+
+    protected VeeamControlServlet newServlet() {
+        return new VeeamControlServlet(Collections.emptyList());
+    }
+
+    protected HttpServletRequest newRequest(final String method) throws Exception {
+        return newRequest(method, Collections.emptyMap(), null, null);
+    }
+
+    protected HttpServletRequest newRequest(final String method, final Map<String, String> params,
+            final String contentType, final String body) throws Exception {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        final Map<String, String> safeParams = params == null ? Collections.emptyMap() : params;
+
+        when(request.getMethod()).thenReturn(method);
+        when(request.getContentType()).thenReturn(contentType);
+        when(request.getParameterMap()).thenReturn(toParameterMap(safeParams));
+        when(request.getParameter(org.mockito.ArgumentMatchers.anyString())).thenAnswer(invocation -> safeParams.get(invocation.getArgument(0)));
+        when(request.getReader()).thenReturn(new BufferedReader(new StringReader(body == null ? "" : body)));
+        return request;
+    }
+
+    protected ResponseCapture newResponse() throws Exception {
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        final PrintWriter writer = new PrintWriter(sink);
+        when(response.getWriter()).thenReturn(writer);
+        return new ResponseCapture(response, sink, writer);
+    }
+
+    protected static <T extends BaseDto> T withId(final T dto, final String id) {
+        dto.setId(id);
+        dto.setHref("/api/test/" + id);
+        return dto;
+    }
+
+    protected static void assertContains(final String actual, final String expected) {
+        assertTrue("Expected body to contain: " + expected + " but was: " + actual, actual.contains(expected));
+    }
+
+    private static Map<String, String[]> toParameterMap(final Map<String, String> params) {
+        final java.util.LinkedHashMap<String, String[]> result = new java.util.LinkedHashMap<>();
+        for (Map.Entry<String, String> entry : params.entrySet()) {
+            result.put(entry.getKey(), new String[]{entry.getValue()});
+        }
+        return result;
+    }
+
+    protected static class ResponseCapture {
+        final HttpServletResponse response;
+        private final StringWriter sink;
+        private final PrintWriter writer;
+
+        ResponseCapture(final HttpServletResponse response, final StringWriter sink, final PrintWriter writer) {
+            this.response = response;
+            this.sink = sink;
+            this.writer = writer;
+        }
+
+        String body() {
+            writer.flush();
+            return sink.toString();
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/TagsRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/TagsRouteHandlerTest.java
new file mode 100644
index 000000000000..1b01887aabf4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/TagsRouteHandlerTest.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class TagsRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final TagsRouteHandler handler = new TagsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllTags(null, null)).thenReturn(List.of(withId(new Tag(), "tag-1")));
+        when(handler.serverAdapter.getTag("tag-1")).thenReturn(withId(new Tag(), "tag-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/tags", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"tag\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/tags/tag-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"tag-1\"");
+    }
+
+    @Test
+    public void testHandleMissingTagReturnsNotFound() throws Exception {
+        final TagsRouteHandler handler = new TagsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getTag("missing")).thenThrow(new InvalidParameterValueException("missing tag"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/tags/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing tag");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VmsRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VmsRouteHandlerTest.java
new file mode 100644
index 000000000000..281254fd6864
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VmsRouteHandlerTest.java
@@ -0,0 +1,297 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.veeam.api.dto.Backup;
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.apache.cloudstack.veeam.api.dto.VmAction;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.mockito.ArgumentCaptor;
+
+public class VmsRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListUsesFollowFlags() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllInstances(true, true, true, true, null, 10L))
+                .thenReturn(List.of(withId(new Vm(), "vm-1")));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET", Map.of(
+                        "max", "10",
+                        "all_content", "true",
+                        "follow", "tags,disk_attachments.disk,nics.reporteddevices"), null, null),
+                response.response, "/api/vms", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(handler.serverAdapter).listAllInstances(true, true, true, true, null, 10L);
+        verify(response.response).setStatus(200);
+        assertContains(response.body(), "\"vm\":[");
+        assertContains(response.body(), "vm-1");
+    }
+
+    @Test
+    public void testHandlePostAndUpdateParseVmJson() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+
+        final ArgumentCaptor<Vm> createCaptor = ArgumentCaptor.forClass(Vm.class);
+        final Vm created = withId(new Vm(), "vm-created");
+        created.setName("vm-created");
+        when(handler.serverAdapter.createInstance(createCaptor.capture())).thenReturn(created);
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"name\":\"vm-created\"}"), post.response,
+                "/api/vms", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(201);
+        assertEquals("vm-created", createCaptor.getValue().getName());
+        assertContains(post.body(), "vm-created");
+
+        final ArgumentCaptor<Vm> updateCaptor = ArgumentCaptor.forClass(Vm.class);
+        final Vm updated = withId(new Vm(), "vm-1");
+        updated.setName("vm-updated");
+        when(handler.serverAdapter.updateInstance(eq("vm-1"), updateCaptor.capture())).thenReturn(updated);
+
+        final ResponseCapture put = newResponse();
+        handler.handle(newRequest("PUT", Map.of(), "application/json", "{\"name\":\"vm-updated\"}"), put.response,
+                "/api/vms/vm-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(put.response).setStatus(200);
+        assertEquals("vm-updated", updateCaptor.getValue().getName());
+        assertContains(put.body(), "vm-updated");
+    }
+
+    @Test
+    public void testHandleGetByIdDeleteAndPowerActions() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getInstance("vm-1", true, true, true, true)).thenReturn(withId(new Vm(), "vm-1"));
+
+        final VmAction deleteAction = new VmAction();
+        deleteAction.setStatus("deleted");
+        final VmAction startAction = new VmAction();
+        startAction.setStatus("starting");
+        final VmAction stopAction = new VmAction();
+        stopAction.setStatus("stopping");
+        final VmAction shutdownAction = new VmAction();
+        shutdownAction.setStatus("shutting_down");
+        when(handler.serverAdapter.deleteInstance("vm-1", true, true)).thenReturn(deleteAction);
+        when(handler.serverAdapter.startInstance("vm-1", false)).thenReturn(startAction);
+        when(handler.serverAdapter.stopInstance("vm-1", false)).thenReturn(stopAction);
+        when(handler.serverAdapter.shutdownInstance("vm-1", false)).thenReturn(shutdownAction);
+
+        final ResponseCapture get = newResponse();
+        handler.handle(newRequest("GET", Map.of(
+                        "all_content", "true",
+                        "follow", "tags,disk_attachments.disk,nics.reporteddevices"), null, null),
+                get.response, "/api/vms/vm-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(get.response).setStatus(200);
+        assertContains(get.body(), "\"id\":\"vm-1\"");
+
+        final ResponseCapture delete = newResponse();
+        handler.handle(newRequest("DELETE", Map.of("async", "true", "detach_only", "false"), null, null), delete.response,
+                "/api/vms/vm-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).deleteInstance("vm-1", true, true);
+        verify(delete.response).setStatus(200);
+        assertContains(delete.body(), "deleted");
+
+        final ResponseCapture start = newResponse();
+        handler.handle(newRequest("POST"), start.response, "/api/vms/vm-1/start", Negotiation.OutFormat.JSON, newServlet());
+        verify(start.response).setStatus(202);
+        assertContains(start.body(), "starting");
+
+        final ResponseCapture stop = newResponse();
+        handler.handle(newRequest("POST"), stop.response, "/api/vms/vm-1/stop", Negotiation.OutFormat.JSON, newServlet());
+        verify(stop.response).setStatus(202);
+        assertContains(stop.body(), "stopping");
+
+        final ResponseCapture shutdown = newResponse();
+        handler.handle(newRequest("POST"), shutdown.response, "/api/vms/vm-1/shutdown", Negotiation.OutFormat.JSON, newServlet());
+        verify(shutdown.response).setStatus(202);
+        assertContains(shutdown.body(), "shutting_down");
+    }
+
+    @Test
+    public void testHandleDiskAttachmentAndNicRoutes() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listDiskAttachmentsByInstanceUuid("vm-1"))
+                .thenReturn(List.of(withId(new DiskAttachment(), "attach-1")));
+        when(handler.serverAdapter.listNicsByInstanceUuid("vm-1"))
+                .thenReturn(List.of(withId(new Nic(), "nic-1")));
+
+        final ArgumentCaptor<DiskAttachment> diskAttachmentCaptor = ArgumentCaptor.forClass(DiskAttachment.class);
+        final DiskAttachment createdAttachment = withId(new DiskAttachment(), "attach-created");
+        createdAttachment.setActive("true");
+        when(handler.serverAdapter.attachInstanceDisk(eq("vm-1"), diskAttachmentCaptor.capture())).thenReturn(createdAttachment);
+
+        final ArgumentCaptor<Nic> nicCaptor = ArgumentCaptor.forClass(Nic.class);
+        final Nic createdNic = withId(new Nic(), "nic-created");
+        createdNic.setName("nic-created");
+        when(handler.serverAdapter.attachInstanceNic(eq("vm-1"), nicCaptor.capture())).thenReturn(createdNic);
+
+        final ResponseCapture attachments = newResponse();
+        handler.handle(newRequest("GET"), attachments.response, "/api/vms/vm-1/diskattachments", Negotiation.OutFormat.JSON, newServlet());
+        verify(attachments.response).setStatus(200);
+        assertContains(attachments.body(), "\"disk_attachment\":[");
+
+        final ResponseCapture postAttachment = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"active\":\"true\"}"), postAttachment.response,
+                "/api/vms/vm-1/diskattachments", Negotiation.OutFormat.JSON, newServlet());
+        verify(postAttachment.response).setStatus(201);
+        assertEquals("true", diskAttachmentCaptor.getValue().getActive());
+        assertContains(postAttachment.body(), "attach-created");
+
+        final ResponseCapture nics = newResponse();
+        handler.handle(newRequest("GET"), nics.response, "/api/vms/vm-1/nics", Negotiation.OutFormat.JSON, newServlet());
+        verify(nics.response).setStatus(200);
+        assertContains(nics.body(), "\"nic\":[");
+
+        final ResponseCapture postNic = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"name\":\"nic-created\"}"), postNic.response,
+                "/api/vms/vm-1/nics", Negotiation.OutFormat.JSON, newServlet());
+        verify(postNic.response).setStatus(201);
+        assertEquals("nic-created", nicCaptor.getValue().getName());
+        assertContains(postNic.body(), "nic-created");
+    }
+
+    @Test
+    public void testHandleSnapshotRoutes() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listSnapshotsByInstanceUuid("vm-1")).thenReturn(List.of(withId(new Snapshot(), "snap-1")));
+        when(handler.serverAdapter.getSnapshot("snap-1")).thenReturn(withId(new Snapshot(), "snap-1"));
+
+        final ArgumentCaptor<Snapshot> createCaptor = ArgumentCaptor.forClass(Snapshot.class);
+        final Snapshot createdSnapshot = withId(new Snapshot(), "snap-created");
+        createdSnapshot.setDescription("created snapshot");
+        when(handler.serverAdapter.createInstanceSnapshot(eq("vm-1"), createCaptor.capture())).thenReturn(createdSnapshot);
+
+        final ResourceAction deleteAction = new ResourceAction();
+        deleteAction.setStatus("deleted");
+        final ResourceAction restoreAction = new ResourceAction();
+        restoreAction.setStatus("restored");
+        when(handler.serverAdapter.deleteSnapshot("snap-1", true)).thenReturn(deleteAction);
+        when(handler.serverAdapter.revertInstanceToSnapshot("snap-1", false)).thenReturn(restoreAction);
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/vms/vm-1/snapshots", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"snapshot\":[");
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"description\":\"created snapshot\"}"), post.response,
+                "/api/vms/vm-1/snapshots", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(202);
+        assertEquals("created snapshot", createCaptor.getValue().getDescription());
+        assertContains(post.body(), "snap-created");
+
+        final ResponseCapture get = newResponse();
+        handler.handle(newRequest("GET"), get.response, "/api/vms/vm-1/snapshots/snap-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(get.response).setStatus(200);
+        assertContains(get.body(), "snap-1");
+
+        final ResponseCapture delete = newResponse();
+        handler.handle(newRequest("DELETE", Map.of("async", "true"), null, null), delete.response,
+                "/api/vms/vm-1/snapshots/snap-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(delete.response).setStatus(202);
+        assertContains(delete.body(), "deleted");
+
+        final ResponseCapture restore = newResponse();
+        handler.handle(newRequest("POST"), restore.response, "/api/vms/vm-1/snapshots/snap-1/restore", Negotiation.OutFormat.JSON, newServlet());
+        verify(restore.response).setStatus(202);
+        assertContains(restore.body(), "restored");
+    }
+
+    @Test
+    public void testHandleBackupRoutes() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listBackupsByInstanceUuid("vm-1")).thenReturn(List.of(withId(new Backup(), "backup-1")));
+        when(handler.serverAdapter.getBackup("backup-1")).thenReturn(withId(new Backup(), "backup-1"));
+        when(handler.serverAdapter.listDisksByBackupUuid("backup-1")).thenReturn(List.of(withId(new Disk(), "disk-1")));
+
+        final ArgumentCaptor<Backup> createCaptor = ArgumentCaptor.forClass(Backup.class);
+        final Backup createdBackup = withId(new Backup(), "backup-created");
+        createdBackup.setName("backup-created");
+        when(handler.serverAdapter.createInstanceBackup(eq("vm-1"), createCaptor.capture())).thenReturn(createdBackup);
+
+        final Backup finalizedBackup = withId(new Backup(), "backup-1");
+        finalizedBackup.setPhase("finalized");
+        when(handler.serverAdapter.finalizeBackup("vm-1", "backup-1")).thenReturn(finalizedBackup);
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/vms/vm-1/backups", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"backup\":[");
+
+        final ResponseCapture post = newResponse();
+        handler.handle(newRequest("POST", Map.of(), "application/json", "{\"name\":\"backup-created\"}"), post.response,
+                "/api/vms/vm-1/backups", Negotiation.OutFormat.JSON, newServlet());
+        verify(post.response).setStatus(200);
+        assertEquals("backup-created", createCaptor.getValue().getName());
+        assertContains(post.body(), "backup-created");
+
+        final ResponseCapture get = newResponse();
+        handler.handle(newRequest("GET"), get.response, "/api/vms/vm-1/backups/backup-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(get.response).setStatus(200);
+        assertContains(get.body(), "backup-1");
+
+        final ResponseCapture disks = newResponse();
+        handler.handle(newRequest("GET"), disks.response, "/api/vms/vm-1/backups/backup-1/disks", Negotiation.OutFormat.JSON, newServlet());
+        verify(disks.response).setStatus(200);
+        assertContains(disks.body(), "\"disk\":[");
+
+        final ResponseCapture finalize = newResponse();
+        handler.handle(newRequest("POST"), finalize.response, "/api/vms/vm-1/backups/backup-1/finalize", Negotiation.OutFormat.JSON, newServlet());
+        verify(finalize.response).setStatus(200);
+        assertContains(finalize.body(), "finalized");
+    }
+
+    @Test
+    public void testHandleCheckpointRoutes() throws Exception {
+        final VmsRouteHandler handler = new VmsRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listCheckpointsByInstanceUuid("vm-1")).thenReturn(List.of(withId(new Checkpoint(), "chk-1")));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/vms/vm-1/checkpoints", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"checkpoints\":[");
+
+        final ResponseCapture delete = newResponse();
+        handler.handle(newRequest("DELETE"), delete.response, "/api/vms/vm-1/checkpoints/chk-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(handler.serverAdapter).deleteCheckpoint("vm-1", "chk-1");
+        verify(delete.response).setStatus(200);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandlerTest.java
new file mode 100644
index 000000000000..c22d2c402edb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/VnicProfilesRouteHandlerTest.java
@@ -0,0 +1,63 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import com.cloud.exception.InvalidParameterValueException;
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+
+public class VnicProfilesRouteHandlerTest extends RouteHandlerTestSupport {
+
+    @Test
+    public void testHandleGetListAndById() throws Exception {
+        final VnicProfilesRouteHandler handler = new VnicProfilesRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.listAllVnicProfiles(null, null)).thenReturn(List.of(withId(new VnicProfile(), "vnic-1")));
+        when(handler.serverAdapter.getVnicProfile("vnic-1")).thenReturn(withId(new VnicProfile(), "vnic-1"));
+
+        final ResponseCapture list = newResponse();
+        handler.handle(newRequest("GET"), list.response, "/api/vnicprofiles", Negotiation.OutFormat.JSON, newServlet());
+        verify(list.response).setStatus(200);
+        assertContains(list.body(), "\"vnic_profile\":[");
+
+        final ResponseCapture item = newResponse();
+        handler.handle(newRequest("GET"), item.response, "/api/vnicprofiles/vnic-1", Negotiation.OutFormat.JSON, newServlet());
+        verify(item.response).setStatus(200);
+        assertContains(item.body(), "\"id\":\"vnic-1\"");
+    }
+
+    @Test
+    public void testHandleMissingVnicProfileReturnsNotFound() throws Exception {
+        final VnicProfilesRouteHandler handler = new VnicProfilesRouteHandler();
+        handler.serverAdapter = mock(org.apache.cloudstack.veeam.adapter.ServerAdapter.class);
+        when(handler.serverAdapter.getVnicProfile("missing")).thenThrow(new InvalidParameterValueException("missing vnic"));
+
+        final ResponseCapture response = newResponse();
+        handler.handle(newRequest("GET"), response.response, "/api/vnicprofiles/missing", Negotiation.OutFormat.JSON, newServlet());
+
+        verify(response.response).setStatus(404);
+        assertContains(response.body(), "missing vnic");
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverterTest.java
new file mode 100644
index 000000000000..503fd05104b4
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/AsyncJobJoinVOToJobConverterTest.java
@@ -0,0 +1,85 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Date;
+import java.util.List;
+
+import org.apache.cloudstack.jobs.JobInfo;
+import org.apache.cloudstack.veeam.api.dto.Job;
+import org.apache.cloudstack.veeam.api.dto.ResourceAction;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.AsyncJobJoinVO;
+
+public class AsyncJobJoinVOToJobConverterTest {
+
+    @Test
+    public void testToJob_MapsSucceededStatusAndOwnerRef() {
+        final AsyncJobJoinVO vo = mock(AsyncJobJoinVO.class);
+        when(vo.getUuid()).thenReturn("job-1");
+        when(vo.getUserUuid()).thenReturn("user-1");
+        when(vo.getCreated()).thenReturn(new Date(1000L));
+        when(vo.getStatus()).thenReturn(JobInfo.Status.SUCCEEDED.ordinal());
+
+        final Job job = AsyncJobJoinVOToJobConverter.toJob(vo);
+
+        assertEquals("job-1", job.getId());
+        assertEquals("finished", job.getStatus());
+        assertEquals(Long.valueOf(1000L), job.getStartTime());
+        assertNotNull(job.getEndTime());
+        assertEquals("user-1", job.getOwner().getId());
+    }
+
+    @Test
+    public void testToJob_MapsInProgressToStartedAndNoEndTime() {
+        final AsyncJobJoinVO vo = mock(AsyncJobJoinVO.class);
+        when(vo.getUuid()).thenReturn("job-2");
+        when(vo.getUserUuid()).thenReturn("user-2");
+        when(vo.getCreated()).thenReturn(new Date(2000L));
+        when(vo.getStatus()).thenReturn(JobInfo.Status.IN_PROGRESS.ordinal());
+
+        final Job job = AsyncJobJoinVOToJobConverter.toJob(vo);
+
+        assertEquals("started", job.getStatus());
+        assertNull(job.getEndTime());
+    }
+
+    @Test
+    public void testToActionAndToJobList() {
+        final AsyncJobJoinVO vo = mock(AsyncJobJoinVO.class);
+        when(vo.getUuid()).thenReturn("job-3");
+        when(vo.getUserUuid()).thenReturn("user-3");
+        when(vo.getCreated()).thenReturn(new Date(3000L));
+        when(vo.getStatus()).thenReturn(JobInfo.Status.CANCELLED.ordinal());
+
+        final ResourceAction action = AsyncJobJoinVOToJobConverter.toAction(vo);
+        assertEquals("complete", action.getStatus());
+        assertEquals("job-3", action.getJob().getId());
+
+        final List<Job> jobs = AsyncJobJoinVOToJobConverter.toJobList(List.of(vo));
+        assertEquals(1, jobs.size());
+        assertEquals("aborted", jobs.get(0).getStatus());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverterTest.java
new file mode 100644
index 000000000000..1eb59b2f4b1a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/BackupVOToBackupConverterTest.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Date;
+import java.util.List;
+
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.backup.BackupVO;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.vm.UserVmVO;
+
+public class BackupVOToBackupConverterTest {
+
+    @Test
+    public void testToBackup_MapsCoreFieldsAndResolvedRefs() {
+        final BackupVO backupVO = mock(BackupVO.class);
+        when(backupVO.getUuid()).thenReturn("bkp-1");
+        when(backupVO.getName()).thenReturn("backup-1");
+        when(backupVO.getDescription()).thenReturn("desc-1");
+        when(backupVO.getDate()).thenReturn(new Date(1000L));
+        when(backupVO.getStatus()).thenReturn(Backup.Status.ReadyForImageTransfer);
+        when(backupVO.getFromCheckpointId()).thenReturn("cp-1");
+        when(backupVO.getToCheckpointId()).thenReturn("cp-2");
+        when(backupVO.getVmId()).thenReturn(101L);
+        when(backupVO.getHostId()).thenReturn(201L);
+
+        final UserVmVO vmVO = mock(UserVmVO.class);
+        when(vmVO.getUuid()).thenReturn("vm-1");
+        final HostJoinVO hostVO = mock(HostJoinVO.class);
+        when(hostVO.getUuid()).thenReturn("host-1");
+
+        final org.apache.cloudstack.veeam.api.dto.Backup backup = BackupVOToBackupConverter.toBackup(
+                backupVO,
+                id -> vmVO,
+                id -> hostVO,
+                vo -> List.of(new Disk())
+        );
+
+        assertEquals("bkp-1", backup.getId());
+        assertEquals("backup-1", backup.getName());
+        assertEquals("desc-1", backup.getDescription());
+        assertEquals(Long.valueOf(1000L), backup.getCreationDate());
+        assertEquals("ready", backup.getPhase());
+        assertEquals("cp-1", backup.getFromCheckpointId());
+        assertEquals("cp-2", backup.getToCheckpointId());
+        assertEquals("vm-1", backup.getVm().getId());
+        assertEquals("host-1", backup.getHost().getId());
+        assertNotNull(backup.getDisks());
+    }
+
+    @Test
+    public void testToBackup_PhaseMappingForDifferentStatuses() {
+        final BackupVO queued = mock(BackupVO.class);
+        when(queued.getUuid()).thenReturn("b1");
+        when(queued.getDate()).thenReturn(new Date(1L));
+        when(queued.getStatus()).thenReturn(Backup.Status.Queued);
+        when(queued.getVmId()).thenReturn(1L);
+
+        final BackupVO finalizing = mock(BackupVO.class);
+        when(finalizing.getUuid()).thenReturn("b2");
+        when(finalizing.getDate()).thenReturn(new Date(2L));
+        when(finalizing.getStatus()).thenReturn(Backup.Status.FinalizingImageTransfer);
+        when(finalizing.getVmId()).thenReturn(2L);
+
+        final BackupVO failed = mock(BackupVO.class);
+        when(failed.getUuid()).thenReturn("b3");
+        when(failed.getDate()).thenReturn(new Date(3L));
+        when(failed.getStatus()).thenReturn(Backup.Status.Failed);
+        when(failed.getVmId()).thenReturn(3L);
+
+        assertEquals("initializing", BackupVOToBackupConverter.toBackup(queued, null, null, null).getPhase());
+        assertEquals("finalizing", BackupVOToBackupConverter.toBackup(finalizing, null, null, null).getPhase());
+        assertEquals("failed", BackupVOToBackupConverter.toBackup(failed, null, null, null).getPhase());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverterTest.java
new file mode 100644
index 000000000000..1ac57f44949a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ClusterVOToClusterConverterTest.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.Cluster;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.cpu.CPU;
+import com.cloud.dc.ClusterVO;
+
+public class ClusterVOToClusterConverterTest {
+
+    @Test
+    public void testToCluster_MapsDefaultsAndResolvedDataCenter() {
+        final ClusterVO vo = mock(ClusterVO.class);
+        when(vo.getUuid()).thenReturn("cluster-1");
+        when(vo.getName()).thenReturn("cluster-a");
+        when(vo.getArch()).thenReturn(CPU.CPUArch.amd64);
+        when(vo.getDataCenterId()).thenReturn(11L);
+
+        final DataCenterJoinVO zone = mock(DataCenterJoinVO.class);
+        when(zone.getUuid()).thenReturn("dc-1");
+
+        final Cluster cluster = ClusterVOToClusterConverter.toCluster(vo, id -> zone);
+
+        assertEquals("cluster-1", cluster.getId());
+        assertEquals("cluster-a", cluster.getName());
+        assertEquals("x86_64", cluster.getCpu().getArchitecture());
+        assertEquals("dc-1", cluster.getDataCenter().getId());
+        assertEquals("urandom", cluster.getRequiredRngSources().requiredRngSource.get(0));
+        assertEquals("networks", cluster.getLink().get(0).getRel());
+        assertNotNull(cluster.getSchedulingPolicy());
+        assertNotNull(cluster.getMacPool());
+        assertTrue(cluster.getHref().contains("/api/clusters/cluster-1"));
+    }
+
+    @Test
+    public void testToClusterList_ConvertsAllItems() {
+        final ClusterVO first = mock(ClusterVO.class);
+        when(first.getUuid()).thenReturn("c1");
+        when(first.getName()).thenReturn("c1");
+        when(first.getArch()).thenReturn(CPU.CPUArch.x86);
+        when(first.getDataCenterId()).thenReturn(1L);
+
+        final ClusterVO second = mock(ClusterVO.class);
+        when(second.getUuid()).thenReturn("c2");
+        when(second.getName()).thenReturn("c2");
+        when(second.getArch()).thenReturn(CPU.CPUArch.amd64);
+        when(second.getDataCenterId()).thenReturn(2L);
+
+        final List<Cluster> clusters = ClusterVOToClusterConverter.toClusterList(List.of(first, second), id -> null);
+
+        assertEquals(2, clusters.size());
+        assertEquals("c1", clusters.get(0).getId());
+        assertEquals("c2", clusters.get(1).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverterTest.java
new file mode 100644
index 000000000000..59d14a5545cc
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/DataCenterJoinVOToDataCenterConverterTest.java
@@ -0,0 +1,88 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.DataCenter;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.org.Grouping;
+
+public class DataCenterJoinVOToDataCenterConverterTest {
+
+    @Test
+    public void testToDataCenter_MapsIdentityStatusAndLinks() {
+        final DataCenterJoinVO zone = mock(DataCenterJoinVO.class);
+        when(zone.getUuid()).thenReturn("dc-1");
+        when(zone.getName()).thenReturn("zone-a");
+        when(zone.getDescription()).thenReturn("desc-a");
+        when(zone.getAllocationState()).thenReturn(Grouping.AllocationState.Enabled);
+
+        final DataCenter dc = DataCenterJoinVOToDataCenterConverter.toDataCenter(zone);
+
+        assertEquals("dc-1", dc.getId());
+        assertEquals("zone-a", dc.getName());
+        assertEquals("desc-a", dc.getDescription());
+        assertEquals("up", dc.getStatus());
+        assertNotNull(dc.getVersion());
+        assertNotNull(dc.getSupportedVersions());
+        assertEquals(3, dc.getLink().size());
+        assertEquals("cluster", dc.getLink().get(0).getRel());
+    }
+
+    @Test
+    public void testToDataCenter_DisabledZoneMapsToDown() {
+        final DataCenterJoinVO zone = mock(DataCenterJoinVO.class);
+        when(zone.getUuid()).thenReturn("dc-2");
+        when(zone.getName()).thenReturn("zone-b");
+        when(zone.getDescription()).thenReturn("desc-b");
+        when(zone.getAllocationState()).thenReturn(Grouping.AllocationState.Disabled);
+
+        final DataCenter dc = DataCenterJoinVOToDataCenterConverter.toDataCenter(zone);
+
+        assertEquals("down", dc.getStatus());
+    }
+
+    @Test
+    public void testToDcList_ConvertsAllItems() {
+        final DataCenterJoinVO first = mock(DataCenterJoinVO.class);
+        when(first.getUuid()).thenReturn("dc-1");
+        when(first.getName()).thenReturn("zone-a");
+        when(first.getDescription()).thenReturn("desc-a");
+        when(first.getAllocationState()).thenReturn(Grouping.AllocationState.Enabled);
+
+        final DataCenterJoinVO second = mock(DataCenterJoinVO.class);
+        when(second.getUuid()).thenReturn("dc-2");
+        when(second.getName()).thenReturn("zone-b");
+        when(second.getDescription()).thenReturn("desc-b");
+        when(second.getAllocationState()).thenReturn(Grouping.AllocationState.Disabled);
+
+        final List<DataCenter> result = DataCenterJoinVOToDataCenterConverter.toDCList(List.of(first, second));
+
+        assertEquals(2, result.size());
+        assertEquals("dc-1", result.get(0).getId());
+        assertEquals("dc-2", result.get(1).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverterTest.java
new file mode 100644
index 000000000000..e5ab87b40c55
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/HostJoinVOToHostConverterTest.java
@@ -0,0 +1,123 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.Host;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.host.Status;
+import com.cloud.resource.ResourceState;
+
+public class HostJoinVOToHostConverterTest {
+
+    @Test
+    public void testToHost_MapsUpHostAndCoreFields() {
+        final HostJoinVO vo = mock(HostJoinVO.class);
+        when(vo.getUuid()).thenReturn("host-1");
+        when(vo.getName()).thenReturn("kvm-1");
+        when(vo.getPrivateIpAddress()).thenReturn("10.10.10.11");
+        when(vo.isInMaintenanceStates()).thenReturn(false);
+        when(vo.getStatus()).thenReturn(Status.Up);
+        when(vo.getResourceState()).thenReturn(ResourceState.Enabled);
+        when(vo.getClusterUuid()).thenReturn("cl-1");
+        when(vo.getSpeed()).thenReturn(2400L);
+        when(vo.getCpuSockets()).thenReturn(2);
+        when(vo.getCpus()).thenReturn(8);
+        when(vo.getTotalMemory()).thenReturn(16000L);
+        when(vo.getMemUsedCapacity()).thenReturn(4000L);
+
+        final Host host = HostJoinVOToHostConverter.toHost(vo);
+
+        assertEquals("host-1", host.getId());
+        assertEquals("kvm-1", host.getName());
+        assertEquals("10.10.10.11", host.getAddress());
+        assertEquals("up", host.getStatus());
+        assertEquals("cl-1", host.getCluster().getId());
+        assertEquals("2400", host.getCpu().getSpeed());
+        assertEquals("16000", host.getMemory());
+        assertEquals("12000", host.getMaxSchedulingMemory());
+        assertTrue(host.getHref().contains("/api/hosts/host-1"));
+    }
+
+    @Test
+    public void testToHost_MapsMaintenanceAndFallbackName() {
+        final HostJoinVO vo = mock(HostJoinVO.class);
+        when(vo.getUuid()).thenReturn("host-2");
+        when(vo.getName()).thenReturn(null);
+        when(vo.getPrivateIpAddress()).thenReturn("10.10.10.12");
+        when(vo.isInMaintenanceStates()).thenReturn(true);
+        when(vo.getStatus()).thenReturn(Status.Down);
+        when(vo.getResourceState()).thenReturn(ResourceState.Disabled);
+        when(vo.getClusterUuid()).thenReturn("cl-2");
+        when(vo.getSpeed()).thenReturn(2200L);
+        when(vo.getCpuSockets()).thenReturn(1);
+        when(vo.getCpus()).thenReturn(4);
+        when(vo.getTotalMemory()).thenReturn(8000L);
+        when(vo.getMemUsedCapacity()).thenReturn(2000L);
+
+        final Host host = HostJoinVOToHostConverter.toHost(vo);
+
+        assertEquals("host-host-2", host.getName());
+        assertEquals("maintenance", host.getStatus());
+    }
+
+    @Test
+    public void testToHostList_ConvertsAllEntries() {
+        final HostJoinVO first = mock(HostJoinVO.class);
+        when(first.getUuid()).thenReturn("h1");
+        when(first.getName()).thenReturn("h1");
+        when(first.getPrivateIpAddress()).thenReturn("1.1.1.1");
+        when(first.isInMaintenanceStates()).thenReturn(false);
+        when(first.getStatus()).thenReturn(Status.Up);
+        when(first.getResourceState()).thenReturn(ResourceState.Enabled);
+        when(first.getClusterUuid()).thenReturn("c1");
+        when(first.getSpeed()).thenReturn(1000L);
+        when(first.getCpuSockets()).thenReturn(1);
+        when(first.getCpus()).thenReturn(1);
+        when(first.getTotalMemory()).thenReturn(1024L);
+        when(first.getMemUsedCapacity()).thenReturn(24L);
+
+        final HostJoinVO second = mock(HostJoinVO.class);
+        when(second.getUuid()).thenReturn("h2");
+        when(second.getName()).thenReturn("h2");
+        when(second.getPrivateIpAddress()).thenReturn("2.2.2.2");
+        when(second.isInMaintenanceStates()).thenReturn(false);
+        when(second.getStatus()).thenReturn(Status.Down);
+        when(second.getResourceState()).thenReturn(ResourceState.Disabled);
+        when(second.getClusterUuid()).thenReturn("c2");
+        when(second.getSpeed()).thenReturn(2000L);
+        when(second.getCpuSockets()).thenReturn(1);
+        when(second.getCpus()).thenReturn(2);
+        when(second.getTotalMemory()).thenReturn(2048L);
+        when(second.getMemUsedCapacity()).thenReturn(48L);
+
+        final List<Host> hosts = HostJoinVOToHostConverter.toHostList(List.of(first, second));
+
+        assertEquals(2, hosts.size());
+        assertEquals("h1", hosts.get(0).getId());
+        assertEquals("h2", hosts.get(1).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverterTest.java
new file mode 100644
index 000000000000..a5d88b0f0a6b
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ImageTransferVOToImageTransferConverterTest.java
@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertTrue;
+import org.junit.Test;
+
+public class ImageTransferVOToImageTransferConverterTest {
+
+    @Test
+    public void testConverterExposesExpectedApiMethods() {
+        final java.lang.reflect.Method[] methods = ImageTransferVOToImageTransferConverter.class.getDeclaredMethods();
+        boolean hasSingle = false;
+        boolean hasList = false;
+        for (java.lang.reflect.Method method : methods) {
+            if ("toImageTransfer".equals(method.getName())) {
+                hasSingle = true;
+            }
+            if ("toImageTransferList".equals(method.getName())) {
+                hasList = true;
+            }
+        }
+        assertTrue(hasSingle);
+        assertTrue(hasList);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverterTest.java
new file mode 100644
index 000000000000..f3323e18fa6d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToNetworkConverterTest.java
@@ -0,0 +1,113 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.Network;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.network.Networks;
+import com.cloud.network.dao.NetworkVO;
+
+public class NetworkVOToNetworkConverterTest {
+
+    @Test
+    public void testToNetwork_MapsFieldsAndDataCenterRef() {
+        final NetworkVO vo = mock(NetworkVO.class);
+        when(vo.getUuid()).thenReturn("net-1");
+        when(vo.getName()).thenReturn("guest-net");
+        when(vo.getDisplayText()).thenReturn("Guest network");
+        when(vo.getPrivateMtu()).thenReturn(1450);
+        when(vo.getDataCenterId()).thenReturn(10L);
+
+        final DataCenterJoinVO dc = mock(DataCenterJoinVO.class);
+        when(dc.getUuid()).thenReturn("dc-1");
+
+        final Network dto = NetworkVOToNetworkConverter.toNetwork(vo, id -> dc);
+
+        assertEquals("net-1", dto.getId());
+        assertEquals("guest-net", dto.getName());
+        assertEquals("Guest network", dto.getDescription());
+        assertEquals("", dto.getComment());
+        assertEquals("1450", dto.getMtu());
+        assertEquals("false", dto.getPortIsolation());
+        assertEquals("false", dto.getStp());
+        assertEquals("guest-net", dto.getVdsmName());
+        assertNotNull(dto.getUsages());
+        assertEquals(1, dto.getUsages().getItems().size());
+        assertEquals("vm", dto.getUsages().getItems().get(0));
+        assertNotNull(dto.getLink());
+        assertTrue(dto.getLink().isEmpty());
+        assertEquals("dc-1", dto.getDataCenter().getId());
+        assertTrue(dto.getHref().contains("/api/networks/net-1"));
+    }
+
+    @Test
+    public void testToNetwork_UsesFallbackNameAndSkipsBlankDataCenterUuid() {
+        final NetworkVO vo = mock(NetworkVO.class);
+        when(vo.getUuid()).thenReturn("net-2");
+        when(vo.getName()).thenReturn(null);
+        when(vo.getTrafficType()).thenReturn(Networks.TrafficType.Guest);
+        when(vo.getDisplayText()).thenReturn("Fallback network");
+        when(vo.getPrivateMtu()).thenReturn(null);
+        when(vo.getDataCenterId()).thenReturn(20L);
+
+        final DataCenterJoinVO dc = mock(DataCenterJoinVO.class);
+        when(dc.getUuid()).thenReturn("");
+
+        final Network dto = NetworkVOToNetworkConverter.toNetwork(vo, id -> dc);
+
+        assertEquals("Guest-net-2", dto.getName());
+        assertEquals("0", dto.getMtu());
+        assertEquals("Guest-net-2", dto.getVdsmName());
+        assertNull(dto.getDataCenter());
+    }
+
+    @Test
+    public void testToNetworkList_ConvertsAllItemsInOrder() {
+        final NetworkVO first = mock(NetworkVO.class);
+        when(first.getUuid()).thenReturn("net-1");
+        when(first.getName()).thenReturn("first-net");
+        when(first.getDisplayText()).thenReturn("First network");
+        when(first.getPrivateMtu()).thenReturn(1400);
+
+        final NetworkVO second = mock(NetworkVO.class);
+        when(second.getUuid()).thenReturn("net-2");
+        when(second.getName()).thenReturn(null);
+        when(second.getTrafficType()).thenReturn(Networks.TrafficType.Control);
+        when(second.getDisplayText()).thenReturn("Second network");
+        when(second.getPrivateMtu()).thenReturn(null);
+
+        final List<Network> result = NetworkVOToNetworkConverter.toNetworkList(List.of(first, second), null);
+
+        assertEquals(2, result.size());
+        assertEquals("net-1", result.get(0).getId());
+        assertEquals("first-net", result.get(0).getName());
+        assertEquals("net-2", result.get(1).getId());
+        assertEquals("Control-net-2", result.get(1).getName());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverterTest.java
new file mode 100644
index 000000000000..c8a57e90383a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NetworkVOToVnicProfileConverterTest.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.VnicProfile;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.DataCenterJoinVO;
+import com.cloud.network.Networks;
+import com.cloud.network.dao.NetworkVO;
+
+public class NetworkVOToVnicProfileConverterTest {
+
+    @Test
+    public void testToVnicProfile_MapsNetworkAndDataCenterRefs() {
+        final NetworkVO vo = mock(NetworkVO.class);
+        when(vo.getUuid()).thenReturn("net-3");
+        when(vo.getName()).thenReturn("profile-net");
+        when(vo.getDisplayText()).thenReturn("Profile network");
+        when(vo.getDataCenterId()).thenReturn(30L);
+
+        final DataCenterJoinVO dc = mock(DataCenterJoinVO.class);
+        when(dc.getUuid()).thenReturn("dc-3");
+
+        final VnicProfile profile = NetworkVOToVnicProfileConverter.toVnicProfile(vo, id -> dc);
+
+        assertEquals("net-3", profile.getId());
+        assertEquals("profile-net", profile.getName());
+        assertEquals("Profile network", profile.getDescription());
+        assertEquals("net-3", profile.getNetwork().getId());
+        assertEquals("dc-3", profile.getDataCenter().getId());
+        assertTrue(profile.getHref().contains("/api/vnicprofiles/net-3"));
+        assertTrue(profile.getNetwork().getHref().contains("/api/networks/net-3"));
+    }
+
+    @Test
+    public void testToVnicProfile_UsesFallbackNameAndOmitsBlankDataCenterUuid() {
+        final NetworkVO vo = mock(NetworkVO.class);
+        when(vo.getUuid()).thenReturn("net-4");
+        when(vo.getName()).thenReturn(null);
+        when(vo.getTrafficType()).thenReturn(Networks.TrafficType.Management);
+        when(vo.getDisplayText()).thenReturn("Mgmt network");
+        when(vo.getDataCenterId()).thenReturn(40L);
+
+        final DataCenterJoinVO dc = mock(DataCenterJoinVO.class);
+        when(dc.getUuid()).thenReturn("");
+
+        final VnicProfile profile = NetworkVOToVnicProfileConverter.toVnicProfile(vo, id -> dc);
+
+        assertEquals("Management-net-4", profile.getName());
+        assertEquals("Mgmt network", profile.getDescription());
+        assertEquals("net-4", profile.getNetwork().getId());
+        assertNull(profile.getDataCenter());
+    }
+
+    @Test
+    public void testToVnicProfileList_ConvertsAllItemsInOrder() {
+        final NetworkVO first = mock(NetworkVO.class);
+        when(first.getUuid()).thenReturn("net-1");
+        when(first.getName()).thenReturn("profile-a");
+        when(first.getDisplayText()).thenReturn("Profile A");
+
+        final NetworkVO second = mock(NetworkVO.class);
+        when(second.getUuid()).thenReturn("net-2");
+        when(second.getName()).thenReturn(null);
+        when(second.getTrafficType()).thenReturn(Networks.TrafficType.Control);
+        when(second.getDisplayText()).thenReturn("Profile B");
+
+        final List<VnicProfile> result = NetworkVOToVnicProfileConverter.toVnicProfileList(List.of(first, second), null);
+
+        assertEquals(2, result.size());
+        assertEquals("net-1", result.get(0).getId());
+        assertEquals("profile-a", result.get(0).getName());
+        assertEquals("net-2", result.get(1).getId());
+        assertEquals("Control-net-2", result.get(1).getName());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverterTest.java
new file mode 100644
index 000000000000..cb60d8e081eb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/NicVOToNicConverterTest.java
@@ -0,0 +1,66 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.junit.Test;
+
+import com.cloud.network.dao.NetworkVO;
+
+public class NicVOToNicConverterTest {
+
+    @Test
+    public void testToNic_MapsVmHrefIpAndVnicProfile() {
+        final com.cloud.vm.NicVO vo = mock(com.cloud.vm.NicVO.class);
+        when(vo.getUuid()).thenReturn("nic-1");
+        when(vo.getReserver()).thenReturn("eth0");
+        when(vo.getMacAddress()).thenReturn("02:00:00:00:00:01");
+        when(vo.getIPv4Address()).thenReturn("10.1.1.10");
+        when(vo.getIPv4Gateway()).thenReturn("10.1.1.1");
+        when(vo.getNetworkId()).thenReturn(10L);
+
+        final NetworkVO network = mock(NetworkVO.class);
+        when(network.getUuid()).thenReturn("net-1");
+
+        final Nic nic = NicVOToNicConverter.toNic(vo, "vm-1", id -> network);
+
+        assertEquals("nic-1", nic.getId());
+        assertEquals("virtio", nic.getInterfaceType());
+        assertEquals("vm-1", nic.getVm().getId());
+        assertTrue(nic.getHref().contains("/api/vms/vm-1/nics/nic-1"));
+        assertEquals("net-1", nic.getVnicProfile().getId());
+        assertNotNull(nic.getReportedDevices());
+        assertEquals("v4", nic.getReportedDevices().getItems().get(0).getIps().getItems().get(0).getVersion());
+    }
+
+    @Test(expected = NullPointerException.class)
+    public void testToNic_BlankVmUuidCurrentBehaviorThrowsNpe() {
+        final com.cloud.vm.NicVO vo = mock(com.cloud.vm.NicVO.class);
+        when(vo.getUuid()).thenReturn("nic-2");
+        when(vo.getReserver()).thenReturn("eth1");
+        when(vo.getMacAddress()).thenReturn("02:00:00:00:00:02");
+
+        NicVOToNicConverter.toNic(vo, "", null);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverterTest.java
new file mode 100644
index 000000000000..6c607ea1f8c8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/ResourceTagVOToTagConverterTest.java
@@ -0,0 +1,87 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.BaseDto;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.junit.Test;
+
+import com.cloud.server.ResourceTag;
+import com.cloud.tags.ResourceTagVO;
+
+public class ResourceTagVOToTagConverterTest {
+
+    @Test
+    public void testGetRootTagAndRootRef() {
+        final Tag root = ResourceTagVOToTagConverter.getRootTag();
+
+        assertEquals(BaseDto.ZERO_UUID, root.getId());
+        assertEquals("root", root.getName());
+        assertNotNull(ResourceTagVOToTagConverter.getRootTagRef().getHref());
+    }
+
+    @Test
+    public void testToTag_FromResourceTagVoWithVmReference() {
+        final ResourceTagVO vo = mock(ResourceTagVO.class);
+        when(vo.getKey()).thenReturn("env");
+        when(vo.getValue()).thenReturn("prod");
+        when(vo.getResourceType()).thenReturn(ResourceTag.ResourceObjectType.UserVm);
+        when(vo.getResourceUuid()).thenReturn("vm-1");
+
+        final Tag tag = ResourceTagVOToTagConverter.toTag(vo);
+
+        assertEquals("prod", tag.getId());
+        assertEquals("prod", tag.getName());
+        assertNotNull(tag.getParent());
+        assertNotNull(tag.getVm());
+        assertEquals("vm-1", tag.getVm().getId());
+    }
+
+    @Test
+    public void testToTag_FromResourceTagVoWithoutVmReference() {
+        final ResourceTagVO vo = mock(ResourceTagVO.class);
+        when(vo.getKey()).thenReturn("scope");
+        when(vo.getValue()).thenReturn("global");
+        when(vo.getResourceType()).thenReturn(ResourceTag.ResourceObjectType.Volume);
+
+        final Tag tag = ResourceTagVOToTagConverter.toTag(vo);
+
+        assertEquals("global", tag.getId());
+        assertNull(tag.getVm());
+    }
+
+    @Test
+    public void testToTagsAndToTagsFromValues() {
+        final ResourceTagVO vo = mock(ResourceTagVO.class);
+        when(vo.getKey()).thenReturn("team");
+        when(vo.getValue()).thenReturn("ops");
+        when(vo.getResourceType()).thenReturn(ResourceTag.ResourceObjectType.UserVm);
+        when(vo.getResourceUuid()).thenReturn("vm-2");
+
+        assertEquals(1, ResourceTagVOToTagConverter.toTags(List.of(vo)).size());
+        assertEquals("ops", ResourceTagVOToTagConverter.toTagsFromValues(List.of("ops")).get(0).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverterTest.java
new file mode 100644
index 000000000000..479dab2157cf
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/StoreVOToStorageDomainConverterTest.java
@@ -0,0 +1,99 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.StorageDomain;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.ImageStoreJoinVO;
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.storage.Storage;
+import com.cloud.storage.StoragePoolStatus;
+
+public class StoreVOToStorageDomainConverterTest {
+
+    @Test
+    public void testToStorageDomain_FromPrimaryPool() {
+        final StoragePoolJoinVO pool = mock(StoragePoolJoinVO.class);
+        when(pool.getUuid()).thenReturn("pool-1");
+        when(pool.getName()).thenReturn("Primary-1");
+        when(pool.getCapacityBytes()).thenReturn(1000L);
+        when(pool.getUsedBytes()).thenReturn(250L);
+        when(pool.getStatus()).thenReturn(StoragePoolStatus.Up);
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.NetworkFilesystem);
+        when(pool.getZoneUuid()).thenReturn("dc-1");
+
+        final StorageDomain sd = StoreVOToStorageDomainConverter.toStorageDomain(pool);
+
+        assertEquals("pool-1", sd.getId());
+        assertEquals("data", sd.getType());
+        assertEquals("active", sd.getStatus());
+        assertEquals("750", sd.getAvailable());
+        assertEquals("250", sd.getUsed());
+        assertEquals("1000", sd.getCommitted());
+        assertEquals("nfs", sd.getStorage().getType());
+        assertEquals("dc-1", sd.getDataCenters().getItems().get(0).getId());
+        assertTrue(sd.getLink().stream().anyMatch(l -> "disks".equals(l.getRel())));
+    }
+
+    @Test
+    public void testToStorageDomain_FromImageStore() {
+        final ImageStoreJoinVO store = mock(ImageStoreJoinVO.class);
+        when(store.getUuid()).thenReturn("img-1");
+        when(store.getName()).thenReturn("Secondary-1");
+        when(store.getProviderName()).thenReturn("glance");
+        when(store.getZoneUuid()).thenReturn("dc-2");
+
+        final StorageDomain sd = StoreVOToStorageDomainConverter.toStorageDomain(store);
+
+        assertEquals("img-1", sd.getId());
+        assertEquals("image", sd.getType());
+        assertEquals("unattached", sd.getStatus());
+        assertEquals("glance", sd.getStorage().getType());
+        assertEquals("dc-2", sd.getDataCenters().getItems().get(0).getId());
+        assertTrue(sd.getLink().stream().anyMatch(l -> "images".equals(l.getRel())));
+    }
+
+    @Test
+    public void testListConverters() {
+        final StoragePoolJoinVO pool = mock(StoragePoolJoinVO.class);
+        when(pool.getUuid()).thenReturn("p");
+        when(pool.getName()).thenReturn("P");
+        when(pool.getCapacityBytes()).thenReturn(10L);
+        when(pool.getUsedBytes()).thenReturn(2L);
+        when(pool.getStatus()).thenReturn(StoragePoolStatus.Up);
+        when(pool.getPoolType()).thenReturn(Storage.StoragePoolType.Filesystem);
+        when(pool.getZoneUuid()).thenReturn("z");
+
+        final ImageStoreJoinVO store = mock(ImageStoreJoinVO.class);
+        when(store.getUuid()).thenReturn("s");
+        when(store.getName()).thenReturn("S");
+        when(store.getProviderName()).thenReturn("glance");
+        when(store.getZoneUuid()).thenReturn("z");
+
+        assertEquals(1, StoreVOToStorageDomainConverter.toStorageDomainListFromPools(List.of(pool)).size());
+        assertEquals(1, StoreVOToStorageDomainConverter.toStorageDomainListFromStores(List.of(store)).size());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverterTest.java
new file mode 100644
index 000000000000..190976e232b8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmJoinVOToVmConverterTest.java
@@ -0,0 +1,140 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Date;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.apache.cloudstack.veeam.api.dto.Nic;
+import org.apache.cloudstack.veeam.api.dto.Tag;
+import org.apache.cloudstack.veeam.api.dto.Vm;
+import org.junit.Test;
+
+import org.apache.cloudstack.api.ApiConstants;
+import com.cloud.api.query.vo.HostJoinVO;
+import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.vm.VirtualMachine;
+
+public class UserVmJoinVOToVmConverterTest {
+
+    @Test
+    public void testToVm_MapsUpStateWithBasicFields() {
+        final UserVmJoinVO src = mock(UserVmJoinVO.class);
+        when(src.getId()).thenReturn(101L);
+        when(src.getUuid()).thenReturn("vm-1");
+        when(src.getName()).thenReturn("vm-1-name");
+        when(src.getDisplayName()).thenReturn("vm-1-display");
+        when(src.getInstanceName()).thenReturn("i-101");
+        when(src.getState()).thenReturn(VirtualMachine.State.Running);
+        when(src.getCreated()).thenReturn(new Date(1000L));
+        when(src.getLastUpdated()).thenReturn(new Date(2000L));
+        when(src.getTemplateUuid()).thenReturn("tmpl-1");
+        when(src.getHostUuid()).thenReturn("host-1");
+        when(src.getRamSize()).thenReturn(512);
+        when(src.getArch()).thenReturn("x86_64");
+        when(src.getCpu()).thenReturn(2);
+        when(src.getGuestOsDisplayName()).thenReturn("Linux");
+        when(src.getServiceOfferingUuid()).thenReturn("offering-1");
+        when(src.getAccountUuid()).thenReturn("acct-1");
+        when(src.getAffinityGroupUuid()).thenReturn("ag-1");
+        when(src.getUserDataUuid()).thenReturn("ud-1");
+
+        final Vm vm = UserVmJoinVOToVmConverter.toVm(src, null, null, null, null, null, null, null, false);
+
+        assertEquals("vm-1", vm.getId());
+        assertEquals("vm-1-name", vm.getName());
+        assertEquals("vm-1-display", vm.getDescription());
+        assertEquals("up", vm.getStatus());
+        assertEquals(Long.valueOf(1000L), vm.getCreationTime());
+        assertEquals(Long.valueOf(2000L), vm.getStartTime());
+        assertNull(vm.getStopTime());
+        assertEquals("536870912", vm.getMemory());
+        assertEquals("x86_64", vm.getCpu().getArchitecture());
+        assertEquals("host-1", vm.getHost().getId());
+        assertNotNull(vm.getActions());
+        assertEquals(3, vm.getActions().getItems().size());
+    }
+
+    @Test
+    public void testToVm_UsesResolversAndMapsDownState() {
+        final UserVmJoinVO src = mock(UserVmJoinVO.class);
+        when(src.getId()).thenReturn(202L);
+        when(src.getUuid()).thenReturn("vm-2");
+        when(src.getName()).thenReturn("vm-2-name");
+        when(src.getDisplayName()).thenReturn("vm-2-display");
+        when(src.getInstanceName()).thenReturn("i-202");
+        when(src.getState()).thenReturn(VirtualMachine.State.Stopped);
+        when(src.getCreated()).thenReturn(new Date(3000L));
+        when(src.getLastUpdated()).thenReturn(new Date(4000L));
+        when(src.getTemplateUuid()).thenReturn("tmpl-2");
+        when(src.getHostUuid()).thenReturn(null);
+        when(src.getHostId()).thenReturn(22L);
+        when(src.getLastHostId()).thenReturn(null);
+        when(src.getRamSize()).thenReturn(1024);
+        when(src.getArch()).thenReturn("x86_64");
+        when(src.getCpu()).thenReturn(4);
+        when(src.getGuestOsDisplayName()).thenReturn("Linux");
+        when(src.getServiceOfferingUuid()).thenReturn("offering-2");
+        when(src.getAccountUuid()).thenReturn("acct-2");
+        when(src.getAffinityGroupUuid()).thenReturn("ag-2");
+        when(src.getUserDataUuid()).thenReturn("ud-2");
+
+        final HostJoinVO hostVo = mock(HostJoinVO.class);
+        when(hostVo.getUuid()).thenReturn("host-2");
+        when(hostVo.getClusterUuid()).thenReturn("cluster-2");
+
+        final Tag tag = new Tag();
+        tag.setId("tag-1");
+
+        final DiskAttachment disk = new DiskAttachment();
+        disk.setId("da-1");
+
+        final Nic nic = new Nic();
+        nic.setId("nic-1");
+
+        final Vm vm = UserVmJoinVOToVmConverter.toVm(
+                src,
+                id -> hostVo,
+                id -> Map.of(ApiConstants.BootType.UEFI.toString(), "true"),
+                id -> List.of(tag),
+                id -> List.of(disk),
+                ignored -> List.of(nic),
+                null,
+                null,
+                false);
+
+        assertEquals("down", vm.getStatus());
+        assertEquals(Long.valueOf(4000L), vm.getStopTime());
+        assertEquals("host-2", vm.getHost().getId());
+        assertEquals("cluster-2", vm.getCluster().getId());
+        assertEquals(1, vm.getTags().getItems().size());
+        assertEquals(1, vm.getDiskAttachments().getItems().size());
+        assertEquals(1, vm.getNics().getItems().size());
+        assertEquals("acct-2", vm.getAccountId());
+        assertEquals("ag-2", vm.getAffinityGroupId());
+        assertEquals("ud-2", vm.getUserDataId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverterTest.java
new file mode 100644
index 000000000000..7fb0396fc685
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/UserVmVOToCheckpointConverterTest.java
@@ -0,0 +1,56 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.api.dto.Checkpoint;
+import org.junit.Test;
+
+public class UserVmVOToCheckpointConverterTest {
+
+    @Test
+    public void testToCheckpoint_ReturnsNullWhenCheckpointIdMissing() {
+        assertNull(UserVmVOToCheckpointConverter.toCheckpoint(null, "10"));
+        assertNull(UserVmVOToCheckpointConverter.toCheckpoint("", "10"));
+    }
+
+    @Test
+    public void testToCheckpoint_ParsesCreationTimeWhenProvided() {
+        final Checkpoint checkpoint = UserVmVOToCheckpointConverter.toCheckpoint("chk-1", "1700000000");
+
+        assertNotNull(checkpoint);
+        assertEquals("chk-1", checkpoint.getId());
+        assertEquals("chk-1", checkpoint.getName());
+        assertEquals(String.valueOf(1700000000L * 1000L), checkpoint.getCreationDate());
+        assertEquals("created", checkpoint.getState());
+    }
+
+    @Test
+    public void testToCheckpoint_UsesNowWhenCreateTimeInvalid() {
+        final long before = System.currentTimeMillis();
+        final Checkpoint checkpoint = UserVmVOToCheckpointConverter.toCheckpoint("chk-2", "not-a-number");
+        final long after = System.currentTimeMillis();
+
+        final long creation = Long.parseLong(checkpoint.getCreationDate());
+        assertTrue(creation >= before && creation <= after);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverterTest.java
new file mode 100644
index 000000000000..75a36c13a4dc
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VmSnapshotVOToSnapshotConverterTest.java
@@ -0,0 +1,74 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Date;
+import java.util.List;
+
+import org.apache.cloudstack.veeam.api.dto.Snapshot;
+import org.junit.Test;
+
+import com.cloud.vm.snapshot.VMSnapshot;
+import com.cloud.vm.snapshot.VMSnapshotVO;
+
+public class VmSnapshotVOToSnapshotConverterTest {
+
+    @Test
+    public void testToSnapshot_MapsReadyDiskAndMemorySnapshot() {
+        final VMSnapshotVO vo = mock(VMSnapshotVO.class);
+        when(vo.getUuid()).thenReturn("snap-1");
+        when(vo.getDescription()).thenReturn("desc");
+        when(vo.getCreated()).thenReturn(new Date(1234L));
+        when(vo.getType()).thenReturn(VMSnapshotVO.Type.DiskAndMemory);
+        when(vo.getState()).thenReturn(VMSnapshot.State.Ready);
+
+        final Snapshot snapshot = VmSnapshotVOToSnapshotConverter.toSnapshot(vo, "vm-1");
+
+        assertEquals("snap-1", snapshot.getId());
+        assertTrue(snapshot.getHref().contains("/api/vms/vm-1/snapshots/snap-1"));
+        assertEquals("vm-1", snapshot.getVm().getId());
+        assertEquals("desc", snapshot.getDescription());
+        assertEquals(Long.valueOf(1234L), snapshot.getDate());
+        assertEquals("true", snapshot.getPersistMemorystate());
+        assertEquals("ok", snapshot.getSnapshotStatus());
+        assertEquals("link", snapshot.getActions().asMap().keySet().iterator().next());
+    }
+
+    @Test
+    public void testToSnapshot_MapsNonReadyToLockedAndToSnapshotList() {
+        final VMSnapshotVO vo = mock(VMSnapshotVO.class);
+        when(vo.getUuid()).thenReturn("snap-2");
+        when(vo.getDescription()).thenReturn("desc2");
+        when(vo.getCreated()).thenReturn(new Date(5678L));
+        when(vo.getType()).thenReturn(VMSnapshotVO.Type.Disk);
+        when(vo.getState()).thenReturn(VMSnapshot.State.Creating);
+
+        final Snapshot snapshot = VmSnapshotVOToSnapshotConverter.toSnapshot(vo, "vm-2");
+        assertEquals("false", snapshot.getPersistMemorystate());
+        assertEquals("locked", snapshot.getSnapshotStatus());
+
+        final List<Snapshot> list = VmSnapshotVOToSnapshotConverter.toSnapshotList(List.of(vo), "vm-2");
+        assertEquals(1, list.size());
+        assertEquals("snap-2", list.get(0).getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverterTest.java
new file mode 100644
index 000000000000..ae4d5961748b
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/converter/VolumeJoinVOToDiskConverterTest.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.converter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.List;
+
+import org.apache.cloudstack.backup.Backup;
+import org.apache.cloudstack.veeam.api.dto.Disk;
+import org.apache.cloudstack.veeam.api.dto.DiskAttachment;
+import org.junit.Test;
+
+import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Volume;
+
+public class VolumeJoinVOToDiskConverterTest {
+
+    @Test
+    public void testToDisk_MapsCoreFieldsAndResolverOverridesActualSize() {
+        final VolumeJoinVO vol = mock(VolumeJoinVO.class);
+        when(vol.getUuid()).thenReturn("vol-1");
+        when(vol.getVolumeType()).thenReturn(Volume.Type.ROOT);
+        when(vol.getName()).thenReturn("root-disk");
+        when(vol.getSize()).thenReturn(1000L);
+        when(vol.getVolumeStoreSize()).thenReturn(500L);
+        when(vol.getFormat()).thenReturn(Storage.ImageFormat.RAW);
+        when(vol.getState()).thenReturn(Volume.State.Ready);
+        when(vol.getPath()).thenReturn("path-1");
+        when(vol.getDiskOfferingUuid()).thenReturn("do-1");
+        when(vol.getPoolUuid()).thenReturn("pool-1");
+
+        final Disk disk = VolumeJoinVOToDiskConverter.toDisk(vol, v -> 700L);
+
+        assertEquals("vol-1", disk.getId());
+        assertEquals("true", disk.getBootable());
+        assertEquals("raw", disk.getFormat());
+        assertEquals("ok", disk.getStatus());
+        assertEquals("700", disk.getActualSize());
+        assertNotNull(disk.getStorageDomains());
+        assertTrue(disk.getHref().contains("/api/disks/vol-1"));
+    }
+
+    @Test
+    public void testToDiskAttachment_MapsVmAndDisk() {
+        final VolumeJoinVO vol = mock(VolumeJoinVO.class);
+        when(vol.getUuid()).thenReturn("vol-2");
+        when(vol.getVmUuid()).thenReturn("vm-2");
+        when(vol.getVolumeType()).thenReturn(Volume.Type.DATADISK);
+        when(vol.getName()).thenReturn("data-disk");
+        when(vol.getSize()).thenReturn(2048L);
+        when(vol.getVolumeStoreSize()).thenReturn(1024L);
+        when(vol.getFormat()).thenReturn(Storage.ImageFormat.QCOW2);
+        when(vol.getState()).thenReturn(Volume.State.Allocated);
+        when(vol.getPath()).thenReturn("path-2");
+        when(vol.getDiskOfferingUuid()).thenReturn("do-2");
+        when(vol.getPoolUuid()).thenReturn("pool-2");
+
+        final DiskAttachment da = VolumeJoinVOToDiskConverter.toDiskAttachment(vol, null);
+
+        assertEquals("vol-2", da.getId());
+        assertEquals("vm-2", da.getVm().getId());
+        assertEquals("false", da.getBootable());
+        assertEquals("virtio_scsi", da.getIface());
+        assertEquals("vol-2", da.getDisk().getId());
+    }
+
+    @Test
+    public void testToDiskListFromVolumeInfos_MapsBootableByVolumeType() {
+        final Backup.VolumeInfo root = new Backup.VolumeInfo("root-id", "p1", Volume.Type.ROOT, 10L, 0L, "do", 0L, 0L);
+        final Backup.VolumeInfo data = new Backup.VolumeInfo("data-id", "p2", Volume.Type.DATADISK, 20L, 1L, "do", 0L, 0L);
+
+        final List<Disk> result = VolumeJoinVOToDiskConverter.toDiskListFromVolumeInfos(List.of(root, data));
+
+        assertEquals(2, result.size());
+        assertEquals("true", result.get(0).getBootable());
+        assertEquals("false", result.get(1).getBootable());
+        assertEquals("20", result.get(1).getTotalSize());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BackupTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BackupTest.java
new file mode 100644
index 000000000000..418b8ba79dcd
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BackupTest.java
@@ -0,0 +1,79 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertNotNull;
+
+import java.util.Collections;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class BackupTest {
+    @Test
+    public void gettersSetters() {
+        Backup backup = new Backup();
+        backup.setName("backup-vm1");
+        backup.setDescription("Full backup");
+        backup.setCreationDate(1714465200000L);
+        backup.setPhase("succeeded");
+        backup.setFromCheckpointId("cp-1");
+        backup.setToCheckpointId("cp-2");
+        assertEquals("backup-vm1", backup.getName());
+        assertEquals("Full backup", backup.getDescription());
+        assertEquals(Long.valueOf(1714465200000L), backup.getCreationDate());
+        assertEquals("succeeded", backup.getPhase());
+        assertEquals("cp-1", backup.getFromCheckpointId());
+        assertEquals("cp-2", backup.getToCheckpointId());
+    }
+
+    @Test
+    public void gettersSetters_VmAndHost() {
+        Backup backup = new Backup();
+        Vm vm = Vm.of("/api/vms/v1", "v1");
+        Host host = Host.of("/api/hosts/h1", "h1");
+        backup.setVm(vm);
+        backup.setHost(host);
+        assertEquals("v1", backup.getVm().getId());
+        assertEquals("h1", backup.getHost().getId());
+    }
+
+    @Test
+    public void disks_NamedList() {
+        Backup backup = new Backup();
+        Disk disk = new Disk();
+        disk.setName("disk-1");
+        NamedList<Disk> disks = NamedList.of("disk", Collections.singletonList(disk));
+        backup.setDisks(disks);
+        assertNotNull(backup.getDisks());
+        assertEquals(1, backup.getDisks().getItems().size());
+        assertEquals("disk-1", backup.getDisks().getItems().get(0).getName());
+    }
+
+    @Test
+    public void json_ContainsNameAndPhase() throws Exception {
+        Mapper mapper = new Mapper();
+        Backup backup = new Backup();
+        backup.setName("nightly");
+        backup.setPhase("running");
+        String json = mapper.toJson(backup);
+        assertTrue(json.contains("\"name\":\"nightly\""));
+        assertTrue(json.contains("\"phase\":\"running\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BaseDtoTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BaseDtoTest.java
new file mode 100644
index 000000000000..9b776bac5618
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/BaseDtoTest.java
@@ -0,0 +1,100 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class BaseDtoTest {
+    @Test
+    public void zeroUuid_ConstantValue() {
+        assertEquals("00000000-0000-0000-0000-000000000000", BaseDto.ZERO_UUID);
+    }
+
+    @Test
+    public void getActionLink_BuildsRelAndHref() {
+        Link link = BaseDto.getActionLink("start", "/ovirt-engine/api/vms/1");
+        assertEquals("start", link.getRel());
+        assertEquals("/ovirt-engine/api/vms/1/start", link.getHref());
+    }
+
+    @Test
+    public void ref_of_SetsHrefAndId() {
+        Ref ref = Ref.of("https://host/api/templates/abc", "abc");
+        assertEquals("https://host/api/templates/abc", ref.getHref());
+        assertEquals("abc", ref.getId());
+    }
+
+    @Test
+    public void link_of_SetsRelAndHref() {
+        Link link = Link.of("edit", "/api/vms/1");
+        assertEquals("edit", link.getRel());
+        assertEquals("/api/vms/1", link.getHref());
+    }
+
+    @Test
+    public void ref_JsonOmitsNullId() throws Exception {
+        Mapper mapper = new Mapper();
+        Ref ref = new Ref();
+        ref.setHref("/api/vms/1");
+        String json = mapper.toJson(ref);
+        assertTrue(json.contains("\"href\":\"/api/vms/1\""));
+        assertFalse(json.contains("\"id\""));
+    }
+
+    @Test
+    public void link_JsonContainsRelAndHref() throws Exception {
+        Mapper mapper = new Mapper();
+        Link link = Link.of("delete", "/api/disks/7");
+        String json = mapper.toJson(link);
+        assertTrue(json.contains("\"rel\":\"delete\""));
+        assertTrue(json.contains("\"href\":\"/api/disks/7\""));
+    }
+
+    @Test
+    public void baseDto_GettersSetters() {
+        Ref ref = new Ref();
+        assertNull(ref.getHref());
+        assertNull(ref.getId());
+        ref.setHref("/test");
+        ref.setId("id-1");
+        assertEquals("/test", ref.getHref());
+        assertEquals("id-1", ref.getId());
+    }
+
+    @Test
+    public void vmOf_SetsHrefAndId() {
+        Vm vm = Vm.of("/ovirt-engine/api/vms/1", "1");
+        assertNotNull(vm);
+        assertEquals("/ovirt-engine/api/vms/1", vm.getHref());
+        assertEquals("1", vm.getId());
+    }
+
+    @Test
+    public void hostOf_SetsHrefAndId() {
+        Host host = Host.of("/ovirt-engine/api/hosts/h1", "h1");
+        assertNotNull(host);
+        assertEquals("/ovirt-engine/api/hosts/h1", host.getHref());
+        assertEquals("h1", host.getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/CertificateTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/CertificateTest.java
new file mode 100644
index 000000000000..695082ce38cc
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/CertificateTest.java
@@ -0,0 +1,45 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class CertificateTest {
+    @Test
+    public void gettersSetters() {
+        Certificate cert = new Certificate();
+        cert.setOrganization("Apache");
+        cert.setSubject("CN=cloudstack.apache.org");
+        assertEquals("Apache", cert.getOrganization());
+        assertEquals("CN=cloudstack.apache.org", cert.getSubject());
+    }
+
+    @Test
+    public void json_IncludesOrganizationAndSubject() throws Exception {
+        Mapper mapper = new Mapper();
+        Certificate cert = new Certificate();
+        cert.setOrganization("Apache");
+        cert.setSubject("CN=host");
+        String json = mapper.toJson(cert);
+        assertTrue(json.contains("\"organization\":\"Apache\""));
+        assertTrue(json.contains("\"subject\":\"CN=host\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DiskTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DiskTest.java
new file mode 100644
index 000000000000..5af29f9fff44
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DiskTest.java
@@ -0,0 +1,68 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class DiskTest {
+    @Test
+    public void gettersSetters() {
+        Disk disk = new Disk();
+        disk.setName("root-disk");
+        disk.setAlias("vm-alias");
+        disk.setFormat("cow");
+        disk.setProvisionedSize("10737418240");
+        disk.setActualSize("2147483648");
+        disk.setStatus("ok");
+        disk.setImageId("img-uuid-1");
+        disk.setBootable("true");
+        assertEquals("root-disk", disk.getName());
+        assertEquals("vm-alias", disk.getAlias());
+        assertEquals("cow", disk.getFormat());
+        assertEquals("10737418240", disk.getProvisionedSize());
+        assertEquals("2147483648", disk.getActualSize());
+        assertEquals("ok", disk.getStatus());
+        assertEquals("img-uuid-1", disk.getImageId());
+        assertEquals("true", disk.getBootable());
+    }
+
+    @Test
+    public void json_ContainsFormatAndName() throws Exception {
+        Mapper mapper = new Mapper();
+        Disk disk = new Disk();
+        disk.setName("data-disk");
+        disk.setFormat("raw");
+        String json = mapper.toJson(disk);
+        assertTrue(json.contains("\"name\":\"data-disk\""));
+        assertTrue(json.contains("\"format\":\"raw\""));
+    }
+
+    @Test
+    public void json_OmitsNullOptionals() throws Exception {
+        Mapper mapper = new Mapper();
+        Disk disk = new Disk();
+        disk.setName("minimal");
+        String json = mapper.toJson(disk);
+        assertFalse(json.contains("\"alias\""));
+        assertFalse(json.contains("\"bootable\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DtoSerializationTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DtoSerializationTest.java
new file mode 100644
index 000000000000..129fcf4e60f0
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/DtoSerializationTest.java
@@ -0,0 +1,82 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class DtoSerializationTest {
+
+    @Test
+    public void diskAttachmentJson_UsesInterfaceProperty() throws Exception {
+        Mapper mapper = new Mapper();
+        DiskAttachment diskAttachment = new DiskAttachment();
+        diskAttachment.setIface("virtio_scsi");
+
+        String json = mapper.toJson(diskAttachment);
+
+        assertTrue(json.contains("\"interface\":\"virtio_scsi\""));
+        assertFalse(json.contains("\"iface\""));
+    }
+
+    @Test
+    public void nicJson_UsesInterfacePropertyAndRoundTrips() throws Exception {
+        Mapper mapper = new Mapper();
+        Nic nic = new Nic();
+        nic.setInterfaceType("virtio");
+
+        String json = mapper.toJson(nic);
+        Nic read = mapper.jsonMapper().readValue(json, Nic.class);
+
+        assertTrue(json.contains("\"interface\":\"virtio\""));
+        assertFalse(json.contains("interface_type"));
+        assertEquals("virtio", read.getInterfaceType());
+    }
+
+    @Test
+    public void vmJson_IgnoresCloudStackSpecificFields() throws Exception {
+        Mapper mapper = new Mapper();
+        Vm vm = new Vm();
+        vm.setName("vm-1");
+        vm.setAccountId("account-uuid");
+        vm.setAffinityGroupId("affinity-uuid");
+        vm.setUserDataId("userdata-uuid");
+
+        String json = mapper.toJson(vm);
+
+        assertTrue(json.contains("\"name\":\"vm-1\""));
+        assertFalse(json.contains("account_id"));
+        assertFalse(json.contains("affinity_group_id"));
+        assertFalse(json.contains("user_data_id"));
+    }
+
+    @Test
+    public void vmXml_WritesEmptyElements() throws Exception {
+        Mapper mapper = new Mapper();
+        Vm vm = new Vm();
+
+        String xml = mapper.toXml(vm);
+
+        assertTrue(xml.contains("<io/>"));
+        assertTrue(xml.contains("<migration/>"));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/FaultTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/FaultTest.java
new file mode 100644
index 000000000000..5dc7078ea028
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/FaultTest.java
@@ -0,0 +1,41 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class FaultTest {
+    @Test
+    public void constructor_SetsReasonAndDetail() {
+        Fault fault = new Fault("Not Found", "Entity was not found");
+        assertEquals("Not Found", fault.getReason());
+        assertEquals("Entity was not found", fault.getDetail());
+    }
+
+    @Test
+    public void json_ContainsReasonAndDetail() throws Exception {
+        Mapper mapper = new Mapper();
+        Fault fault = new Fault("Unauthorized", "Invalid credentials");
+        String json = mapper.toJson(fault);
+        assertTrue(json.contains("\"reason\":\"Unauthorized\""));
+        assertTrue(json.contains("\"detail\":\"Invalid credentials\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/HostTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/HostTest.java
new file mode 100644
index 000000000000..44d1deae33f8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/HostTest.java
@@ -0,0 +1,73 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class HostTest {
+    @Test
+    public void of_SetsHrefAndId() {
+        Host host = Host.of("/api/hosts/h1", "h1");
+        assertNotNull(host);
+        assertEquals("/api/hosts/h1", host.getHref());
+        assertEquals("h1", host.getId());
+    }
+
+    @Test
+    public void gettersSetters_CoreFields() {
+        Host host = new Host();
+        host.setAddress("192.168.1.10");
+        host.setStatus("up");
+        host.setName("kvm-host-01");
+        host.setPort("54321");
+        assertEquals("192.168.1.10", host.getAddress());
+        assertEquals("up", host.getStatus());
+        assertEquals("kvm-host-01", host.getName());
+        assertEquals("54321", host.getPort());
+    }
+
+    @Test
+    public void hardwareInformation_GettersSetters() {
+        Host.HardwareInformation hw = new Host.HardwareInformation();
+        hw.setManufacturer("Dell");
+        hw.setProductName("PowerEdge R740");
+        hw.setSerialNumber("SN12345");
+        hw.setUuid("uuid-001");
+        hw.setVersion("1.0");
+        assertEquals("Dell", hw.getManufacturer());
+        assertEquals("PowerEdge R740", hw.getProductName());
+        assertEquals("SN12345", hw.getSerialNumber());
+        assertEquals("uuid-001", hw.getUuid());
+        assertEquals("1.0", hw.getVersion());
+    }
+
+    @Test
+    public void hostJson_ContainsAddressAndStatus() throws Exception {
+        Mapper mapper = new Mapper();
+        Host host = new Host();
+        host.setAddress("10.0.0.1");
+        host.setStatus("up");
+        String json = mapper.toJson(host);
+        assertTrue(json.contains("\"address\":\"10.0.0.1\""));
+        assertTrue(json.contains("\"status\":\"up\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ImageTransferTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ImageTransferTest.java
new file mode 100644
index 000000000000..1a8c64ce5602
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ImageTransferTest.java
@@ -0,0 +1,67 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class ImageTransferTest {
+    @Test
+    public void gettersSetters() {
+        ImageTransfer it = new ImageTransfer();
+        it.setPhase("initializing");
+        it.setDirection("upload");
+        it.setFormat("raw");
+        it.setTransferUrl("http://host:54322/images/xxx");
+        it.setTransferred("0");
+        it.setActive("true");
+        assertEquals("initializing", it.getPhase());
+        assertEquals("upload", it.getDirection());
+        assertEquals("raw", it.getFormat());
+        assertEquals("http://host:54322/images/xxx", it.getTransferUrl());
+        assertEquals("0", it.getTransferred());
+        assertEquals("true", it.getActive());
+    }
+
+    @Test
+    public void hostAndDiskRefs() {
+        ImageTransfer it = new ImageTransfer();
+        Ref host = Ref.of("/api/hosts/h1", "h1");
+        Ref disk = Ref.of("/api/disks/d1", "d1");
+        Ref image = Ref.of("/api/images/img1", "img1");
+        it.setHost(host);
+        it.setDisk(disk);
+        it.setImage(image);
+        assertEquals("h1", it.getHost().getId());
+        assertEquals("d1", it.getDisk().getId());
+        assertEquals("img1", it.getImage().getId());
+    }
+
+    @Test
+    public void json_ContainsPhaseAndDirection() throws Exception {
+        Mapper mapper = new Mapper();
+        ImageTransfer it = new ImageTransfer();
+        it.setPhase("transferring");
+        it.setDirection("download");
+        String json = mapper.toJson(it);
+        assertTrue(json.contains("\"phase\":\"transferring\""));
+        assertTrue(json.contains("\"direction\":\"download\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/MacIpTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/MacIpTest.java
new file mode 100644
index 000000000000..37157c889fed
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/MacIpTest.java
@@ -0,0 +1,67 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertFalse;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class MacIpTest {
+    @Test
+    public void mac_GettersSetters() {
+        Mac mac = new Mac();
+        mac.setAddress("02:00:00:00:00:01");
+        assertEquals("02:00:00:00:00:01", mac.getAddress());
+    }
+
+    @Test
+    public void mac_JsonSerializes() throws Exception {
+        Mapper mapper = new Mapper();
+        Mac mac = new Mac();
+        mac.setAddress("aa:bb:cc:dd:ee:ff");
+        String json = mapper.toJson(mac);
+        assertTrue(json.contains("\"address\":\"aa:bb:cc:dd:ee:ff\""));
+    }
+
+    @Test
+    public void ip_GettersSetters() {
+        Ip ip = new Ip();
+        ip.setAddress("192.168.1.1");
+        ip.setGateway("192.168.1.254");
+        ip.setNetmask("255.255.255.0");
+        ip.setVersion("v4");
+        assertEquals("192.168.1.1", ip.getAddress());
+        assertEquals("192.168.1.254", ip.getGateway());
+        assertEquals("255.255.255.0", ip.getNetmask());
+        assertEquals("v4", ip.getVersion());
+    }
+
+    @Test
+    public void ip_JsonOmitsNullGateway() throws Exception {
+        Mapper mapper = new Mapper();
+        Ip ip = new Ip();
+        ip.setAddress("10.0.0.1");
+        ip.setVersion("v4");
+        String json = mapper.toJson(ip);
+        assertTrue(json.contains("\"address\":\"10.0.0.1\""));
+        assertFalse(json.contains("\"gateway\""));
+        assertFalse(json.contains("\"netmask\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/NamedListTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/NamedListTest.java
new file mode 100644
index 000000000000..5c50638711f5
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/NamedListTest.java
@@ -0,0 +1,93 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.fail;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.junit.Test;
+
+public class NamedListTest {
+
+    @Test
+    public void of_NullItems_UsesEmptyList() {
+        NamedList<String> namedList = NamedList.of("item", null);
+
+        assertNotNull(namedList.getItems());
+        assertTrue(namedList.getItems().isEmpty());
+        assertTrue(namedList.asMap().containsKey("item"));
+    }
+
+    @Test
+    public void of_ValidName_StoresItemsInMap() {
+        List<String> values = Arrays.asList("a", "b");
+        NamedList<String> namedList = NamedList.of("values", values);
+
+        assertEquals(values, namedList.getItems());
+        assertEquals(values, namedList.asMap().get("values"));
+    }
+
+    @Test
+    public void of_EmptyName_ThrowsIllegalArgumentException() {
+        try {
+            NamedList.of("", Collections.singletonList("x"));
+            fail("Expected IllegalArgumentException for empty name");
+        } catch (IllegalArgumentException e) {
+            assertEquals("name must be non-empty", e.getMessage());
+        }
+    }
+
+    @Test
+    public void fromMap_InvalidMapShape_ThrowsIllegalArgumentException() {
+        try {
+            NamedList.fromMap(null);
+            fail("Expected IllegalArgumentException for null map");
+        } catch (IllegalArgumentException e) {
+            assertEquals("Expected single-property object for NamedList", e.getMessage());
+        }
+
+        Map<String, List<String>> invalid = new HashMap<>();
+        invalid.put("a", Collections.singletonList("x"));
+        invalid.put("b", Collections.singletonList("y"));
+
+        try {
+            NamedList.fromMap(invalid);
+            fail("Expected IllegalArgumentException for map with multiple keys");
+        } catch (IllegalArgumentException e) {
+            assertEquals("Expected single-property object for NamedList", e.getMessage());
+        }
+    }
+
+    @Test
+    public void fromMap_SingleEntry_ReturnsNamedList() {
+        Map<String, List<String>> map = Collections.singletonMap("usage", Collections.singletonList("vm"));
+
+        NamedList<String> namedList = NamedList.fromMap(map);
+
+        assertEquals(Collections.singletonList("vm"), namedList.getItems());
+        assertEquals(map, namedList.asMap());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtilTest.java
new file mode 100644
index 000000000000..da941aaa3897
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/OvfXmlUtilTest.java
@@ -0,0 +1,81 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.io.InputStream;
+import java.nio.charset.StandardCharsets;
+
+import org.apache.logging.log4j.Logger;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.utils.Pair;
+
+@RunWith(MockitoJUnitRunner.class)
+public class OvfXmlUtilTest {
+
+    String configuration = "<ovf:Envelope xmlns:ovf=\"http://schemas.dmtf.org/ovf/envelope/1/\" xmlns:rasd=\"http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData\" xmlns:vssd=\"http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\" ovf:version=\"4.4.0.0\">" +
+            "<Content ovf:id=\"out\" xsi:type=\"ovf:VirtualSystem_Type\"><Name>adm-v9</Name><Description>adm-v9</Description>" +
+            "<Section xsi:type=\"ovf:VirtualHardwareSection_Type\"><Info>1 CPU, 512 Memory</Info><System><vssd:VirtualSystemType>ENGINE 4.4.0.0</vssd:VirtualSystemType></System><Item><rasd:Caption>1 virtual cpu</rasd:Caption><rasd:Description>Number of virtual CPU</rasd:Description><rasd:InstanceId>1</rasd:InstanceId><rasd:ResourceType>3</rasd:ResourceType><rasd:num_of_sockets>1</rasd:num_of_sockets><rasd:cpu_per_socket>1</rasd:cpu_per_socket><rasd:threads_per_cpu>1</rasd:threads_per_cpu><rasd:max_num_of_vcpus>1</rasd:max_num_of_vcpus><rasd:VirtualQuantity>1</rasd:VirtualQuantity></Item>" +
+            "<Item><rasd:Caption>512 MB of memory</rasd:Caption><rasd:Description>Memory Size</rasd:Description><rasd:InstanceId>2</rasd:InstanceId><rasd:ResourceType>4</rasd:ResourceType><rasd:AllocationUnits>MegaBytes</rasd:AllocationUnits><rasd:VirtualQuantity>512</rasd:VirtualQuantity></Item>" +
+            "</Section></Content></ovf:Envelope>";
+
+    @Test
+    public void updateFromXml_parsesDetails() {
+        Vm vm = new Vm();
+        OvfXmlUtil.updateFromXml(vm, configuration);
+
+        assertEquals(String.valueOf(512 * OvfXmlUtil.MemoryAllocationUnit.Megabytes.getBytesMultiplier()), vm.getMemory());
+        assertEquals("1", vm.getCpu().getTopology().getSockets());
+        assertEquals("1", vm.getCpu().getTopology().getCores());
+        assertEquals("1", vm.getCpu().getTopology().getThreads());
+    }
+
+    @Test
+    public void test_restoreConfig_parse() throws Exception {
+        Vm vm = mock(Vm.class);
+        Vm.Initialization initialization = mock(Vm.Initialization.class);
+        Vm.Initialization.Configuration configMock = mock(Vm.Initialization.Configuration.class);
+        when(initialization.getConfiguration()).thenReturn(configMock);
+        when(vm.getInitialization()).thenReturn(initialization);
+        String ovfXml;
+        try (InputStream is = getClass().getClassLoader().getResourceAsStream("test-ovf.xml")) {
+            assertNotNull(is);
+            ovfXml = new String(is.readAllBytes(), StandardCharsets.UTF_8);
+        }
+        when(configMock.getType()).thenReturn("ovf");
+        when(configMock.getData()).thenReturn(ovfXml);
+
+        String instanceConfig = OvfXmlUtil.getConfigMetadataXml(vm, mock(Logger.class));
+        assertNotNull(instanceConfig);
+        assertTrue(instanceConfig.contains("ovf:CloudStackMetadata_Type"));
+        assertTrue(instanceConfig.contains("<NetworkId>6aff2178-a323-4148-a592-edbd47b93229</NetworkId>"));
+
+        Pair<String, String> result = OvfXmlUtil.getVmNicDetailFromStoredConfig(instanceConfig, "6aff2178-a323-4148-a592-edbd47b93229", mock(Logger.class));
+        assertNotNull(result);
+        assertEquals("02:01:00:cf:00:05", result.first());
+        assertEquals("10.1.1.40", result.second());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ProductInfoApiTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ProductInfoApiTest.java
new file mode 100644
index 000000000000..318631cd26f5
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/ProductInfoApiTest.java
@@ -0,0 +1,95 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class ProductInfoApiTest {
+    // ---- ProductInfo -------------------------------------------------------
+    @Test
+    public void productInfo_GettersSetters() {
+        ProductInfo info = new ProductInfo();
+        info.setInstanceId("inst-1");
+        info.setName("oVirt Engine");
+        Version version = new Version();
+        version.setMajor("4");
+        version.setMinor("23");
+        info.setVersion(version);
+        assertEquals("inst-1", info.getInstanceId());
+        assertEquals("oVirt Engine", info.getName());
+        assertNotNull(info.getVersion());
+        assertEquals("4", info.getVersion().getMajor());
+        assertEquals("23", info.getVersion().getMinor());
+    }
+
+    @Test
+    public void productInfoJson_ContainsInstanceId() throws Exception {
+        Mapper mapper = new Mapper();
+        ProductInfo info = new ProductInfo();
+        info.setInstanceId("inst-abc");
+        info.setName("CloudStack");
+        String json = mapper.toJson(info);
+        assertTrue(json.contains("\"instance_id\":\"inst-abc\""));
+        assertTrue(json.contains("\"name\":\"CloudStack\""));
+    }
+
+    // ---- SpecialObjects ----------------------------------------------------
+    @Test
+    public void specialObjects_GettersSetters() {
+        SpecialObjects so = new SpecialObjects();
+        Ref blank = Ref.of("/api/templates/blank", "blank");
+        Ref root = Ref.of("/api/tags/root", "root");
+        so.setBlankTemplate(blank);
+        so.setRootTag(root);
+        assertEquals("blank", so.getBlankTemplate().getId());
+        assertEquals("root", so.getRootTag().getId());
+    }
+
+    // ---- ApiSummary --------------------------------------------------------
+    @Test
+    public void apiSummary_HostsAndVms() {
+        ApiSummary summary = new ApiSummary();
+        SummaryCount hosts = new SummaryCount(2, 5);
+        SummaryCount vms = new SummaryCount(10, 20);
+        summary.setHosts(hosts);
+        summary.setVms(vms);
+        assertEquals("2", summary.getHosts().getActive());
+        assertEquals("5", summary.getHosts().getTotal());
+        assertEquals("10", summary.getVms().getActive());
+        assertEquals("20", summary.getVms().getTotal());
+    }
+
+    // ---- Api root -----------------------------------------------------------
+    @Test
+    public void api_GettersSetters() {
+        Api api = new Api();
+        api.setTime(1714465200000L);
+        ProductInfo info = new ProductInfo();
+        info.setName("CloudStack");
+        api.setProductInfo(info);
+        Ref authUser = Ref.of("/api/users/admin", "admin");
+        api.setAuthenticatedUser(authUser);
+        assertEquals(Long.valueOf(1714465200000L), api.getTime());
+        assertEquals("CloudStack", api.getProductInfo().getName());
+        assertEquals("admin", api.getAuthenticatedUser().getId());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SnapshotTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SnapshotTest.java
new file mode 100644
index 000000000000..f3f40d064edf
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SnapshotTest.java
@@ -0,0 +1,51 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class SnapshotTest {
+    @Test
+    public void gettersSetters() {
+        Snapshot snapshot = new Snapshot();
+        snapshot.setDate(1714465200000L);
+        snapshot.setSnapshotType("regular");
+        snapshot.setSnapshotStatus("ok");
+        snapshot.setDescription("Daily backup");
+        snapshot.setPersistMemorystate("false");
+        assertEquals(Long.valueOf(1714465200000L), snapshot.getDate());
+        assertEquals("regular", snapshot.getSnapshotType());
+        assertEquals("ok", snapshot.getSnapshotStatus());
+        assertEquals("Daily backup", snapshot.getDescription());
+        assertEquals("false", snapshot.getPersistMemorystate());
+    }
+
+    @Test
+    public void json_ContainsSnapshotTypeAndDate() throws Exception {
+        Mapper mapper = new Mapper();
+        Snapshot snapshot = new Snapshot();
+        snapshot.setSnapshotType("memory");
+        snapshot.setDate(1000L);
+        String json = mapper.toJson(snapshot);
+        assertTrue(json.contains("\"snapshot_type\":\"memory\""));
+        assertTrue(json.contains("\"date\":1000"));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/StorageDomainTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/StorageDomainTest.java
new file mode 100644
index 000000000000..4c0d4f4eaea2
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/StorageDomainTest.java
@@ -0,0 +1,53 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class StorageDomainTest {
+    @Test
+    public void gettersSetters() {
+        StorageDomain sd = new StorageDomain();
+        sd.setName("data-domain");
+        sd.setType("data");
+        sd.setStatus("active");
+        sd.setAvailable("107374182400");
+        sd.setUsed("21474836480");
+        sd.setStorageFormat("v5");
+        assertEquals("data-domain", sd.getName());
+        assertEquals("data", sd.getType());
+        assertEquals("active", sd.getStatus());
+        assertEquals("107374182400", sd.getAvailable());
+        assertEquals("21474836480", sd.getUsed());
+        assertEquals("v5", sd.getStorageFormat());
+    }
+
+    @Test
+    public void json_ContainsNameAndType() throws Exception {
+        Mapper mapper = new Mapper();
+        StorageDomain sd = new StorageDomain();
+        sd.setName("nfs-storage");
+        sd.setType("data");
+        String json = mapper.toJson(sd);
+        assertTrue(json.contains("\"name\":\"nfs-storage\""));
+        assertTrue(json.contains("\"type\":\"data\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SummaryCountTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SummaryCountTest.java
new file mode 100644
index 000000000000..a6032e571934
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/SummaryCountTest.java
@@ -0,0 +1,57 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertFalse;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class SummaryCountTest {
+    @Test
+    public void constructor_IntValues_ConvertsToStrings() {
+        SummaryCount count = new SummaryCount(3, 10);
+        assertEquals("3", count.getActive());
+        assertEquals("10", count.getTotal());
+    }
+
+    @Test
+    public void defaultConstructor_NullValues() {
+        SummaryCount count = new SummaryCount();
+        assertNull(count.getActive());
+        assertNull(count.getTotal());
+    }
+
+    @Test
+    public void json_OmitsNullFields() throws Exception {
+        Mapper mapper = new Mapper();
+        SummaryCount count = new SummaryCount();
+        String json = mapper.toJson(count);
+        assertFalse(json.contains("active"));
+        assertFalse(json.contains("total"));
+    }
+
+    @Test
+    public void json_IncludesPopulatedFields() throws Exception {
+        Mapper mapper = new Mapper();
+        SummaryCount count = new SummaryCount(5, 20);
+        String json = mapper.toJson(count);
+        assertEquals("{\"active\":\"5\",\"total\":\"20\"}", json);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/TopologyTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/TopologyTest.java
new file mode 100644
index 000000000000..c385977e0e40
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/TopologyTest.java
@@ -0,0 +1,78 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertNull;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class TopologyTest {
+
+    @Test
+    public void constructor_IntValues_ConvertsToStrings() {
+        Topology topology = new Topology(2, 4, 1);
+
+        assertEquals("2", topology.getSockets());
+        assertEquals("4", topology.getCores());
+        assertEquals("1", topology.getThreads());
+    }
+
+    @Test
+    public void defaultConstructor_NullFields() {
+        Topology topology = new Topology();
+
+        assertNull(topology.getSockets());
+        assertNull(topology.getCores());
+        assertNull(topology.getThreads());
+    }
+
+    @Test
+    public void cpuWithTopology_Serializes() throws Exception {
+        Mapper mapper = new Mapper();
+        Cpu cpu = new Cpu();
+        cpu.setName("Intel Xeon");
+        cpu.setArchitecture("x86_64");
+        Topology topology = new Topology(4, 8, 2);
+        cpu.setTopology(topology);
+
+        String json = mapper.toJson(cpu);
+
+        assertNotNull(json);
+        // Mapper uses SNAKE_CASE, so field names become snake_case
+        assertEquals("Intel Xeon", cpu.getName());
+        assertEquals("x86_64", cpu.getArchitecture());
+        assertEquals(topology, cpu.getTopology());
+    }
+
+    @Test
+    public void topologyJson_OmitsNullFields() throws Exception {
+        Mapper mapper = new Mapper();
+        Topology topology = new Topology();
+        topology.setSockets("2");
+
+        String json = mapper.toJson(topology);
+
+        assertNotNull(json);
+        // only sockets is set
+        assertEquals("2", topology.getSockets());
+        assertNull(topology.getCores());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VersionTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VersionTest.java
new file mode 100644
index 000000000000..a91f193ba42a
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VersionTest.java
@@ -0,0 +1,80 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+import org.apache.cloudstack.utils.CloudStackVersion;
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.junit.Test;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+
+public class VersionTest {
+
+    @Test
+    public void fromPackageAndCSVersion_CompleteVersion_IncludesPackageAndCsFields() {
+        CloudStackVersion csVersion = CloudStackVersion.parse("4.23.1.2");
+        try (MockedStatic<VeeamControlService> mocked = Mockito.mockStatic(VeeamControlService.class)) {
+            mocked.when(VeeamControlService::getPackageVersion).thenReturn("4.23.1.2");
+            mocked.when(VeeamControlService::getCSVersion).thenReturn(csVersion);
+
+            Version version = Version.fromPackageAndCSVersion(true);
+
+            assertEquals("4.23.1.2", version.getFullVersion());
+            assertEquals("4", version.getMajor());
+            assertEquals("23", version.getMinor());
+            assertEquals("1", version.getBuild());
+            assertEquals("2", version.getRevision());
+        }
+    }
+
+    @Test
+    public void fromPackageAndCSVersion_IncompleteVersion_DoesNotSetFullVersion() {
+        CloudStackVersion csVersion = CloudStackVersion.parse("4.23.1.2");
+        try (MockedStatic<VeeamControlService> mocked = Mockito.mockStatic(VeeamControlService.class)) {
+            mocked.when(VeeamControlService::getPackageVersion).thenReturn("4.23.1.2");
+            mocked.when(VeeamControlService::getCSVersion).thenReturn(csVersion);
+
+            Version version = Version.fromPackageAndCSVersion(false);
+
+            assertNull(version.getFullVersion());
+            assertEquals("4", version.getMajor());
+            assertEquals("23", version.getMinor());
+            assertEquals("1", version.getBuild());
+            assertEquals("2", version.getRevision());
+        }
+    }
+
+    @Test
+    public void fromPackageAndCSVersion_NullCloudStackVersion_ReturnsWithoutNumericParts() {
+        try (MockedStatic<VeeamControlService> mocked = Mockito.mockStatic(VeeamControlService.class)) {
+            mocked.when(VeeamControlService::getPackageVersion).thenReturn("4.23.1.2");
+            mocked.when(VeeamControlService::getCSVersion).thenReturn(null);
+
+            Version version = Version.fromPackageAndCSVersion(true);
+
+            assertEquals("4.23.1.2", version.getFullVersion());
+            assertNull(version.getMajor());
+            assertNull(version.getMinor());
+            assertNull(version.getBuild());
+            assertNull(version.getRevision());
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VmTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VmTest.java
new file mode 100644
index 000000000000..7741859d8971
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VmTest.java
@@ -0,0 +1,98 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.junit.Test;
+
+import com.cloud.utils.Pair;
+
+public class VmTest {
+
+    @Test
+    public void of_SetsHrefAndId() {
+        Vm vm = Vm.of("/ovirt-engine/api/vms/1", "1");
+
+        assertEquals("/ovirt-engine/api/vms/1", vm.getHref());
+        assertEquals("1", vm.getId());
+    }
+
+    @Test
+    public void biosGetDefault_UsesSeaBiosAndDisabledBootMenu() {
+        Vm.Bios bios = Vm.Bios.getDefault();
+
+        assertEquals(Vm.Bios.Type.q35_sea_bios.name(), bios.getType());
+        assertEquals("false", bios.getBootMenu().getEnabled());
+    }
+
+    @Test
+    public void biosUpdateBios_UsesSecureBootWhenRequested() {
+        Vm.Bios bios = Vm.Bios.getDefault();
+
+        Vm.Bios.updateBios(bios, ApiConstants.BootMode.SECURE.toString());
+
+        assertEquals(Vm.Bios.Type.q35_secure_boot.name(), bios.getType());
+    }
+
+    @Test
+    public void biosUpdateBios_UsesOvmfForNonSecureMode() {
+        Vm.Bios bios = Vm.Bios.getDefault();
+
+        Vm.Bios.updateBios(bios, ApiConstants.BootMode.LEGACY.toString());
+
+        assertEquals(Vm.Bios.Type.q35_ovmf.name(), bios.getType());
+    }
+
+    @Test
+    public void biosGetBiosFromOrdinal_FallsBackToDefaultWhenInvalid() {
+        Vm.Bios bios = Vm.Bios.getBiosFromOrdinal("not-a-number");
+
+        assertEquals(Vm.Bios.Type.q35_sea_bios.name(), bios.getType());
+    }
+
+    @Test
+    public void biosGetBiosFromOrdinal_MapsKnownOrdinals() {
+        Vm.Bios secure = Vm.Bios.getBiosFromOrdinal(String.valueOf(Vm.Bios.Type.q35_secure_boot.ordinal()));
+        Vm.Bios ovmf = Vm.Bios.getBiosFromOrdinal(String.valueOf(Vm.Bios.Type.q35_ovmf.ordinal()));
+
+        assertEquals(Vm.Bios.Type.q35_secure_boot.name(), secure.getType());
+        assertEquals(Vm.Bios.Type.q35_ovmf.name(), ovmf.getType());
+    }
+
+    @Test
+    public void biosRetrieveBootOptions_ReturnsExpectedMappings() {
+        Pair<ApiConstants.BootType, ApiConstants.BootMode> defaults = Vm.Bios.retrieveBootOptions(null);
+        Pair<ApiConstants.BootType, ApiConstants.BootMode> secure = Vm.Bios.retrieveBootOptions(typeOnly(Vm.Bios.Type.q35_secure_boot.name()));
+        Pair<ApiConstants.BootType, ApiConstants.BootMode> uefiLegacy = Vm.Bios.retrieveBootOptions(typeOnly(Vm.Bios.Type.q35_ovmf.name()));
+
+        assertEquals(ApiConstants.BootType.BIOS, defaults.first());
+        assertEquals(ApiConstants.BootMode.LEGACY, defaults.second());
+        assertEquals(ApiConstants.BootType.UEFI, secure.first());
+        assertEquals(ApiConstants.BootMode.SECURE, secure.second());
+        assertEquals(ApiConstants.BootType.UEFI, uefiLegacy.first());
+        assertEquals(ApiConstants.BootMode.LEGACY, uefiLegacy.second());
+    }
+
+    private Vm.Bios typeOnly(String type) {
+        Vm.Bios bios = new Vm.Bios();
+        bios.setType(type);
+        return bios;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VnicProfileReportedDeviceTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VnicProfileReportedDeviceTest.java
new file mode 100644
index 000000000000..27ca43f77866
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/dto/VnicProfileReportedDeviceTest.java
@@ -0,0 +1,83 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements. See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership. The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License. You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied. See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.veeam.api.dto;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertNotNull;
+
+import java.util.Collections;
+
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.junit.Test;
+
+public class VnicProfileReportedDeviceTest {
+    // ---- VnicProfile -------------------------------------------------------
+    @Test
+    public void vnicProfile_GettersSetters() {
+        VnicProfile profile = new VnicProfile();
+        profile.setName("default");
+        profile.setDescription("Default vNIC profile");
+        Ref network = Ref.of("/api/networks/net1", "net1");
+        Ref dc = Ref.of("/api/datacenters/dc1", "dc1");
+        profile.setNetwork(network);
+        profile.setDataCenter(dc);
+        assertEquals("default", profile.getName());
+        assertEquals("Default vNIC profile", profile.getDescription());
+        assertEquals("net1", profile.getNetwork().getId());
+        assertEquals("dc1", profile.getDataCenter().getId());
+    }
+
+    @Test
+    public void vnicProfileJson_ContainsName() throws Exception {
+        Mapper mapper = new Mapper();
+        VnicProfile profile = new VnicProfile();
+        profile.setName("my-profile");
+        String json = mapper.toJson(profile);
+        assertTrue(json.contains("\"name\":\"my-profile\""));
+    }
+
+    // ---- ReportedDevice ----------------------------------------------------
+    @Test
+    public void reportedDevice_GettersSetters() {
+        ReportedDevice device = new ReportedDevice();
+        device.setName("eth0");
+        device.setType("bridge");
+        device.setDescription("Primary NIC");
+        Mac mac = new Mac();
+        mac.setAddress("aa:bb:cc:dd:ee:01");
+        device.setMac(mac);
+        NamedList<Ip> ips = NamedList.of("ip", Collections.singletonList(new Ip()));
+        device.setIps(ips);
+        assertEquals("eth0", device.getName());
+        assertEquals("bridge", device.getType());
+        assertEquals("Primary NIC", device.getDescription());
+        assertEquals("aa:bb:cc:dd:ee:01", device.getMac().getAddress());
+        assertNotNull(device.getIps());
+    }
+
+    @Test
+    public void reportedDeviceJson_ContainsNameAndType() throws Exception {
+        Mapper mapper = new Mapper();
+        ReportedDevice device = new ReportedDevice();
+        device.setName("ens3");
+        device.setType("ethernet");
+        String json = mapper.toJson(device);
+        assertTrue(json.contains("\"name\":\"ens3\""));
+        assertTrue(json.contains("\"type\":\"ethernet\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/request/ListQueryTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/request/ListQueryTest.java
new file mode 100644
index 000000000000..16fbd02669c5
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/api/request/ListQueryTest.java
@@ -0,0 +1,92 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.api.request;
+
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.Map;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.junit.Test;
+
+public class ListQueryTest {
+
+    @Test
+    public void testFromRequest_WithNoParametersReturnsDefaults() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        when(request.getParameterMap()).thenReturn(Collections.emptyMap());
+
+        final ListQuery query = ListQuery.fromRequest(request);
+
+        assertFalse(query.isAllContent());
+        assertNull(query.getLimit());
+        assertNull(query.getOffset());
+        assertFalse(query.followContains("tags"));
+    }
+
+    @Test
+    public void testFromRequest_ParsesAllContentMaxAndFollow() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        when(request.getParameterMap()).thenReturn(Map.of(
+                "all_content", new String[]{"true"},
+                "max", new String[]{"25"},
+                "follow", new String[]{"tags, disk_attachments.disk, ,nics.reporteddevices"}
+        ));
+        when(request.getParameter("all_content")).thenReturn("true");
+        when(request.getParameter("max")).thenReturn("25");
+        when(request.getParameter("follow")).thenReturn("tags, disk_attachments.disk, ,nics.reporteddevices");
+        when(request.getParameter("search")).thenReturn(null);
+
+        final ListQuery query = ListQuery.fromRequest(request);
+
+        assertTrue(query.isAllContent());
+        assertTrue(query.followContains("tags"));
+        assertTrue(query.followContains("disk_attachments.disk"));
+        assertTrue(query.followContains("nics.reporteddevices"));
+    }
+
+    @Test
+    public void testFromRequest_SearchParserIgnoresNonEqualsAndUsesPageValueAsMaxCurrentBehavior() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+        when(request.getParameterMap()).thenReturn(Map.of("search", new String[]{"name=vm and page=3 and status!=down and x>=1"}));
+        when(request.getParameter("all_content")).thenReturn(null);
+        when(request.getParameter("max")).thenReturn(null);
+        when(request.getParameter("follow")).thenReturn(null);
+        when(request.getParameter("search")).thenReturn("name=vm and page=3 and status!=down and x>=1");
+
+        final ListQuery query = ListQuery.fromRequest(request);
+
+        // Document existing behavior: when search contains page=..., max is set from it.
+        org.junit.Assert.assertEquals(Long.valueOf(3L), query.getLimit());
+    }
+
+    @Test
+    public void testGetOffset_UsesPageAndMax() {
+        final ListQuery query = new ListQuery();
+        query.page = 3L;
+        query.max = 10L;
+
+        org.junit.Assert.assertEquals(Long.valueOf(20L), query.getOffset());
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilterTest.java
new file mode 100644
index 000000000000..d14d1291dc17
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/AllowedClientCidrsFilterTest.java
@@ -0,0 +1,130 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.filter;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.List;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+@RunWith(MockitoJUnitRunner.class)
+public class AllowedClientCidrsFilterTest {
+
+    @Mock
+    private VeeamControlService veeamControlService;
+
+    @Mock
+    private FilterChain chain;
+
+    @Test
+    public void testDoFilterAllowsNonHttpRequestsToPassThrough() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final ServletRequest request = mock(ServletRequest.class);
+        final ServletResponse response = mock(ServletResponse.class);
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+        verifyNoInteractions(veeamControlService);
+    }
+
+    @Test
+    public void testDoFilterRejectsWhenServiceIsUnavailable() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(null);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(503, response.getStatus());
+        assertEquals("Service Unavailable", response.getErrorMessage());
+        verifyNoInteractions(chain);
+    }
+
+    @Test
+    public void testDoFilterAllowsRequestWhenNoCidrsConfigured() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        when(veeamControlService.getAllowedClientCidrs()).thenReturn(Collections.emptyList());
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+    }
+
+    @Test
+    public void testDoFilterAllowsRequestFromConfiguredCidr() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setRemoteAddr("192.168.10.25");
+        when(veeamControlService.getAllowedClientCidrs()).thenReturn(List.of("192.168.10.0/24"));
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+        assertEquals(200, response.getStatus());
+    }
+
+    @Test
+    public void testDoFilterRejectsRequestOutsideConfiguredCidrs() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setRemoteAddr("10.10.10.10");
+        when(veeamControlService.getAllowedClientCidrs()).thenReturn(List.of("192.168.10.0/24"));
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(403, response.getStatus());
+        assertEquals("Forbidden", response.getErrorMessage());
+        verifyNoInteractions(chain);
+    }
+
+    @Test
+    public void testDoFilterRejectsMalformedRemoteAddress() throws Exception {
+        final AllowedClientCidrsFilter filter = new AllowedClientCidrsFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setRemoteAddr("not-a-valid-ip-address");
+        when(veeamControlService.getAllowedClientCidrs()).thenReturn(List.of("192.168.10.0/24"));
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(403, response.getStatus());
+        assertEquals("Forbidden", response.getErrorMessage());
+        verifyNoInteractions(chain);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilterTest.java
new file mode 100644
index 000000000000..ba25da38e3e8
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/filter/BearerOrBasicAuthFilterTest.java
@@ -0,0 +1,129 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.filter;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.verifyNoInteractions;
+import static org.mockito.Mockito.when;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+
+import javax.servlet.FilterChain;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.utils.JwtUtil;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+@RunWith(MockitoJUnitRunner.class)
+public class BearerOrBasicAuthFilterTest {
+
+    private static final String SECRET = "very-secret";
+
+    @Mock
+    private VeeamControlService veeamControlService;
+
+    @Mock
+    private FilterChain chain;
+
+    @Test
+    public void testDoFilterRejectsMissingAuthorizationWithJsonPayload() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.addHeader("Accept", "application/json");
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(401, response.getStatus());
+        assertEquals("application/json; charset=UTF-8", response.getContentType());
+        assertNotNull(response.getHeader("WWW-Authenticate"));
+        assertTrue(response.getHeader("WWW-Authenticate").contains("error=\"invalid_token\""));
+        assertTrue(response.getContentAsString().contains("\"error\":\"invalid_token\""));
+        assertTrue(response.getContentAsString().contains("Missing Authorization"));
+        verifyNoInteractions(chain);
+    }
+
+    @Test
+    public void testDoFilterRejectsInvalidBearerToken() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.addHeader("Accept", "application/json");
+        request.addHeader("Authorization", "Bearer not-a-jwt");
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(401, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Invalid or expired token"));
+        verifyNoInteractions(chain);
+    }
+
+    @Test
+    public void testDoFilterAllowsValidBearerTokenWithRequiredScopes() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        final String token = JwtUtil.issueHs256Jwt("service-user", "ovirt-app-admin ovirt-app-portal", 60L, SECRET);
+        request.addHeader("Authorization", "Bearer " + token);
+        when(veeamControlService.getHmacSecret()).thenReturn(SECRET);
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+    }
+
+    @Test
+    public void testDoFilterAllowsValidBasicCredentials() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        final String credentials = Base64.getEncoder().encodeToString("veeam:secret".getBytes(StandardCharsets.UTF_8));
+        request.addHeader("Authorization", "Basic " + credentials);
+        when(veeamControlService.validateCredentials("veeam", "secret")).thenReturn(true);
+
+        filter.doFilter(request, response, chain);
+
+        verify(chain).doFilter(request, response);
+    }
+
+    @Test
+    public void testDoFilterRejectsInvalidBasicCredentialsWithHtmlPayload() throws Exception {
+        final BearerOrBasicAuthFilter filter = new BearerOrBasicAuthFilter(veeamControlService);
+        final MockHttpServletRequest request = new MockHttpServletRequest();
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.addHeader("Authorization", "Basic !!!not-base64!!!");
+
+        filter.doFilter(request, response, chain);
+
+        assertEquals(401, response.getStatus());
+        assertEquals("text/html; charset=UTF-8", response.getContentType());
+        assertTrue(response.getContentAsString().contains("Unauthorized"));
+        assertNotNull(response.getHeader("WWW-Authenticate"));
+        assertTrue(response.getHeader("WWW-Authenticate").contains("invalid_client"));
+        verifyNoInteractions(chain);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandlerTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandlerTest.java
new file mode 100644
index 000000000000..cbae87164536
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/services/PkiResourceRouteHandlerTest.java
@@ -0,0 +1,127 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.services;
+
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Collections;
+
+import org.apache.cloudstack.ca.CAManager;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+@RunWith(MockitoJUnitRunner.class)
+public class PkiResourceRouteHandlerTest {
+
+    @Test
+    public void testCanHandleSanitizesQueryParameters() {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+
+        assertTrue(handler.canHandle("GET", "/services/pki-resource?resource=ca-certificate"));
+    }
+
+    @Test
+    public void testHandleReturnsCertificateDownload() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        final CAManager caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        final String certificate = "-----BEGIN CERTIFICATE-----\nveeam\n-----END CERTIFICATE-----\n";
+        handler.caManager = caManager;
+        when(caManager.getCaCertificate(null)).thenReturn(certificate);
+
+        handler.handle(request, response, "/services/pki-resource", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(200, response.getStatus());
+        assertEquals("no-store", response.getHeader("Cache-Control"));
+        assertEquals("attachment; filename=\"pki-resource.cer\"", response.getHeader("Content-Disposition"));
+        assertEquals("application/x-x509-ca-cert; charset=ISO-8859-1", response.getContentType());
+        assertArrayEquals(certificate.getBytes(StandardCharsets.ISO_8859_1), response.getContentAsByteArray());
+    }
+
+    @Test
+    public void testHandleRejectsUnsupportedResource() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        handler.caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("resource", "unsupported");
+
+        handler.handle(request, response, "/services/pki-resource", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertEquals("Unsupported resource", response.getErrorMessage());
+    }
+
+    @Test
+    public void testHandleRejectsUnsupportedFormat() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        handler.caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("format", "PEM");
+
+        handler.handle(request, response, "/services/pki-resource", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertEquals("Unsupported format", response.getErrorMessage());
+    }
+
+    @Test
+    public void testHandleRejectsEmptyCertificateData() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        final CAManager caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        handler.caManager = caManager;
+        when(caManager.getCaCertificate(null)).thenReturn("");
+
+        handler.handle(request, response, "/services/pki-resource", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(500, response.getStatus());
+        assertEquals("No certificate data available", response.getErrorMessage());
+    }
+
+    @Test
+    public void testHandleReturnsNotFoundForUnknownPath() throws Exception {
+        final PkiResourceRouteHandler handler = new PkiResourceRouteHandler();
+        handler.caManager = mock(CAManager.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/services/pki-resource/unknown");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        handler.handle(request, response, "/services/pki-resource/unknown", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(404, response.getStatus());
+        assertTrue(response.getContentAsString().contains("\"reason\":\"Not found\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/sso/SsoServiceTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/sso/SsoServiceTest.java
new file mode 100644
index 000000000000..d6c2c87fd038
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/sso/SsoServiceTest.java
@@ -0,0 +1,219 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.sso;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import java.nio.charset.StandardCharsets;
+import java.util.Base64;
+import java.util.Collections;
+import java.util.Map;
+
+import org.apache.cloudstack.veeam.VeeamControlService;
+import org.apache.cloudstack.veeam.VeeamControlServlet;
+import org.apache.cloudstack.veeam.utils.Mapper;
+import org.apache.cloudstack.veeam.utils.Negotiation;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+
+import com.fasterxml.jackson.core.type.TypeReference;
+
+@RunWith(MockitoJUnitRunner.class)
+public class SsoServiceTest {
+
+    private final Mapper mapper = new Mapper();
+
+    @Test
+    public void testCanHandleSanitizesQueryParameters() {
+        final SsoService service = new SsoService();
+
+        assertTrue(service.canHandle("POST", "/sso/oauth/token?scope=abc"));
+    }
+
+    @Test
+    public void testHandleReturnsNotFoundForUnknownPath() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/sso/unknown");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        service.handle(request, response, "/sso/unknown", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(404, response.getStatus());
+        assertTrue(response.getContentAsString().contains("\"reason\":\"Not found\""));
+    }
+
+    @Test
+    public void testHandleTokenRejectsNonPostMethod() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("GET", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(405, response.getStatus());
+        assertEquals("POST", response.getHeader("Allow"));
+        assertTrue(response.getContentAsString().contains("method_not_allowed"));
+    }
+
+    @Test
+    public void testHandleTokenRejectsMissingGrantType() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Missing parameter: grant_type"));
+    }
+
+    @Test
+    public void testHandleTokenRejectsUnsupportedGrantType() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "client_credentials");
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertTrue(response.getContentAsString().contains("unsupported_grant_type"));
+    }
+
+    @Test
+    public void testHandleTokenRejectsMissingCredentials() throws Exception {
+        final SsoService service = new SsoService();
+        service.veeamControlService = mock(VeeamControlService.class);
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(400, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Missing username/password"));
+    }
+
+    @Test
+    public void testHandleTokenRejectsInvalidCredentials() throws Exception {
+        final SsoService service = new SsoService();
+        final VeeamControlService controlService = mock(VeeamControlService.class);
+        service.veeamControlService = controlService;
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+        request.setParameter("password", "wrong");
+        when(controlService.validateCredentials("veeam", "wrong")).thenReturn(false);
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(401, response.getStatus());
+        assertTrue(response.getContentAsString().contains("invalid_grant"));
+    }
+
+    @Test
+    public void testHandleTokenReturnsServerErrorWhenTokenIssuanceFails() throws Exception {
+        final SsoService service = new SsoService();
+        final VeeamControlService controlService = mock(VeeamControlService.class);
+        service.veeamControlService = controlService;
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+        request.setParameter("password", "secret");
+        when(controlService.validateCredentials("veeam", "secret")).thenReturn(true);
+        when(controlService.getHmacSecret()).thenReturn(null);
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(500, response.getStatus());
+        assertTrue(response.getContentAsString().contains("Failed to issue token"));
+    }
+
+    @Test
+    public void testHandleTokenIssuesTokenWithDefaultScopes() throws Exception {
+        final SsoService service = new SsoService();
+        final VeeamControlService controlService = mock(VeeamControlService.class);
+        service.veeamControlService = controlService;
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+        request.setParameter("password", "secret");
+        when(controlService.validateCredentials("veeam", "secret")).thenReturn(true);
+        when(controlService.getHmacSecret()).thenReturn("very-secret");
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(200, response.getStatus());
+
+        final Map<String, Object> payload = mapper.jsonMapper().readValue(response.getContentAsByteArray(), new TypeReference<>() {
+        });
+        assertEquals("bearer", payload.get("token_type"));
+        assertEquals(3600, ((Number) payload.get("expires_in")).intValue());
+        assertEquals(String.join(" ", SsoService.REQUIRED_SCOPES), payload.get("scope"));
+
+        final String accessToken = (String) payload.get("access_token");
+        final String jwtPayload = new String(Base64.getUrlDecoder().decode(accessToken.split("\\.")[1]), StandardCharsets.UTF_8);
+        final Map<String, Object> jwtClaims = mapper.jsonMapper().readValue(jwtPayload, new TypeReference<>() {
+        });
+        assertEquals("veeam", jwtClaims.get("sub"));
+        assertEquals(String.join(" ", SsoService.REQUIRED_SCOPES), jwtClaims.get("scope"));
+    }
+
+    @Test
+    public void testHandleTokenHonorsCustomScope() throws Exception {
+        final SsoService service = new SsoService();
+        final VeeamControlService controlService = mock(VeeamControlService.class);
+        service.veeamControlService = controlService;
+        final MockHttpServletRequest request = new MockHttpServletRequest("POST", "/sso/oauth/token");
+        final MockHttpServletResponse response = new MockHttpServletResponse();
+        request.setParameter("grant_type", "password");
+        request.setParameter("username", "veeam");
+        request.setParameter("password", "secret");
+        request.setParameter("scope", "custom-scope");
+        when(controlService.validateCredentials("veeam", "secret")).thenReturn(true);
+        when(controlService.getHmacSecret()).thenReturn("very-secret");
+
+        service.handle(request, response, "/sso/oauth/token", Negotiation.OutFormat.JSON,
+                new VeeamControlServlet(Collections.emptyList()));
+
+        assertEquals(200, response.getStatus());
+        assertTrue(response.getContentAsString().contains("\"scope\":\"custom-scope\""));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/CloudConfigUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/CloudConfigUtilTest.java
new file mode 100644
index 000000000000..ca56e9a74061
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/CloudConfigUtilTest.java
@@ -0,0 +1,82 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+
+import java.util.Optional;
+
+import org.junit.Test;
+
+public class CloudConfigUtilTest {
+
+    @Test
+    public void testExtractIpv4Address_ReturnsIpv4FromNetworkConfigWriteFile() {
+        final String userData = "#cloud-config\n"
+                + "write_files:\n"
+                + "  - path: /etc/network/network_config.yml\n"
+                + "    content: |\n"
+                + "      interfaces:\n"
+                + "        - ipv4:\n"
+                + "            enabled: true\n"
+                + "            dhcp: false\n"
+                + "            address:\n"
+                + "              - ip: 10.20.30.40\n";
+
+        final Optional<String> result = CloudConfigUtil.extractIpv4Address(userData);
+
+        assertEquals(Optional.of("10.20.30.40"), result);
+    }
+
+    @Test
+    public void testExtractIpv4Address_ReturnsEmptyWhenNetworkConfigUsesDhcp() {
+        final String userData = "#cloud-config\n"
+                + "write_files:\n"
+                + "  - path: /etc/network/network_config.yml\n"
+                + "    content: |\n"
+                + "      interfaces:\n"
+                + "        - ipv4:\n"
+                + "            enabled: true\n"
+                + "            dhcp: true\n"
+                + "            address:\n"
+                + "              - ip: 10.20.30.40\n";
+
+        assertFalse(CloudConfigUtil.extractIpv4Address(userData).isPresent());
+    }
+
+    @Test
+    public void testExtractIpv4Address_ReturnsEmptyForInvalidYaml() {
+        assertFalse(CloudConfigUtil.extractIpv4Address("write_files: [").isPresent());
+    }
+
+    @Test
+    public void testExtractIpv4Address_NormalizesEscapedNewLines() {
+        final String userData = "write_files:\\n"
+                + "  - path: /tmp/network_config.yml\\n"
+                + "    content: |\\n"
+                + "      interfaces:\\n"
+                + "        - ipv4:\\n"
+                + "            enabled: true\\n"
+                + "            dhcp: false\\n"
+                + "            address:\\n"
+                + "              - ip: 192.168.1.25\\n";
+
+        assertEquals(Optional.of("192.168.1.25"), CloudConfigUtil.extractIpv4Address(userData));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/DataUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/DataUtilTest.java
new file mode 100644
index 000000000000..a576557a26b0
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/DataUtilTest.java
@@ -0,0 +1,57 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+
+import org.junit.Test;
+
+public class DataUtilTest {
+
+    @Test
+    public void testB64Url_UsesUrlSafeAlphabetAndNoPadding() {
+        final String encoded = DataUtil.b64Url(new byte[]{(byte) 0xfb, (byte) 0xff});
+        assertEquals("-_8", encoded);
+    }
+
+    @Test
+    public void testJsonEscape_NullAndEscapedCharacters() {
+        assertEquals("", DataUtil.jsonEscape(null));
+        assertEquals("a\\\\b\\\"c", DataUtil.jsonEscape("a\\b\"c"));
+    }
+
+    @Test
+    public void testConstantTimeEquals_StringOverload() {
+        assertTrue(DataUtil.constantTimeEquals("abc", "abc"));
+        assertFalse(DataUtil.constantTimeEquals("abc", "abcd"));
+        assertFalse(DataUtil.constantTimeEquals(null, "abc"));
+        assertFalse(DataUtil.constantTimeEquals("abc", null));
+    }
+
+    @Test
+    public void testConstantTimeEquals_ByteArrayOverload() {
+        final byte[] left = "sample".getBytes(StandardCharsets.UTF_8);
+        assertTrue(DataUtil.constantTimeEquals(left, "sample".getBytes(StandardCharsets.UTF_8)));
+        assertFalse(DataUtil.constantTimeEquals(left, "samples".getBytes(StandardCharsets.UTF_8)));
+        assertFalse(DataUtil.constantTimeEquals(left, "samplE".getBytes(StandardCharsets.UTF_8)));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/JwtUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/JwtUtilTest.java
new file mode 100644
index 000000000000..255eec3744b6
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/JwtUtilTest.java
@@ -0,0 +1,79 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertArrayEquals;
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertTrue;
+
+import java.nio.charset.StandardCharsets;
+import java.time.Instant;
+import java.util.Base64;
+
+import org.junit.Test;
+
+import com.google.gson.JsonObject;
+import com.google.gson.JsonParser;
+
+public class JwtUtilTest {
+
+    @Test
+    public void testHmacSha256_KnownVector() throws Exception {
+        final byte[] actual = JwtUtil.hmacSha256("data".getBytes(StandardCharsets.UTF_8), "key".getBytes(StandardCharsets.UTF_8));
+        final byte[] expected = hexToBytes("5031fe3d989c6d1537a013fa6e739da23463fdaec3b70137d828e36ace221bd0");
+        assertArrayEquals(expected, actual);
+    }
+
+    @Test
+    public void testIssueHs256Jwt_BuildsValidTokenAndClaims() throws Exception {
+        final long before = Instant.now().getEpochSecond();
+        final String token = JwtUtil.issueHs256Jwt("sub-1", "scope-a", 120L, "very-secret");
+        final long after = Instant.now().getEpochSecond();
+
+        final String[] parts = token.split("\\.");
+        assertEquals(3, parts.length);
+
+        final JsonObject header = JsonParser.parseString(new String(Base64.getUrlDecoder().decode(parts[0]), StandardCharsets.UTF_8)).getAsJsonObject();
+        final JsonObject payload = JsonParser.parseString(new String(Base64.getUrlDecoder().decode(parts[1]), StandardCharsets.UTF_8)).getAsJsonObject();
+
+        assertEquals("HS256", header.get("alg").getAsString());
+        assertEquals("JWT", header.get("typ").getAsString());
+        assertEquals(JwtUtil.ISSUER, payload.get("iss").getAsString());
+        assertEquals("sub-1", payload.get("sub").getAsString());
+        assertEquals("scope-a", payload.get("scope").getAsString());
+
+        final long iat = payload.get("iat").getAsLong();
+        final long exp = payload.get("exp").getAsLong();
+        assertTrue(iat >= before && iat <= after);
+        assertEquals(120L, exp - iat);
+
+        final byte[] expectedSig = JwtUtil.hmacSha256((parts[0] + "." + parts[1]).getBytes(StandardCharsets.UTF_8), "very-secret".getBytes(StandardCharsets.UTF_8));
+        final byte[] actualSig = Base64.getUrlDecoder().decode(parts[2]);
+        assertArrayEquals(expectedSig, actualSig);
+    }
+
+    private static byte[] hexToBytes(final String hex) {
+        final byte[] out = new byte[hex.length() / 2];
+        for (int i = 0; i < out.length; i++) {
+            final int hi = Character.digit(hex.charAt(i * 2), 16);
+            final int lo = Character.digit(hex.charAt(i * 2 + 1), 16);
+            out[i] = (byte)((hi << 4) + lo);
+        }
+        return out;
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/MapperTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/MapperTest.java
new file mode 100644
index 000000000000..d444386d066d
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/MapperTest.java
@@ -0,0 +1,72 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertFalse;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertTrue;
+
+import org.junit.Test;
+
+public class MapperTest {
+
+    @Test
+    public void testToJson_UsesSnakeCaseAndOmitsNulls() throws Exception {
+        final Mapper mapper = new Mapper();
+        final String json = mapper.toJson(new Sample("John", "Doe", null));
+
+        assertTrue(json.contains("\"first_name\":\"John\""));
+        assertTrue(json.contains("\"last_name\":\"Doe\""));
+        assertFalse(json.contains("optional_field"));
+    }
+
+    @Test
+    public void testToXml_UsesSnakeCaseAndOmitsNulls() throws Exception {
+        final Mapper mapper = new Mapper();
+        final String xml = mapper.toXml(new Sample("John", "Doe", null));
+
+        assertTrue(xml.contains("<first_name>John</first_name>"));
+        assertTrue(xml.contains("<last_name>Doe</last_name>"));
+        assertFalse(xml.contains("optional_field"));
+    }
+
+    @Test
+    public void testJsonMapper_IgnoresUnknownProperties() throws Exception {
+        final Mapper mapper = new Mapper();
+        final Sample sample = mapper.jsonMapper().readValue("{\"first_name\":\"Alice\",\"unknown\":\"x\"}", Sample.class);
+
+        assertNotNull(sample);
+        assertEquals("Alice", sample.firstName);
+    }
+
+    static class Sample {
+        public String firstName;
+        public String lastName;
+        public String optionalField;
+
+        Sample() {
+        }
+
+        Sample(final String firstName, final String lastName, final String optionalField) {
+            this.firstName = firstName;
+            this.lastName = lastName;
+            this.optionalField = optionalField;
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/NegotiationTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/NegotiationTest.java
new file mode 100644
index 000000000000..fb08f14b24eb
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/NegotiationTest.java
@@ -0,0 +1,66 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
+import javax.servlet.http.HttpServletRequest;
+
+import org.junit.Test;
+
+public class NegotiationTest {
+
+    @Test
+    public void testResponseFormat_DefaultsToXmlForNullBlankWildcardAndUnknown() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+
+        when(request.getHeader("Accept")).thenReturn(null);
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("   ");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("*/*");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("application/octet-stream");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+    }
+
+    @Test
+    public void testResponseFormat_ResolvesJsonAndXmlMediaTypesCaseInsensitively() {
+        final HttpServletRequest request = mock(HttpServletRequest.class);
+
+        when(request.getHeader("Accept")).thenReturn("Application/JSON");
+        assertEquals(Negotiation.OutFormat.JSON, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("application/xml");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+
+        when(request.getHeader("Accept")).thenReturn("text/xml");
+        assertEquals(Negotiation.OutFormat.XML, Negotiation.responseFormat(request));
+    }
+
+    @Test
+    public void testContentType_ReturnsMimeTypeForEachFormat() {
+        assertEquals("application/json", Negotiation.contentType(Negotiation.OutFormat.JSON));
+        assertEquals("application/xml", Negotiation.contentType(Negotiation.OutFormat.XML));
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/PathUtilTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/PathUtilTest.java
new file mode 100644
index 000000000000..f069c724c704
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/PathUtilTest.java
@@ -0,0 +1,54 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNull;
+
+import java.util.List;
+
+import org.junit.Test;
+
+public class PathUtilTest {
+
+    @Test
+    public void testExtractIdAndSubPath_ReturnsNullForBlankOrInvalidPath() {
+        assertNull(PathUtil.extractIdAndSubPath(null, "/api/datacenters"));
+        assertNull(PathUtil.extractIdAndSubPath("   ", "/api/datacenters"));
+        assertNull(PathUtil.extractIdAndSubPath("api/datacenters/123", "/api/datacenters"));
+        assertNull(PathUtil.extractIdAndSubPath("/api/datacenters", "/api/datacenters"));
+    }
+
+    @Test
+    public void testExtractIdAndSubPath_RemovesBaseRouteAndReturnsSegments() {
+        final List<String> parts = PathUtil.extractIdAndSubPath("/api/datacenters/123/sub/path", "/api/datacenters");
+        assertEquals(List.of("123", "sub", "path"), parts);
+    }
+
+    @Test
+    public void testExtractIdAndSubPath_HandlesTrailingSlashBaseAndRepeatedSlashes() {
+        final List<String> parts = PathUtil.extractIdAndSubPath("/api/datacenters//123///child/", "/api/datacenters/");
+        assertEquals(List.of("123", "child"), parts);
+    }
+
+    @Test
+    public void testExtractIdAndSubPath_WithoutBaseRouteUsesPathDirectly() {
+        final List<String> parts = PathUtil.extractIdAndSubPath("/id-1/sub", "");
+        assertEquals(List.of("id-1", "sub"), parts);
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/ResponseWriterTest.java b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/ResponseWriterTest.java
new file mode 100644
index 000000000000..241d92f7c933
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/java/org/apache/cloudstack/veeam/utils/ResponseWriterTest.java
@@ -0,0 +1,116 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.veeam.utils;
+
+import static org.junit.Assert.assertTrue;
+import static org.mockito.ArgumentMatchers.anyInt;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.io.PrintWriter;
+import java.io.StringWriter;
+
+import javax.servlet.http.HttpServletResponse;
+
+import org.junit.Test;
+
+public class ResponseWriterTest {
+
+    @Test
+    public void testWrite_NullBodySetsStatusAndZeroContentLength() throws Exception {
+        final Mapper mapper = new Mapper();
+        final ResponseWriter responseWriter = new ResponseWriter(mapper);
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+
+        responseWriter.write(response, 204, null, Negotiation.OutFormat.XML);
+
+        verify(response).setStatus(204);
+        verify(response).setContentLength(0);
+        verify(response, never()).getWriter();
+    }
+
+    @Test
+    public void testWrite_JsonBodyWritesPayloadAndHeaders() throws Exception {
+        final ResponseWriter responseWriter = new ResponseWriter(new Mapper());
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        when(response.getWriter()).thenReturn(new PrintWriter(sink));
+
+        responseWriter.write(response, 200, new Payload("item-1"), Negotiation.OutFormat.JSON);
+
+        verify(response).setStatus(200);
+        verify(response).setHeader("Content-Type", "application/json");
+        assertTrue(sink.toString().contains("\"name\":\"item-1\""));
+    }
+
+    @Test
+    public void testWrite_XmlBodyWritesPayloadAndHeaders() throws Exception {
+        final ResponseWriter responseWriter = new ResponseWriter(new Mapper());
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        when(response.getWriter()).thenReturn(new PrintWriter(sink));
+
+        responseWriter.write(response, 200, new Payload("item-2"), Negotiation.OutFormat.XML);
+
+        verify(response).setHeader("Content-Type", "application/xml");
+        assertTrue(sink.toString().contains("<name>item-2</name>"));
+    }
+
+    @Test
+    public void testWrite_WhenMappingFailsReturnsInternalServerError() throws Exception {
+        final Mapper mapper = mock(Mapper.class);
+        doThrow(new RuntimeException("boom")).when(mapper).toJson(org.mockito.ArgumentMatchers.any());
+
+        final ResponseWriter responseWriter = new ResponseWriter(mapper);
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        when(response.getWriter()).thenReturn(new PrintWriter(sink));
+
+        responseWriter.write(response, 200, new Payload("ignored"), Negotiation.OutFormat.JSON);
+
+        verify(response).setStatus(500);
+        verify(response).setHeader("Content-Type", "text/plain");
+        assertTrue(sink.toString().contains("Internal Server Error"));
+        verify(response, never()).setContentLength(anyInt());
+    }
+
+    @Test
+    public void testWriteFault_JsonWritesFaultStructure() throws Exception {
+        final ResponseWriter responseWriter = new ResponseWriter(new Mapper());
+        final HttpServletResponse response = mock(HttpServletResponse.class);
+        final StringWriter sink = new StringWriter();
+        when(response.getWriter()).thenReturn(new PrintWriter(sink));
+
+        responseWriter.writeFault(response, 404, "Not Found", "missing vm", Negotiation.OutFormat.JSON);
+
+        verify(response).setStatus(404);
+        assertTrue(sink.toString().contains("\"reason\":\"Not Found\""));
+        assertTrue(sink.toString().contains("\"detail\":\"missing vm\""));
+    }
+
+    static class Payload {
+        public String name;
+
+        Payload(final String name) {
+            this.name = name;
+        }
+    }
+}
diff --git a/plugins/integrations/veeam-control-service/src/test/resources/test-ovf.xml b/plugins/integrations/veeam-control-service/src/test/resources/test-ovf.xml
new file mode 100644
index 000000000000..ed22ca632398
--- /dev/null
+++ b/plugins/integrations/veeam-control-service/src/test/resources/test-ovf.xml
@@ -0,0 +1,225 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  Licensed to the Apache Software Foundation (ASF) under one
+  or more contributor license agreements.  See the NOTICE file
+  distributed with this work for additional information
+  regarding copyright ownership.  The ASF licenses this file
+  to you under the Apache License, Version 2.0 (the
+  "License"); you may not use this file except in compliance
+  with the License.  You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing,
+  software distributed under the License is distributed on an
+  "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+  KIND, either express or implied.  See the License for the
+  specific language governing permissions and limitations
+  under the License.
+-->
+<ovf:Envelope
+        xmlns:ovf="http://schemas.dmtf.org/ovf/envelope/1/"
+        xmlns:rasd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_ResourceAllocationSettingData"
+        xmlns:vssd="http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_VirtualSystemSettingData"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" ovf:version="4.4.0.0">
+  <References>
+    <File ovf:href="6af2dd24-1af2-3610-b7b8-de38c98ec958/2efdaae2-6c38-4ac8-ac75-562cf47adba1" ovf:id="2efdaae2-6c38-4ac8-ac75-562cf47adba1" ovf:size="4096" ovf:description="Active VM" ovf:disk_storage_type="IMAGE" ovf:cinder_volume_type=""></File>
+  </References>
+  <NetworkSection>
+    <Info>List of networks</Info>
+    <Network ovf:name="Network-85990692-f734-4695-afe4-aca34a21f459">
+      <Description></Description>
+    </Network>
+  </NetworkSection>
+  <Section xsi:type="ovf:DiskSection_Type">
+    <Info>List of Virtual Disks</Info>
+    <Disk ovf:diskId="2efdaae2-6c38-4ac8-ac75-562cf47adba1" ovf:size="1" ovf:actual_size="1" ovf:vm_snapshot_id="dfa11f00-f92d-353b-8dbe-a653a0a4315b" ovf:parentRef="" ovf:fileRef="6af2dd24-1af2-3610-b7b8-de38c98ec958/2efdaae2-6c38-4ac8-ac75-562cf47adba1" ovf:format="http://www.vmware.com/specifications/vmdk.html#sparse" ovf:volume-format="COW" ovf:volume-type="Sparse" ovf:disk-interface="VirtIO_SCSI" ovf:read-only="false" ovf:shareable="false" ovf:boot="true" ovf:pass-discard="false" ovf:incremental-backup="false" ovf:disk-alias="ROOT-27" ovf:disk-description="ROOT-27" ovf:wipe-after-delete="false"></Disk>
+  </Section>
+  <Section xsi:type="ovf:CloudStackMetadata_Type">
+    <Info>CloudStack specific metadata</Info>
+    <CloudStack>
+      <AccountId>048531b6-4386-11f1-930c-525400580bd0</AccountId>
+      <DomainId>e0afbb58-4385-11f1-930c-525400580bd0</DomainId>
+      <ProjectId></ProjectId>
+      <ServiceOfferingId>ac3edee0-e2fb-4cd1-b6d4-d3b4555203ba</ServiceOfferingId>
+      <DataDiskOfferingIdMap>
+        <Entry>
+          <DiskId>2efdaae2-6c38-4ac8-ac75-562cf47adba1</DiskId>
+          <OfferingId>4de70249-b89d-4f08-9ca2-05ddb4ad1b2a</OfferingId>
+        </Entry>
+      </DataDiskOfferingIdMap>
+      <Details>
+        <Detail>
+          <Key>keyboard</Key>
+          <Value>us</Value>
+        </Detail>
+        <Detail>
+          <Key>skip.force.disk.controller</Key>
+          <Value>true</Value>
+        </Detail>
+        <Detail>
+          <Key>nicAdapter</Key>
+          <Value>virtio</Value>
+        </Detail>
+        <Detail>
+          <Key>rootDiskController</Key>
+          <Value>osdefault</Value>
+        </Detail>
+      </Details>
+      <Nics>
+        <Nic>
+          <Id>85990692-f734-4695-afe4-aca34a21f459</Id>
+          <NetworkId>6aff2178-a323-4148-a592-edbd47b93229</NetworkId>
+          <MACAddress>02:01:00:cf:00:05</MACAddress>
+          <Ip4Address>10.1.1.40</Ip4Address>
+          <Ip6Address></Ip6Address>
+        </Nic>
+      </Nics>
+    </CloudStack>
+  </Section>
+  <Content ovf:id="out" xsi:type="ovf:VirtualSystem_Type">
+    <Name>test-vm1</Name>
+    <Description>test-vm1</Description>
+    <Comment></Comment>
+    <CreationDate>2026/05/06 18:29:58</CreationDate>
+    <ExportDate>2026/05/06 18:47:55</ExportDate>
+    <DeleteProtected>false</DeleteProtected>
+    <SsoMethod>guest_agent</SsoMethod>
+    <IsSmartcardEnabled>false</IsSmartcardEnabled>
+    <NumOfIoThreads>1</NumOfIoThreads>
+    <TimeZone>Etc/GMT</TimeZone>
+    <default_boot_sequence>0</default_boot_sequence>
+    <Generation>11</Generation>
+    <ClusterCompatibilityVersion>4.8</ClusterCompatibilityVersion>
+    <VmType>1</VmType>
+    <ResumeBehavior>AUTO_RESUME</ResumeBehavior>
+    <MinAllocatedMem>512</MinAllocatedMem>
+    <IsStateless>false</IsStateless>
+    <IsRunAndPause>false</IsRunAndPause>
+    <AutoStartup>false</AutoStartup>
+    <Priority>0</Priority>
+    <CreatedByUserId>048531b6-4386-11f1-930c-525400580bd0</CreatedByUserId>
+    <MigrationSupport>0</MigrationSupport>
+    <IsBootMenuEnabled>false</IsBootMenuEnabled>
+    <IsSpiceFileTransferEnabled>true</IsSpiceFileTransferEnabled>
+    <IsSpiceCopyPasteEnabled>true</IsSpiceCopyPasteEnabled>
+    <AllowConsoleReconnect>false</AllowConsoleReconnect>
+    <ConsoleDisconnectAction>LOCK_SCREEN</ConsoleDisconnectAction>
+    <ConsoleDisconnectActionDelay>0</ConsoleDisconnectActionDelay>
+    <CustomEmulatedMachine></CustomEmulatedMachine>
+    <BiosType>3</BiosType>
+    <CustomCpuName></CustomCpuName>
+    <PredefinedProperties></PredefinedProperties>
+    <UserDefinedProperties></UserDefinedProperties>
+    <MaxMemorySizeMb>512</MaxMemorySizeMb>
+    <MultiQueuesEnabled>true</MultiQueuesEnabled>
+    <VirtioScsiMultiQueuesEnabled>false</VirtioScsiMultiQueuesEnabled>
+    <UseHostCpu>false</UseHostCpu>
+    <BalloonEnabled>false</BalloonEnabled>
+    <CpuPinningPolicy>0</CpuPinningPolicy>
+    <ClusterName></ClusterName>
+    <TemplateId>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</TemplateId>
+    <TemplateName>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</TemplateName>
+    <IsInitilized>true</IsInitilized>
+    <Origin>3</Origin>
+    <quota_id>00000000-0000-0000-0000-000000000000</quota_id>
+    <DefaultDisplayType>2</DefaultDisplayType>
+    <TrustedService>false</TrustedService>
+    <OriginalTemplateId>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</OriginalTemplateId>
+    <OriginalTemplateName>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</OriginalTemplateName>
+    <UseLatestVersion>false</UseLatestVersion>
+    <StopTime>2026/05/06 18:29:58</StopTime>
+    <BootTime>2026/05/06 18:29:58</BootTime>
+    <Downtime>0</Downtime>
+    <Section ovf:id="649d4d91-7cad-4541-a0a4-3930472f95ec" ovf:required="false" xsi:type="ovf:OperatingSystemSection_Type">
+      <Info>Guest Operating System</Info>
+      <Description>linux</Description>
+    </Section>
+    <Section xsi:type="ovf:VirtualHardwareSection_Type">
+      <Info>1 CPU, 512 Memory</Info>
+      <System>
+        <vssd:VirtualSystemType>ENGINE 4.4.0.0</vssd:VirtualSystemType>
+      </System>
+      <Item>
+        <rasd:Caption>1 virtual cpu</rasd:Caption>
+        <rasd:Description>Number of virtual CPU</rasd:Description>
+        <rasd:InstanceId>1</rasd:InstanceId>
+        <rasd:ResourceType>3</rasd:ResourceType>
+        <rasd:num_of_sockets>1</rasd:num_of_sockets>
+        <rasd:cpu_per_socket>1</rasd:cpu_per_socket>
+        <rasd:threads_per_cpu>1</rasd:threads_per_cpu>
+        <rasd:max_num_of_vcpus>1</rasd:max_num_of_vcpus>
+        <rasd:VirtualQuantity>1</rasd:VirtualQuantity>
+      </Item>
+      <Item>
+        <rasd:Caption>512 MB of memory</rasd:Caption>
+        <rasd:Description>Memory Size</rasd:Description>
+        <rasd:InstanceId>2</rasd:InstanceId>
+        <rasd:ResourceType>4</rasd:ResourceType>
+        <rasd:AllocationUnits>byte * 2^20</rasd:AllocationUnits>
+        <rasd:VirtualQuantity>512</rasd:VirtualQuantity>
+      </Item>
+      <Item>
+        <rasd:Caption>ROOT-27</rasd:Caption>
+        <rasd:InstanceId>2efdaae2-6c38-4ac8-ac75-562cf47adba1</rasd:InstanceId>
+        <rasd:ResourceType>17</rasd:ResourceType>
+        <rasd:HostResource>6af2dd24-1af2-3610-b7b8-de38c98ec958/2efdaae2-6c38-4ac8-ac75-562cf47adba1</rasd:HostResource>
+        <rasd:Parent>00000000-0000-0000-0000-000000000000</rasd:Parent>
+        <rasd:Template>8c367ed8-03d9-4c02-a4a4-f20b796f1b56</rasd:Template>
+        <rasd:ApplicationList></rasd:ApplicationList>
+        <rasd:StorageId>6af2dd24-1af2-3610-b7b8-de38c98ec958</rasd:StorageId>
+        <rasd:StoragePoolId>00000000-0000-0000-0000-000000000000</rasd:StoragePoolId>
+        <rasd:CreationDate>2026/05/06 18:29:58</rasd:CreationDate>
+        <rasd:LastModified>2026/05/06 18:47:55</rasd:LastModified>
+        <rasd:last_modified_date>2026/05/06 18:47:55</rasd:last_modified_date>
+        <Type>disk</Type>
+        <Device>disk</Device>
+        <rasd:Address>{type=drive, bus=0, controller=0, target=0, unit=0}</rasd:Address>
+        <BootOrder>1</BootOrder>
+        <IsPlugged>true</IsPlugged>
+        <IsReadOnly>false</IsReadOnly>
+        <Alias>ua-6af2dd24-1af2-3610-b7b8-de38c98ec958/2efdaae2-6c38-4ac8-ac75-562cf47adba1</Alias>
+      </Item>
+      <Item>
+        <rasd:Caption>Ethernet adapter - ExternalGuestNetworkGuru</rasd:Caption>
+        <rasd:InstanceId>85990692-f734-4695-afe4-aca34a21f459</rasd:InstanceId>
+        <rasd:ResourceType>10</rasd:ResourceType>
+        <rasd:OtherResourceType></rasd:OtherResourceType>
+        <rasd:ResourceSubType>3</rasd:ResourceSubType>
+        <rasd:Connection>Network-85990692-f734-4695-afe4-aca34a21f459</rasd:Connection>
+        <rasd:Linked>true</rasd:Linked>
+        <rasd:Name>ExternalGuestNetworkGuru</rasd:Name>
+        <rasd:ElementName>6aff2178-a323-4148-a592-edbd47b93229</rasd:ElementName>
+        <rasd:MACAddress>02:01:00:cf:00:05</rasd:MACAddress>
+        <rasd:speed>10000</rasd:speed>
+        <Type>interface</Type>
+        <Device>bridge</Device>
+        <rasd:Address>{type=pci, slot=0x00, bus=0x01, domain=0x0000, function=0x0}</rasd:Address>
+        <BootOrder>0</BootOrder>
+        <IsPlugged>true</IsPlugged>
+        <IsReadOnly>false</IsReadOnly>
+        <Alias>ua-85990692-f734-4695-afe4-aca34a21f459</Alias>
+      </Item>
+      <Item>
+        <rasd:Caption>USB Controller</rasd:Caption>
+        <rasd:InstanceId>3</rasd:InstanceId>
+        <rasd:ResourceType>23</rasd:ResourceType>
+        <rasd:UsbPolicy>DISABLED</rasd:UsbPolicy>
+      </Item>
+      <Item>
+        <rasd:ResourceType>0</rasd:ResourceType>
+        <rasd:InstanceId>373a1bbf-b292-31c9-a29c-afeb9ba84c21</rasd:InstanceId>
+        <Type>rng</Type>
+        <Device>virtio</Device>
+        <rasd:Address>{type=pci, slot=0x00, bus=0x06, domain=0x0000, function=0x0}</rasd:Address>
+        <BootOrder>0</BootOrder>
+        <IsPlugged>true</IsPlugged>
+        <IsReadOnly>false</IsReadOnly>
+        <Alias></Alias>
+        <SpecParams>
+          <source>urandom</source>
+        </SpecParams>
+      </Item>
+    </Section>
+  </Content>
+</ovf:Envelope>
diff --git a/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java b/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
index d9f4963165ec..a0b1973fd8e8 100644
--- a/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
+++ b/plugins/network-elements/juniper-contrail/src/test/java/org/apache/cloudstack/network/contrail/management/MockAccountManager.java
@@ -17,18 +17,22 @@
 
 package org.apache.cloudstack.network.contrail.management;
 
+import java.net.InetAddress;
 import java.util.List;
 import java.util.Map;
-import java.net.InetAddress;
 
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
-import com.cloud.api.auth.SetupUserTwoFactorAuthenticationCmd;
+import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.acl.RolePermissionEntity;
+import org.apache.cloudstack.acl.RoleType;
+import org.apache.cloudstack.acl.SecurityChecker.AccessType;
+import org.apache.cloudstack.acl.apikeypair.ApiKeyPair;
 import org.apache.cloudstack.acl.apikeypair.ApiKeyPairPermission;
 import org.apache.cloudstack.api.BaseCmd;
 import org.apache.cloudstack.api.command.admin.account.CreateAccountCmd;
+import org.apache.cloudstack.api.command.admin.account.UpdateAccountCmd;
 import org.apache.cloudstack.api.command.admin.user.DeleteUserCmd;
 import org.apache.cloudstack.api.command.admin.user.DeleteUserKeysCmd;
 import org.apache.cloudstack.api.command.admin.user.GetUserKeysCmd;
@@ -37,20 +41,15 @@
 import org.apache.cloudstack.api.command.admin.user.MoveUserCmd;
 import org.apache.cloudstack.api.command.admin.user.RegisterUserKeysCmd;
 import org.apache.cloudstack.api.command.admin.user.UpdateUserCmd;
+import org.apache.cloudstack.api.response.ApiKeyPairResponse;
+import org.apache.cloudstack.api.response.ListResponse;
 import org.apache.cloudstack.api.response.UserTwoFactorAuthenticationSetupResponse;
 import org.apache.cloudstack.auth.UserTwoFactorAuthenticator;
 import org.apache.cloudstack.backup.BackupOffering;
-import org.apache.cloudstack.framework.config.ConfigKey;
-
-import org.apache.cloudstack.acl.apikeypair.ApiKeyPair;
-import org.apache.cloudstack.acl.ControlledEntity;
-import org.apache.cloudstack.acl.RoleType;
-import org.apache.cloudstack.api.response.ApiKeyPairResponse;
-import org.apache.cloudstack.api.response.ListResponse;
-import org.apache.cloudstack.acl.SecurityChecker.AccessType;
-import org.apache.cloudstack.api.command.admin.account.UpdateAccountCmd;
 import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.framework.config.ConfigKey;
 
+import com.cloud.api.auth.SetupUserTwoFactorAuthenticationCmd;
 import com.cloud.api.query.vo.ControlledViewEntity;
 import com.cloud.configuration.ResourceLimit;
 import com.cloud.configuration.dao.ResourceCountDao;
@@ -598,6 +597,10 @@ public void validateUserPasswordAndUpdateIfNeeded(String newPassword, UserVO use
     public void checkApiAccess(Account account, String command, String apiKey) throws PermissionDeniedException {
     }
 
+    @Override
+    public void checkApiAccess(Account caller, String command) throws PermissionDeniedException {
+    }
+
     @Override
     public UserAccount clearUserTwoFactorAuthenticationInSetupStateOnLogin(UserAccount user) {
         return null;
@@ -614,4 +617,19 @@ public void verifyCallerPrivilegeForUserOrAccountOperations(User user) {
     @Override
     public void checkCallerRoleTypeAllowedForUserOrAccountOperations(Account userAccount, User user) {
     }
+
+    @Override
+    public Account getActiveAccountByUuid(String accountUuid) {
+        return null;
+    }
+
+    @Override
+    public User getOneActiveUserForAccount(Account account) {
+        return null;
+    }
+
+    @Override
+    public Account getAccountByUuid(String accountUuid) {
+        return null;
+    }
 }
diff --git a/plugins/pom.xml b/plugins/pom.xml
index 44220481a6fe..6e2f20c9a7d7 100755
--- a/plugins/pom.xml
+++ b/plugins/pom.xml
@@ -94,6 +94,7 @@
         <module>integrations/cloudian</module>
         <module>integrations/prometheus</module>
         <module>integrations/kubernetes-service</module>
+        <module>integrations/veeam-control-service</module>
 
         <module>metrics</module>
 
diff --git a/scripts/vm/hypervisor/kvm/imageserver/__init__.py b/scripts/vm/hypervisor/kvm/imageserver/__init__.py
new file mode 100644
index 000000000000..7392dfd3b756
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/__init__.py
@@ -0,0 +1,32 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+CloudStack image server — HTTP server backed by NBD over Unix socket or a local file.
+
+Transfer configs are registered/unregistered by the cloudstack-agent via a
+Unix domain control socket (default: /var/run/cloudstack/image-server.sock)
+and stored in-memory for the lifetime of the server process.
+
+Supports two backends (configured per-transfer at registration time):
+- nbd: proxy to an NBD server via Unix socket; supports range reads/writes
+  (GET/PUT/PATCH), extents, zero, flush.
+- file: read/write a local qcow2/raw file; full PUT only, GET with optional
+  ranges, flush.
+
+Run as a systemd service by the CreateImageTransfer CloudStack Agent Command
+"""
diff --git a/scripts/vm/hypervisor/kvm/imageserver/__main__.py b/scripts/vm/hypervisor/kvm/imageserver/__main__.py
new file mode 100644
index 000000000000..e64bd5f65205
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/__main__.py
@@ -0,0 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from .server import main
+
+main()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/backends/__init__.py b/scripts/vm/hypervisor/kvm/imageserver/backends/__init__.py
new file mode 100644
index 000000000000..36080b4cbe73
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/backends/__init__.py
@@ -0,0 +1,36 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from typing import Any, Dict
+
+from .base import BackendSession, ImageBackend
+from .file import FileBackend
+from .nbd import NbdBackend
+
+__all__ = ["BackendSession", "ImageBackend", "FileBackend", "NbdBackend", "create_backend"]
+
+
+def create_backend(cfg: Dict[str, Any]) -> ImageBackend:
+    """Factory: build the correct ImageBackend from a transfer config dict."""
+    backend_type = cfg.get("backend", "nbd")
+    if backend_type == "file":
+        return FileBackend(cfg["file"])
+    return NbdBackend(
+        cfg["socket"],
+        export=cfg.get("export"),
+        export_bitmap=cfg.get("export_bitmap"),
+    )
diff --git a/scripts/vm/hypervisor/kvm/imageserver/backends/base.py b/scripts/vm/hypervisor/kvm/imageserver/backends/base.py
new file mode 100644
index 000000000000..b081640e2d38
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/backends/base.py
@@ -0,0 +1,148 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+from abc import ABC, abstractmethod
+from typing import Any, Dict, List
+
+
+class BackendSession(ABC):
+    """
+    A session that holds an open connection/file handle for the duration of
+    an operation (e.g. a full GET streaming read).  Use as a context manager.
+    """
+
+    @abstractmethod
+    def size(self) -> int:
+        """Return the image size in bytes."""
+        ...
+
+    @abstractmethod
+    def read(self, offset: int, length: int) -> bytes:
+        """
+        Read *length* bytes starting at *offset*.
+
+        For NBD backends, raises RuntimeError if the server returns empty data.
+        For file backends, returns empty bytes at EOF.
+        """
+        ...
+
+    @abstractmethod
+    def close(self) -> None:
+        """Release the underlying connection or file handle."""
+        ...
+
+    def __enter__(self) -> "BackendSession":
+        return self
+
+    def __exit__(self, exc_type: Any, exc: Any, tb: Any) -> None:
+        self.close()
+
+
+class ImageBackend(ABC):
+    """
+    Abstract base class for image storage backends.
+
+    Each backend (NBD, file, etc.) implements this interface so the HTTP handler
+    can operate uniformly without backend-specific branching.
+    """
+
+    @property
+    @abstractmethod
+    def supports_extents(self) -> bool:
+        """Whether this backend supports querying allocation/dirty extents."""
+        ...
+
+    @property
+    @abstractmethod
+    def supports_range_write(self) -> bool:
+        """Whether this backend supports writing at arbitrary byte offsets."""
+        ...
+
+    @abstractmethod
+    def size(self) -> int:
+        """Return the image size in bytes."""
+        ...
+
+    @abstractmethod
+    def read(self, offset: int, length: int) -> bytes:
+        """Read *length* bytes starting at *offset*."""
+        ...
+
+    @abstractmethod
+    def write(self, data: bytes, offset: int) -> None:
+        """Write *data* at *offset*."""
+        ...
+
+    @abstractmethod
+    def write_full(self, stream, content_length: int, flush: bool) -> int:
+        """
+        Consume *content_length* bytes from *stream* and write the full image.
+        Returns bytes written.  Raises on short read.
+        """
+        ...
+
+    @abstractmethod
+    def flush(self) -> None:
+        """Flush pending data to stable storage."""
+        ...
+
+    @abstractmethod
+    def zero(self, offset: int, length: int) -> None:
+        """Zero *length* bytes starting at *offset*."""
+        ...
+
+    @abstractmethod
+    def get_capabilities(self) -> Dict[str, bool]:
+        """
+        Return backend capabilities dict with keys:
+        read_only, can_flush, can_zero.
+        """
+        ...
+
+    @abstractmethod
+    def get_allocation_extents(self) -> List[Dict[str, Any]]:
+        """
+        Return allocation extents as [{"start": int, "length": int, "zero": bool}, ...].
+        """
+        ...
+
+    @abstractmethod
+    def get_dirty_extents(self, dirty_bitmap_context: str) -> List[Dict[str, Any]]:
+        """
+        Return merged dirty+zero extents as
+        [{"start": int, "length": int, "dirty": bool, "zero": bool}, ...].
+        """
+        ...
+
+    @abstractmethod
+    def open_session(self) -> BackendSession:
+        """
+        Open a session that holds a single connection/file handle for the
+        duration of a streaming operation (e.g. GET).
+        """
+        ...
+
+    @abstractmethod
+    def close(self) -> None:
+        """Release any resources held by this backend."""
+        ...
+
+    def __enter__(self) -> "ImageBackend":
+        return self
+
+    def __exit__(self, exc_type: Any, exc: Any, tb: Any) -> None:
+        self.close()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/backends/file.py b/scripts/vm/hypervisor/kvm/imageserver/backends/file.py
new file mode 100644
index 000000000000..9e55bf21fdef
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/backends/file.py
@@ -0,0 +1,123 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import os
+from io import BufferedReader
+from typing import Any, Dict, List, Optional
+
+from ..constants import CHUNK_SIZE
+from .base import BackendSession, ImageBackend
+
+
+class FileSession(BackendSession):
+    """
+    Holds a single file handle open for the duration of a streaming read.
+    Returns empty bytes at EOF (file semantics).
+    """
+
+    def __init__(self, path: str):
+        self._path = path
+        self._fh: Optional[BufferedReader] = open(path, "rb")
+        self._size = os.path.getsize(path)
+
+    def size(self) -> int:
+        return self._size
+
+    def read(self, offset: int, length: int) -> bytes:
+        if self._fh is None:
+            raise RuntimeError("session is closed")
+        self._fh.seek(offset)
+        return self._fh.read(length)
+
+    def close(self) -> None:
+        if self._fh is not None:
+            self._fh.close()
+            self._fh = None
+
+
+class FileBackend(ImageBackend):
+    """
+    ImageBackend implementation backed by a local file (qcow2 or raw).
+    Supports full read/write and flush.  Does not support extents or range writes.
+    """
+
+    def __init__(self, file_path: str):
+        self._path = file_path
+
+    @property
+    def supports_extents(self) -> bool:
+        return False
+
+    @property
+    def supports_range_write(self) -> bool:
+        return False
+
+    def size(self) -> int:
+        return os.path.getsize(self._path)
+
+    def read(self, offset: int, length: int) -> bytes:
+        with open(self._path, "rb") as f:
+            f.seek(offset)
+            return f.read(length)
+
+    def write(self, data: bytes, offset: int) -> None:
+        raise NotImplementedError("file backend does not support range writes")
+
+    def write_full(self, stream: Any, content_length: int, flush: bool) -> int:
+        bytes_written = 0
+        remaining = content_length
+        with open(self._path, "wb") as f:
+            while remaining > 0:
+                chunk = stream.read(min(CHUNK_SIZE, remaining))
+                if not chunk:
+                    raise IOError(
+                        f"request body ended early at {bytes_written} bytes"
+                    )
+                f.write(chunk)
+                bytes_written += len(chunk)
+                remaining -= len(chunk)
+            if flush:
+                f.flush()
+                os.fsync(f.fileno())
+        return bytes_written
+
+    def flush(self) -> None:
+        with open(self._path, "rb") as f:
+            f.flush()
+            os.fsync(f.fileno())
+
+    def zero(self, offset: int, length: int) -> None:
+        raise NotImplementedError("file backend does not support zero")
+
+    def get_capabilities(self) -> Dict[str, bool]:
+        return {
+            "read_only": False,
+            "can_flush": True,
+            "can_zero": False,
+        }
+
+    def get_allocation_extents(self) -> List[Dict[str, Any]]:
+        raise NotImplementedError("file backend does not support extents")
+
+    def get_dirty_extents(self, dirty_bitmap_context: str) -> List[Dict[str, Any]]:
+        raise NotImplementedError("file backend does not support extents")
+
+    def open_session(self) -> FileSession:
+        return FileSession(self._path)
+
+    def close(self) -> None:
+        pass
diff --git a/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py b/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py
new file mode 100644
index 000000000000..c68a3b5188b6
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/backends/nbd.py
@@ -0,0 +1,471 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import logging
+import socket
+from typing import Any, Dict, List, Optional, Tuple
+
+import nbd
+
+from ..constants import (
+    CHUNK_SIZE,
+    NBD_BLOCK_STATUS_CHUNK,
+    NBD_STATE_DIRTY,
+    NBD_STATE_HOLE,
+    NBD_STATE_ZERO,
+)
+from ..util import coalesce_allocation_extents, merge_dirty_zero_extents
+from .base import BackendSession, ImageBackend
+
+
+class NbdConnection:
+    """
+    Low-level helper to connect to an NBD server over a Unix socket.
+    Opens a fresh handle per connection.
+    """
+
+    def __init__(
+        self,
+        socket_path: str,
+        export: Optional[str],
+        need_block_status: bool = False,
+        extra_meta_contexts: Optional[List[str]] = None,
+    ):
+        self._nbd = nbd.NBD()
+
+        if export and hasattr(self._nbd, "set_export_name"):
+            self._nbd.set_export_name(export)
+
+        if need_block_status and hasattr(self._nbd, "add_meta_context"):
+            for ctx in ["base:allocation"] + (extra_meta_contexts or []):
+                try:
+                    self._nbd.add_meta_context(ctx)
+                except Exception as e:
+                    logging.warning("add_meta_context %r failed: %r", ctx, e)
+
+        self._nbd.connect_unix(socket_path)
+
+    def _connect_existing_socket(self, sock: socket.socket) -> None:
+        last_err: Optional[BaseException] = None
+        if hasattr(self._nbd, "connect_socket"):
+            try:
+                self._nbd.connect_socket(sock)
+                return
+            except Exception as e:
+                last_err = e
+                try:
+                    self._nbd.connect_socket(sock.fileno())
+                    return
+                except Exception as e2:
+                    last_err = e2
+        if hasattr(self._nbd, "connect_fd"):
+            try:
+                self._nbd.connect_fd(sock.fileno())
+                return
+            except Exception as e:
+                last_err = e
+        raise RuntimeError(
+            "Unable to connect libnbd using existing socket/fd; "
+            f"binding missing connect_socket/connect_fd or call failed: {last_err!r}"
+        )
+
+    def size(self) -> int:
+        return int(self._nbd.get_size())
+
+    def get_capabilities(self) -> Dict[str, bool]:
+        """
+        Query NBD export capabilities (read_only, can_flush, can_zero) from the
+        server handshake.  Uses getattr for binding name variations.
+        """
+        out: Dict[str, bool] = {
+            "read_only": True,
+            "can_flush": False,
+            "can_zero": False,
+        }
+        for name, keys in [
+            ("read_only", ("is_read_only", "get_read_only")),
+            ("can_flush", ("can_flush", "get_can_flush")),
+            ("can_zero", ("can_zero", "get_can_zero")),
+        ]:
+            for attr in keys:
+                if hasattr(self._nbd, attr):
+                    try:
+                        val = getattr(self._nbd, attr)()
+                        out[name] = bool(val)
+                    except Exception:
+                        pass
+                    break
+        return out
+
+    def pread(self, length: int, offset: int) -> bytes:
+        try:
+            return self._nbd.pread(length, offset)
+        except TypeError:
+            return self._nbd.pread(offset, length)
+
+    def pwrite(self, buf: bytes, offset: int) -> None:
+        try:
+            self._nbd.pwrite(buf, offset)
+        except TypeError:
+            self._nbd.pwrite(offset, buf)
+
+    def pzero(self, offset: int, size: int) -> None:
+        """
+        Zero a byte range.  Uses NBD WRITE_ZEROES when available,
+        otherwise falls back to writing zero bytes via pwrite.
+        """
+        if size <= 0:
+            return
+        for fn_name in ("pwrite_zeros", "zero"):
+            if not hasattr(self._nbd, fn_name):
+                continue
+            fn = getattr(self._nbd, fn_name)
+            try:
+                fn(size, offset)
+                return
+            except TypeError:
+                try:
+                    fn(offset, size)
+                    return
+                except TypeError:
+                    pass
+        remaining = size
+        pos = offset
+        zero_buf = b"\x00" * min(CHUNK_SIZE, size)
+        while remaining > 0:
+            chunk = min(len(zero_buf), remaining)
+            self.pwrite(zero_buf[:chunk], pos)
+            pos += chunk
+            remaining -= chunk
+
+    def flush(self) -> None:
+        if hasattr(self._nbd, "flush"):
+            self._nbd.flush()
+            return
+        if hasattr(self._nbd, "fsync"):
+            self._nbd.fsync()
+            return
+        raise RuntimeError("libnbd binding has no flush/fsync method")
+
+    def get_allocation_extents(self) -> List[Dict[str, Any]]:
+        """
+        Query base:allocation and return all extents as
+        [{"start": ..., "length": ..., "zero": bool}, ...].
+        """
+        size = self.size()
+        if size == 0:
+            return []
+        if not hasattr(self._nbd, "block_status") and not hasattr(
+            self._nbd, "block_status_64"
+        ):
+            return [{"start": 0, "length": size, "zero": False}]
+        if hasattr(self._nbd, "can_meta_context") and not self._nbd.can_meta_context(
+            "base:allocation"
+        ):
+            return [{"start": 0, "length": size, "zero": False}]
+
+        allocation_extents: List[Dict[str, Any]] = []
+        chunk = min(size, NBD_BLOCK_STATUS_CHUNK)
+        offset = 0
+
+        def extent_cb(*args: Any, **kwargs: Any) -> int:
+            if len(args) < 3:
+                return 0
+            metacontext, off, entries = args[0], args[1], args[2]
+            if metacontext != "base:allocation" or entries is None:
+                return 0
+            current = off
+            try:
+                flat = list(entries)
+                for i in range(0, len(flat), 2):
+                    if i + 1 >= len(flat):
+                        break
+                    length = int(flat[i])
+                    flags = int(flat[i + 1])
+                    zero = (flags & (NBD_STATE_HOLE | NBD_STATE_ZERO)) != 0
+                    allocation_extents.append(
+                        {"start": current, "length": length, "zero": zero}
+                    )
+                    current += length
+            except (TypeError, ValueError, IndexError):
+                pass
+            return 0
+
+        block_status_fn = getattr(
+            self._nbd, "block_status_64", getattr(self._nbd, "block_status", None)
+        )
+        if block_status_fn is None:
+            return [{"start": 0, "length": size, "zero": False}]
+        try:
+            while offset < size:
+                count = min(chunk, size - offset)
+                try:
+                    block_status_fn(count, offset, extent_cb)
+                except TypeError:
+                    block_status_fn(offset, count, extent_cb)
+                offset += count
+        except Exception as e:
+            logging.warning("get_allocation_extents block_status failed: %r", e)
+            return [{"start": 0, "length": size, "zero": False}]
+        if not allocation_extents:
+            return [{"start": 0, "length": size, "zero": False}]
+        return coalesce_allocation_extents(allocation_extents)
+
+    def get_extents_dirty_and_zero(
+        self, dirty_bitmap_context: str
+    ) -> List[Dict[str, Any]]:
+        """
+        Query block status for base:allocation and a dirty bitmap context,
+        merge boundaries, and return extents with dirty and zero flags.
+        """
+        size = self.size()
+        if size == 0:
+            return []
+        if not hasattr(self._nbd, "block_status") and not hasattr(
+            self._nbd, "block_status_64"
+        ):
+            return self._fallback_dirty_zero_extents(size)
+        if hasattr(self._nbd, "can_meta_context"):
+            if not self._nbd.can_meta_context("base:allocation"):
+                return self._fallback_dirty_zero_extents(size)
+            if not self._nbd.can_meta_context(dirty_bitmap_context):
+                logging.warning(
+                    "dirty bitmap context %r not negotiated", dirty_bitmap_context
+                )
+                return self._fallback_dirty_zero_extents(size)
+
+        allocation_extents: List[Tuple[int, int, bool]] = []
+        dirty_extents: List[Tuple[int, int, bool]] = []
+        chunk = min(size, NBD_BLOCK_STATUS_CHUNK)
+        offset = 0
+
+        def extent_cb(*args: Any, **kwargs: Any) -> int:
+            if len(args) < 3:
+                return 0
+            metacontext, off, entries = args[0], args[1], args[2]
+            if entries is None or not hasattr(entries, "__iter__"):
+                return 0
+            current = off
+            try:
+                flat = list(entries)
+                for i in range(0, len(flat), 2):
+                    if i + 1 >= len(flat):
+                        break
+                    length = int(flat[i])
+                    flags = int(flat[i + 1])
+                    if metacontext == "base:allocation":
+                        zero = (flags & (NBD_STATE_HOLE | NBD_STATE_ZERO)) != 0
+                        allocation_extents.append((current, length, zero))
+                    elif metacontext == dirty_bitmap_context:
+                        dirty = (flags & NBD_STATE_DIRTY) != 0
+                        dirty_extents.append((current, length, dirty))
+                    current += length
+            except (TypeError, ValueError, IndexError):
+                pass
+            return 0
+
+        block_status_fn = getattr(
+            self._nbd, "block_status_64", getattr(self._nbd, "block_status", None)
+        )
+        if block_status_fn is None:
+            return self._fallback_dirty_zero_extents(size)
+        try:
+            while offset < size:
+                count = min(chunk, size - offset)
+                try:
+                    block_status_fn(count, offset, extent_cb)
+                except TypeError:
+                    block_status_fn(offset, count, extent_cb)
+                offset += count
+        except Exception as e:
+            logging.warning("get_extents_dirty_and_zero block_status failed: %r", e)
+            return self._fallback_dirty_zero_extents(size)
+        return merge_dirty_zero_extents(allocation_extents, dirty_extents, size)
+
+    @staticmethod
+    def _fallback_dirty_zero_extents(size: int) -> List[Dict[str, Any]]:
+        return [{"start": 0, "length": size, "dirty": False, "zero": False}]
+
+    def close(self) -> None:
+        try:
+            if hasattr(self._nbd, "shutdown"):
+                self._nbd.shutdown()
+        except Exception:
+            pass
+
+    def __enter__(self) -> "NbdConnection":
+        return self
+
+    def __exit__(self, exc_type: Any, exc: Any, tb: Any) -> None:
+        self.close()
+
+
+class NbdSession(BackendSession):
+    """
+    Holds a single NbdConnection open for the duration of a streaming operation.
+    Raises RuntimeError if pread returns empty data (NBD should never do this).
+    """
+
+    def __init__(self, conn: NbdConnection):
+        self._conn = conn
+
+    def size(self) -> int:
+        return self._conn.size()
+
+    def read(self, offset: int, length: int) -> bytes:
+        data = self._conn.pread(length, offset)
+        if not data:
+            raise RuntimeError("backend returned empty read")
+        return data
+
+    def close(self) -> None:
+        self._conn.close()
+
+
+class NbdBackend(ImageBackend):
+    """
+    ImageBackend implementation that proxies to an NBD server via Unix socket.
+    Each public method opens a fresh NbdConnection (per the original design).
+    """
+
+    def __init__(
+        self,
+        socket_path: str,
+        export: Optional[str] = None,
+        export_bitmap: Optional[str] = None,
+    ):
+        self._socket_path = socket_path
+        self._export = export
+        self._export_bitmap = export_bitmap
+
+    @property
+    def supports_extents(self) -> bool:
+        return True
+
+    @property
+    def supports_range_write(self) -> bool:
+        return True
+
+    @property
+    def export_bitmap(self) -> Optional[str]:
+        return self._export_bitmap
+
+    def _connect(
+        self,
+        need_block_status: bool = False,
+        extra_meta_contexts: Optional[List[str]] = None,
+    ) -> NbdConnection:
+        return NbdConnection(
+            self._socket_path,
+            self._export,
+            need_block_status=need_block_status,
+            extra_meta_contexts=extra_meta_contexts,
+        )
+
+    def size(self) -> int:
+        with self._connect() as conn:
+            return conn.size()
+
+    def read(self, offset: int, length: int) -> bytes:
+        with self._connect() as conn:
+            return conn.pread(length, offset)
+
+    def write(self, data: bytes, offset: int) -> None:
+        with self._connect() as conn:
+            conn.pwrite(data, offset)
+
+    def write_full(self, stream: Any, content_length: int, flush: bool) -> int:
+        bytes_written = 0
+        with self._connect() as conn:
+            offset = 0
+            remaining = content_length
+            while remaining > 0:
+                chunk = stream.read(min(CHUNK_SIZE, remaining))
+                if not chunk:
+                    raise IOError(
+                        f"request body ended early at {offset} bytes"
+                    )
+                conn.pwrite(chunk, offset)
+                offset += len(chunk)
+                remaining -= len(chunk)
+                bytes_written += len(chunk)
+            if flush:
+                conn.flush()
+        return bytes_written
+
+    def write_range(self, stream: Any, start_off: int, content_length: int) -> int:
+        """
+        Write *content_length* bytes from *stream* to the image starting at *start_off*.
+        Returns bytes written.  Raises ValueError if offset/length is out of bounds.
+        """
+        bytes_written = 0
+        with self._connect() as conn:
+            image_size = conn.size()
+            if start_off >= image_size:
+                raise ValueError(f"offset {start_off} >= image size {image_size}")
+            max_len = image_size - start_off
+            if content_length > max_len:
+                raise ValueError(
+                    f"content_length {content_length} exceeds available space {max_len}"
+                )
+            offset = start_off
+            remaining = content_length
+            while remaining > 0:
+                chunk = stream.read(min(CHUNK_SIZE, remaining))
+                if not chunk:
+                    raise IOError(
+                        f"request body ended early at {bytes_written} bytes"
+                    )
+                conn.pwrite(chunk, offset)
+                n = len(chunk)
+                offset += n
+                remaining -= n
+                bytes_written += n
+        return bytes_written
+
+    def flush(self) -> None:
+        with self._connect() as conn:
+            conn.flush()
+
+    def zero(self, offset: int, length: int) -> None:
+        with self._connect() as conn:
+            image_size = conn.size()
+            if offset >= image_size:
+                raise ValueError("offset must be less than image size")
+            zero_size = min(length, image_size - offset)
+            conn.pzero(offset, zero_size)
+
+    def get_capabilities(self) -> Dict[str, bool]:
+        with self._connect() as conn:
+            return conn.get_capabilities()
+
+    def get_allocation_extents(self) -> List[Dict[str, Any]]:
+        with self._connect(need_block_status=True) as conn:
+            return conn.get_allocation_extents()
+
+    def get_dirty_extents(self, dirty_bitmap_context: str) -> List[Dict[str, Any]]:
+        extra_contexts: List[str] = [dirty_bitmap_context]
+        with self._connect(
+            need_block_status=True, extra_meta_contexts=extra_contexts
+        ) as conn:
+            return conn.get_extents_dirty_and_zero(dirty_bitmap_context)
+
+    def open_session(self) -> NbdSession:
+        return NbdSession(self._connect())
+
+    def close(self) -> None:
+        pass
diff --git a/scripts/vm/hypervisor/kvm/imageserver/config.py b/scripts/vm/hypervisor/kvm/imageserver/config.py
new file mode 100644
index 000000000000..4bd41c2db56e
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/config.py
@@ -0,0 +1,204 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import logging
+import os
+import threading
+import time
+from contextlib import contextmanager
+from typing import Any, Dict, Iterator, List, Optional
+
+from .constants import DEFAULT_IDLE_TIMEOUT_SECONDS
+
+
+def parse_idle_timeout_seconds(obj: dict) -> int:
+    """Seconds of idle time (no completed HTTP requests) before unregister."""
+    v = obj.get("idle_timeout_seconds", DEFAULT_IDLE_TIMEOUT_SECONDS)
+    if not isinstance(v, int):
+        raise ValueError("idle_timeout_seconds must be an integer")
+    v = int(v)
+    if v < 1:
+        v = 86400
+    return v
+
+
+def validate_transfer_config(obj: dict) -> dict:
+    """
+    Validate and normalize a transfer config dict received over the control
+    socket. Returns the cleaned config or raises ValueError.
+    """
+    idle_sec = parse_idle_timeout_seconds(obj)
+
+    backend = obj.get("backend")
+    if backend is None:
+        backend = "nbd"
+    if not isinstance(backend, str):
+        raise ValueError("invalid backend type")
+    backend = backend.lower()
+    if backend not in ("nbd", "file"):
+        raise ValueError(f"unsupported backend: {backend}")
+
+    if backend == "file":
+        file_path = obj.get("file")
+        if not isinstance(file_path, str) or not file_path.strip():
+            raise ValueError("missing/invalid file path for file backend")
+        return {"backend": "file", "file": file_path.strip(), "idle_timeout_seconds": idle_sec}
+
+    socket_path = obj.get("socket")
+    export = obj.get("export")
+    export_bitmap = obj.get("export_bitmap")
+    if not isinstance(socket_path, str) or not socket_path.strip():
+        raise ValueError("missing/invalid socket path for nbd backend")
+    if export is not None and (not isinstance(export, str) or not export):
+        raise ValueError("invalid export name")
+    return {
+        "backend": "nbd",
+        "socket": socket_path.strip(),
+        "export": export,
+        "export_bitmap": export_bitmap,
+        "idle_timeout_seconds": idle_sec,
+    }
+
+
+def safe_transfer_id(image_id: str) -> Optional[str]:
+    """
+    Only allow a single filename component to avoid path traversal.
+    Rejects anything containing '/' or '\\'.
+    """
+    if not image_id:
+        return None
+    if image_id != os.path.basename(image_id):
+        return None
+    if "/" in image_id or "\\" in image_id:
+        return None
+    if image_id in (".", ".."):
+        return None
+    return image_id
+
+
+class TransferRegistry:
+    """
+    Thread-safe in-memory registry for active image transfer configurations.
+
+    The cloudstack-agent registers/unregisters transfers via the Unix domain
+    control socket.  The HTTP handler looks up configs through get().
+
+    Each transfer may specify idle_timeout_seconds (default DEFAULT_IDLE_TIMEOUT_SECONDS).
+    After no in-flight HTTP requests have completed for that idle period, the transfer
+    is removed (same effect as unregister).
+    """
+
+    def __init__(self) -> None:
+        self._lock = threading.Lock()
+        self._cv = threading.Condition(self._lock)
+        self._transfers: Dict[str, Dict[str, Any]] = {}
+        self._last_activity: Dict[str, float] = {}
+        self._inflight: Dict[str, int] = {}
+
+    def register(self, transfer_id: str, config: Dict[str, Any]) -> bool:
+        safe_id = safe_transfer_id(transfer_id)
+        if safe_id is None:
+            logging.error("register rejected invalid transfer_id=%r", transfer_id)
+            return False
+        with self._lock:
+            self._transfers[safe_id] = config
+            self._last_activity[safe_id] = time.monotonic()
+            self._inflight.pop(safe_id, None)
+            logging.info("registered transfer_id=%s active=%d", safe_id, len(self._transfers))
+            return True
+
+    def unregister(self, transfer_id: str) -> int:
+        """Remove a transfer and return the number of remaining active transfers."""
+        safe_id = safe_transfer_id(transfer_id)
+        if safe_id is None:
+            logging.error("unregister rejected invalid transfer_id=%r", transfer_id)
+            with self._lock:
+                return len(self._transfers)
+        with self._cv:
+            while self._inflight.get(safe_id, 0) > 0:
+                self._cv.wait()
+            self._transfers.pop(safe_id, None)
+            self._last_activity.pop(safe_id, None)
+            self._inflight.pop(safe_id, None)
+            remaining = len(self._transfers)
+            logging.info("unregistered transfer_id=%s active=%d", safe_id, remaining)
+            return remaining
+
+    def get(self, transfer_id: str) -> Optional[Dict[str, Any]]:
+        safe_id = safe_transfer_id(transfer_id)
+        if safe_id is None:
+            return None
+        with self._lock:
+            return self._transfers.get(safe_id)
+
+    def active_count(self) -> int:
+        with self._lock:
+            return len(self._transfers)
+
+    @contextmanager
+    def request_lifecycle(self, transfer_id: str) -> Iterator[None]:
+        """
+        Track an HTTP request for idle-timeout purposes.
+
+        Expiry is based on time since the last request *completed* (all in-flight
+        work for this transfer_id finished). Transfers with active requests are
+        never expired.
+        """
+        safe_id = safe_transfer_id(transfer_id)
+        if safe_id is None:
+            yield
+            return
+        with self._lock:
+            if safe_id not in self._transfers:
+                yield
+                return
+            self._inflight[safe_id] = self._inflight.get(safe_id, 0) + 1
+        try:
+            yield
+        finally:
+            now = time.monotonic()
+            with self._cv:
+                count = self._inflight.get(safe_id, 1) - 1
+                if count <= 0:
+                    self._inflight.pop(safe_id, None)
+                    if safe_id in self._transfers:
+                        self._last_activity[safe_id] = now
+                    self._cv.notify_all()
+                else:
+                    self._inflight[safe_id] = count
+
+    def sweep_expired_transfers(self) -> None:
+        """Remove transfers that exceeded idle_timeout_seconds with no in-flight HTTP work."""
+        now = time.monotonic()
+        with self._lock:
+            expired: List[str] = []
+            for tid, cfg in list(self._transfers.items()):
+                if self._inflight.get(tid, 0) > 0:
+                    continue
+                timeout = int(cfg.get("idle_timeout_seconds", DEFAULT_IDLE_TIMEOUT_SECONDS))
+                last = self._last_activity.get(tid, now)
+                if now - last >= timeout:
+                    expired.append(tid)
+            for tid in expired:
+                self._transfers.pop(tid, None)
+                self._last_activity.pop(tid, None)
+                self._inflight.pop(tid, None)
+                logging.info(
+                    "idle expiry: unregistered transfer_id=%s active=%d",
+                    tid,
+                    len(self._transfers),
+                )
diff --git a/scripts/vm/hypervisor/kvm/imageserver/constants.py b/scripts/vm/hypervisor/kvm/imageserver/constants.py
new file mode 100644
index 000000000000..86d33d57d22c
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/constants.py
@@ -0,0 +1,55 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import logging
+
+# Logging level
+LOGGING_LEVEL = logging.INFO
+
+# Read/Write chunk size for NBD backend
+CHUNK_SIZE = 256 * 1024  # 256 KiB
+
+# NBD base:allocation flags (hole=1, zero=2; hole|zero=3)
+NBD_STATE_HOLE = 1
+NBD_STATE_ZERO = 2
+# NBD qemu:dirty-bitmap flags (dirty=1)
+NBD_STATE_DIRTY = 1
+
+MAX_PARALLEL_READS = 4
+MAX_PARALLEL_WRITES = 4
+
+# HTTP server defaults
+DEFAULT_LISTEN_ADDRESS = "127.0.0.1"
+DEFAULT_HTTP_PORT = 54322
+
+# Control socket
+CONTROL_SOCKET = "/var/run/cloudstack/image-server.sock"
+CONTROL_SOCKET_BACKLOG = 32
+CONTROL_SOCKET_PERMISSIONS = 0o660
+CONTROL_RECV_BUFFER = 4096
+
+# Transfer idle timeout (seconds). A transfer is expired when no in-flight HTTP
+# requests have completed for this duration.
+DEFAULT_IDLE_TIMEOUT_SECONDS = 600
+
+# Maximum size of a JSON body in a PATCH request (zero / flush ops)
+MAX_PATCH_JSON_SIZE = 64 * 1024  # 64 KiB
+
+# Byte range requested per block_status call for NBD extent queries
+NBD_BLOCK_STATUS_CHUNK = 64 * 1024 * 1024  # 64 MiB
+
+CFG_DIR = "/tmp/imagetransfer"
diff --git a/scripts/vm/hypervisor/kvm/imageserver/handler.py b/scripts/vm/hypervisor/kvm/imageserver/handler.py
new file mode 100644
index 000000000000..53bef34b95e4
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/handler.py
@@ -0,0 +1,899 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import json
+import logging
+import re
+from http import HTTPStatus
+from http.server import BaseHTTPRequestHandler
+from typing import Any, Dict, List, Optional, Tuple
+from urllib.parse import parse_qs
+
+from .backends import NbdBackend, create_backend
+from .config import TransferRegistry
+from .constants import CHUNK_SIZE, MAX_PARALLEL_READS, MAX_PARALLEL_WRITES, MAX_PATCH_JSON_SIZE
+from .util import is_fallback_dirty_response, json_bytes, now_s
+
+
+class Handler(BaseHTTPRequestHandler):
+    """
+    HTTP request handler for the image server.
+
+    Routing, HTTP parsing, and response formatting live here.
+    All backend I/O is delegated to ImageBackend implementations via the
+    create_backend() factory.
+
+    Class-level attribute _registry is injected
+    by the server at startup (see server.py / make_handler()).
+    """
+
+    server_version = "cloudstack-image-server/1.0"
+    protocol_version = "HTTP/1.1"
+
+    _registry: TransferRegistry
+
+    _CONTENT_RANGE_RE = re.compile(r"^bytes\s+(\d+)-(\d+)/(?:\*|\d+)$")
+
+    def log_message(self, fmt: str, *args: Any) -> None:
+        logging.debug("%s - - %s", self.client_address[0], fmt % args)
+
+    # ------------------------------------------------------------------
+    # Response helpers
+    # ------------------------------------------------------------------
+
+    def _send_imageio_headers(
+        self, allowed_methods: Optional[str] = None
+    ) -> None:
+        if allowed_methods is None:
+            allowed_methods = "GET, PUT, OPTIONS"
+        self.send_header("Access-Control-Allow-Methods", allowed_methods)
+        self.send_header("Accept-Ranges", "bytes")
+
+    def _send_json(
+        self,
+        status: int,
+        obj: Any,
+        allowed_methods: Optional[str] = None,
+    ) -> None:
+        body = json_bytes(obj)
+        self.send_response(status)
+        self._send_imageio_headers(allowed_methods)
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        try:
+            self.wfile.write(body)
+        except BrokenPipeError:
+            logging.error(
+                "HTTP response write failure status=%s method=%s path=%s err=%s",
+                int(status),
+                self.command,
+                self.path,
+                "client disconnected",
+            )
+
+    def _send_error_json(self, status: int, message: str) -> None:
+        logging.error(
+            "HTTP failure status=%s method=%s path=%s message=%s",
+            int(status),
+            self.command,
+            self.path,
+            message,
+        )
+        self._send_json(status, {"error": message})
+
+    def _send_range_not_satisfiable(self, size: int) -> None:
+        logging.error(
+            "HTTP failure status=%s method=%s path=%s message=%s size=%s",
+            int(HTTPStatus.REQUESTED_RANGE_NOT_SATISFIABLE),
+            self.command,
+            self.path,
+            "range not satisfiable",
+            size,
+        )
+        self.send_response(HTTPStatus.REQUESTED_RANGE_NOT_SATISFIABLE)
+        self._send_imageio_headers()
+        self.send_header("Content-Type", "application/json")
+        self.send_header("Content-Range", f"bytes */{size}")
+        body = json_bytes({"error": "range not satisfiable"})
+        self.send_header("Content-Length", str(len(body)))
+        self.end_headers()
+        try:
+            self.wfile.write(body)
+        except BrokenPipeError:
+            logging.error(
+                "HTTP response write failure status=%s method=%s path=%s err=%s",
+                int(HTTPStatus.REQUESTED_RANGE_NOT_SATISFIABLE),
+                self.command,
+                self.path,
+                "client disconnected",
+            )
+
+    # ------------------------------------------------------------------
+    # Parsing helpers
+    # ------------------------------------------------------------------
+
+    def _parse_single_range(self, range_header: str, size: int) -> Tuple[int, int]:
+        """
+        Parse a single HTTP byte range (RFC 7233) and return (start, end_inclusive).
+        Raises ValueError for invalid headers.
+        """
+        if size < 0:
+            raise ValueError("invalid size")
+        if not range_header:
+            raise ValueError("empty Range")
+        if "," in range_header:
+            raise ValueError("multiple ranges not supported")
+
+        prefix = "bytes="
+        if not range_header.startswith(prefix):
+            raise ValueError("only bytes ranges supported")
+        spec = range_header[len(prefix):].strip()
+        if "-" not in spec:
+            raise ValueError("invalid bytes range")
+
+        left, right = spec.split("-", 1)
+        left = left.strip()
+        right = right.strip()
+
+        if left == "":
+            if right == "":
+                raise ValueError("invalid suffix range")
+            try:
+                suffix_len = int(right, 10)
+            except ValueError as e:
+                raise ValueError("invalid suffix length") from e
+            if suffix_len <= 0:
+                raise ValueError("invalid suffix length")
+            if size == 0:
+                raise ValueError("unsatisfiable")
+            if suffix_len >= size:
+                return 0, size - 1
+            return size - suffix_len, size - 1
+
+        try:
+            start = int(left, 10)
+        except ValueError as e:
+            raise ValueError("invalid range start") from e
+        if start < 0:
+            raise ValueError("invalid range start")
+        if start >= size:
+            raise ValueError("unsatisfiable")
+
+        if right == "":
+            return start, size - 1
+
+        try:
+            end = int(right, 10)
+        except ValueError as e:
+            raise ValueError("invalid range end") from e
+        if end < start:
+            raise ValueError("unsatisfiable")
+        if end >= size:
+            end = size - 1
+        return start, end
+
+    def _parse_route(self) -> Tuple[Optional[str], Optional[str]]:
+        path = self.path.split("?", 1)[0]
+        parts = [p for p in path.split("/") if p]
+        if len(parts) < 2 or parts[0] != "images":
+            return None, None
+        image_id = parts[1]
+        tail = parts[2] if len(parts) >= 3 else None
+        if len(parts) > 3:
+            return None, None
+        return image_id, tail
+
+    def _parse_content_range(self, header: str) -> Tuple[int, int]:
+        """
+        Parse Content-Range header "bytes start-end/*" or "bytes start-end/size".
+        Returns (start, end_inclusive).
+        """
+        if not header:
+            raise ValueError("empty Content-Range")
+        m = self._CONTENT_RANGE_RE.match(header.strip())
+        if not m:
+            raise ValueError("invalid Content-Range")
+        start_s, end_s = m.groups()
+        start = int(start_s, 10)
+        end = int(end_s, 10)
+        if start < 0 or end < start:
+            raise ValueError("invalid Content-Range range")
+        return start, end
+
+    def _parse_query(self) -> Dict[str, List[str]]:
+        if "?" not in self.path:
+            return {}
+        query = self.path.split("?", 1)[1]
+        return parse_qs(query, keep_blank_values=True)
+
+    def _image_cfg(self, image_id: str) -> Optional[Dict[str, Any]]:
+        return self._registry.get(image_id)
+
+    # ------------------------------------------------------------------
+    # HTTP verb dispatchers
+    # ------------------------------------------------------------------
+
+    def do_OPTIONS(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None or tail is not None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        with self._registry.request_lifecycle(image_id):
+            backend = create_backend(cfg)
+            try:
+                max_writers = MAX_PARALLEL_WRITES
+                if not backend.supports_range_write:
+                    max_writers = 1
+
+                if not backend.supports_extents:
+                    allowed_methods = "GET, PUT, POST, OPTIONS"
+                    features = ["flush"]
+                    response = {
+                        "unix_socket": None,
+                        "features": features,
+                        "max_readers": MAX_PARALLEL_READS,
+                        "max_writers": max_writers,
+                    }
+                    self._send_json(HTTPStatus.OK, response, allowed_methods=allowed_methods)
+                    return
+
+                read_only = True
+                can_flush = False
+                can_zero = False
+                try:
+                    caps = backend.get_capabilities()
+                    read_only = caps["read_only"]
+                    can_flush = caps["can_flush"]
+                    can_zero = caps["can_zero"]
+                except Exception as e:
+                    logging.warning("OPTIONS: could not query backend capabilities: %r", e)
+                    read_only = bool(cfg.get("read_only"))
+                    if not read_only:
+                        can_flush = True
+                        can_zero = True
+
+                if read_only:
+                    allowed_methods = "GET, OPTIONS"
+                    features = ["extents"]
+                    max_writers = 0
+                else:
+                    allowed_methods = "GET, PUT, PATCH, OPTIONS"
+                    features = ["extents"]
+                    if can_zero:
+                        features.append("zero")
+                    if can_flush:
+                        features.append("flush")
+
+                response = {
+                    "unix_socket": None,
+                    "features": features,
+                    "max_readers": MAX_PARALLEL_READS,
+                    "max_writers": max_writers,
+                }
+                self._send_json(HTTPStatus.OK, response, allowed_methods=allowed_methods)
+            finally:
+                backend.close()
+
+    def do_GET(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        if tail == "extents":
+            with self._registry.request_lifecycle(image_id):
+                query = self._parse_query()
+                context = (query.get("context") or [None])[0]
+                self._handle_get_extents(image_id, cfg, context=context)
+            return
+        if tail is not None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        range_header = self.headers.get("Range")
+        with self._registry.request_lifecycle(image_id):
+            self._handle_get_image(image_id, cfg, range_header)
+
+    def do_PUT(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None or tail is not None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        with self._registry.request_lifecycle(image_id):
+            if self.headers.get("Range") is not None:
+                self._send_error_json(
+                    HTTPStatus.BAD_REQUEST,
+                    "Range header not supported for PUT; use Content-Range or PATCH",
+                )
+                return
+
+            content_length_hdr = self.headers.get("Content-Length")
+            if content_length_hdr is None:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, "Content-Length required")
+                return
+            try:
+                content_length = int(content_length_hdr)
+            except ValueError:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                return
+            if content_length < 0:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                return
+
+            query = self._parse_query()
+            flush_param = (query.get("flush") or ["n"])[0].lower()
+            flush = flush_param in ("y", "yes", "true", "1")
+
+            content_range_hdr = self.headers.get("Content-Range")
+            if content_range_hdr is not None:
+                backend = create_backend(cfg)
+                try:
+                    if not backend.supports_range_write:
+                        self._send_error_json(
+                            HTTPStatus.BAD_REQUEST,
+                            "Content-Range PUT not supported for file backend; use full PUT",
+                        )
+                        return
+                    self._handle_put_range_with_backend(
+                        image_id,
+                        backend,
+                        content_range_hdr,
+                        content_length,
+                        flush,
+                    )
+                finally:
+                    backend.close()
+                return
+
+            self._handle_put_image(image_id, cfg, content_length, flush)
+
+    def do_POST(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        if tail == "flush":
+            with self._registry.request_lifecycle(image_id):
+                self._handle_post_flush(image_id, cfg)
+            return
+        self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+
+    def do_PATCH(self) -> None:
+        image_id, tail = self._parse_route()
+        if image_id is None or tail is not None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "not found")
+            return
+
+        cfg = self._image_cfg(image_id)
+        if cfg is None:
+            self._send_error_json(HTTPStatus.NOT_FOUND, "unknown image_id")
+            return
+
+        with self._registry.request_lifecycle(image_id):
+            backend = create_backend(cfg)
+            try:
+                if not backend.supports_range_write:
+                    self._send_error_json(
+                        HTTPStatus.BAD_REQUEST,
+                        "range writes and PATCH not supported for file backend; use PUT for full upload",
+                    )
+                    return
+                content_type = self.headers.get("Content-Type", "").split(";")[0].strip().lower()
+                range_header = self.headers.get("Range")
+
+                if range_header is not None and content_type != "application/json":
+                    content_length_hdr = self.headers.get("Content-Length")
+                    if content_length_hdr is None:
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "Content-Length required")
+                        return
+                    try:
+                        content_length = int(content_length_hdr)
+                    except ValueError:
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                        return
+                    if content_length <= 0:
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "Content-Length must be positive")
+                        return
+                    self._handle_patch_range_with_backend(
+                        image_id,
+                        backend,
+                        range_header,
+                        content_length,
+                    )
+                    return
+
+                if content_type != "application/json":
+                    self._send_error_json(
+                        HTTPStatus.UNSUPPORTED_MEDIA_TYPE,
+                        "PATCH requires Content-Type: application/json (for zero/flush) or Range with binary body",
+                    )
+                    return
+
+                content_length_hdr = self.headers.get("Content-Length")
+                if content_length_hdr is None:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "Content-Length required")
+                    return
+                try:
+                    content_length = int(content_length_hdr)
+                except ValueError:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                    return
+                if content_length <= 0 or content_length > MAX_PATCH_JSON_SIZE:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "Invalid Content-Length")
+                    return
+
+                body = self.rfile.read(content_length)
+                if len(body) != content_length:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "request body truncated")
+                    return
+
+                try:
+                    payload = json.loads(body.decode("utf-8"))
+                except (json.JSONDecodeError, UnicodeDecodeError) as e:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, f"invalid JSON: {e}")
+                    return
+
+                if not isinstance(payload, dict):
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "body must be a JSON object")
+                    return
+
+                op = payload.get("op")
+                if op == "flush":
+                    self._handle_post_flush_with_backend(image_id, backend)
+                    return
+                if op != "zero":
+                    self._send_error_json(
+                        HTTPStatus.BAD_REQUEST,
+                        "unsupported op; only \"zero\" and \"flush\" are supported",
+                    )
+                    return
+
+                try:
+                    size = int(payload.get("size"))
+                except (TypeError, ValueError):
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "missing or invalid \"size\"")
+                    return
+                if size <= 0:
+                    self._send_error_json(HTTPStatus.BAD_REQUEST, "\"size\" must be positive")
+                    return
+
+                offset = payload.get("offset")
+                if offset is None:
+                    offset = 0
+                else:
+                    try:
+                        offset = int(offset)
+                    except (TypeError, ValueError):
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "invalid \"offset\"")
+                        return
+                    if offset < 0:
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "\"offset\" must be non-negative")
+                        return
+
+                flush = bool(payload.get("flush", False))
+                self._handle_patch_zero_with_backend(
+                    image_id,
+                    backend,
+                    offset=offset,
+                    size=size,
+                    flush=flush,
+                )
+            finally:
+                backend.close()
+
+    # ------------------------------------------------------------------
+    # Operation handlers
+    # ------------------------------------------------------------------
+
+    def _handle_get_image(
+        self, image_id: str, cfg: Dict[str, Any], range_header: Optional[str]
+    ) -> None:
+        start = now_s()
+        bytes_sent = 0
+        expected_bytes = 0
+        try:
+            logging.debug("GET start image_id=%s range=%s", image_id, range_header or "-")
+            backend = create_backend(cfg)
+            session = None
+            try:
+                session = backend.open_session()
+                size = session.size()
+            except OSError as e:
+                logging.error("GET size error image_id=%s err=%r", image_id, e)
+                self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "failed to access image")
+                if session is not None:
+                    session.close()
+                backend.close()
+                return
+
+            try:
+                start_off = 0
+                end_off_incl = size - 1 if size > 0 else -1
+                status = HTTPStatus.OK
+                content_length = size
+                if range_header is not None:
+                    try:
+                        start_off, end_off_incl = self._parse_single_range(range_header, size)
+                    except ValueError as e:
+                        if "unsatisfiable" in str(e):
+                            self._send_range_not_satisfiable(size)
+                            return
+                        self._send_error_json(HTTPStatus.BAD_REQUEST, "invalid Range header")
+                        return
+                    status = HTTPStatus.PARTIAL_CONTENT
+                    content_length = (end_off_incl - start_off) + 1
+                expected_bytes = content_length
+
+                self.send_response(status)
+                self._send_imageio_headers()
+                self.send_header("Content-Type", "application/octet-stream")
+                self.send_header("Content-Length", str(content_length))
+                if status == HTTPStatus.PARTIAL_CONTENT:
+                    self.send_header("Content-Range", f"bytes {start_off}-{end_off_incl}/{size}")
+                self.end_headers()
+
+                offset = start_off
+                end_excl = end_off_incl + 1
+                while offset < end_excl:
+                    to_read = min(CHUNK_SIZE, end_excl - offset)
+                    data = session.read(offset, to_read)
+                    if not data:
+                        logging.error(
+                            "GET short read image_id=%s expected_bytes=%d sent_bytes=%d offset=%d",
+                            image_id,
+                            expected_bytes,
+                            bytes_sent,
+                            offset,
+                        )
+                        self.close_connection = True
+                        break
+                    try:
+                        self.wfile.write(data)
+                    except BrokenPipeError:
+                        logging.error(
+                            "GET client disconnected image_id=%s at=%d expected_bytes=%d sent_bytes=%d",
+                            image_id,
+                            offset,
+                            expected_bytes,
+                            bytes_sent,
+                        )
+                        self.close_connection = True
+                        break
+                    offset += len(data)
+                    bytes_sent += len(data)
+            finally:
+                session.close()
+                backend.close()
+        except Exception as e:
+            logging.error("GET error image_id=%s err=%r", image_id, e)
+            try:
+                if not self.wfile.closed:
+                    self.close_connection = True
+            except Exception:
+                pass
+        finally:
+            if expected_bytes > 0 and bytes_sent < expected_bytes:
+                logging.error(
+                    "GET incomplete image_id=%s expected_bytes=%d sent_bytes=%d",
+                    image_id,
+                    expected_bytes,
+                    bytes_sent,
+                )
+            dur = now_s() - start
+            logging.debug(
+                "GET end image_id=%s bytes=%d duration_s=%.3f", image_id, bytes_sent, dur
+            )
+
+    def _handle_put_image(
+        self, image_id: str, cfg: Dict[str, Any], content_length: int, flush: bool
+    ) -> None:
+        start = now_s()
+        bytes_written = 0
+        try:
+            logging.debug("PUT start image_id=%s content_length=%d", image_id, content_length)
+            backend = create_backend(cfg)
+            try:
+                bytes_written = backend.write_full(self.rfile, content_length, flush)
+                self._send_json(
+                    HTTPStatus.OK,
+                    {"ok": True, "bytes_written": bytes_written, "flushed": flush},
+                )
+            except IOError as e:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, str(e))
+            finally:
+                backend.close()
+        except Exception as e:
+            logging.error("PUT error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.debug(
+                "PUT end image_id=%s bytes=%d duration_s=%.3f", image_id, bytes_written, dur
+            )
+
+    def _handle_put_range(
+        self,
+        image_id: str,
+        cfg: Dict[str, Any],
+        content_range: str,
+        content_length: int,
+        flush: bool,
+    ) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_put_range_with_backend(
+                image_id,
+                backend,
+                content_range,
+                content_length,
+                flush,
+            )
+        finally:
+            backend.close()
+
+    def _handle_put_range_with_backend(
+        self,
+        image_id: str,
+        backend: NbdBackend,
+        content_range: str,
+        content_length: int,
+        flush: bool,
+    ) -> None:
+        start = now_s()
+        bytes_written = 0
+        try:
+            logging.debug(
+                "PUT range start image_id=%s Content-Range=%s content_length=%d flush=%s",
+                image_id, content_range, content_length, flush,
+            )
+            try:
+                start_off, _end_inclusive = self._parse_content_range(content_range)
+            except ValueError as e:
+                self._send_error_json(
+                    HTTPStatus.BAD_REQUEST, f"invalid Content-Range header: {e}"
+                )
+                return
+
+            try:
+                bytes_written = backend.write_range(self.rfile, start_off, content_length)
+                if flush:
+                    backend.flush()
+                self._send_json(
+                    HTTPStatus.OK,
+                    {"ok": True, "bytes_written": bytes_written, "flushed": flush},
+                )
+            except ValueError:
+                image_size = backend.size()
+                self._send_range_not_satisfiable(image_size)
+            except IOError as e:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, str(e))
+        except Exception as e:
+            logging.error("PUT range error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.debug(
+                "PUT range end image_id=%s bytes=%d duration_s=%.3f flush=%s",
+                image_id, bytes_written, dur, flush,
+            )
+
+    def _handle_get_extents(
+        self, image_id: str, cfg: Dict[str, Any], context: Optional[str] = None
+    ) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_get_extents_with_backend(image_id, backend, context=context)
+        finally:
+            backend.close()
+
+    def _handle_get_extents_with_backend(
+        self, image_id: str, backend: NbdBackend, context: Optional[str] = None
+    ) -> None:
+        start = now_s()
+        try:
+            logging.info("EXTENTS start image_id=%s context=%s", image_id, context)
+            if not backend.supports_extents:
+                self._send_error_json(
+                    HTTPStatus.BAD_REQUEST, "extents not supported for file backend"
+                )
+                return
+            if context == "dirty":
+                export_bitmap = backend.export_bitmap
+                if not export_bitmap:
+                    allocation = backend.get_allocation_extents()
+                    extents: List[Dict[str, Any]] = [
+                        {"start": e["start"], "length": e["length"], "dirty": True, "zero": e["zero"]}
+                        for e in allocation
+                    ]
+                else:
+                    dirty_bitmap_ctx = f"qemu:dirty-bitmap:{export_bitmap}"
+                    extents = backend.get_dirty_extents(dirty_bitmap_ctx)
+                    if is_fallback_dirty_response(extents):
+                        allocation = backend.get_allocation_extents()
+                        extents = [
+                            {
+                                "start": e["start"],
+                                "length": e["length"],
+                                "dirty": True,
+                                "zero": e["zero"],
+                            }
+                            for e in allocation
+                        ]
+            else:
+                extents = backend.get_allocation_extents()
+            self._send_json(HTTPStatus.OK, extents)
+        except Exception as e:
+            logging.error("EXTENTS error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.info("EXTENTS end image_id=%s duration_s=%.3f", image_id, dur)
+
+    def _handle_post_flush(self, image_id: str, cfg: Dict[str, Any]) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_post_flush_with_backend(image_id, backend)
+        finally:
+            backend.close()
+
+    def _handle_post_flush_with_backend(self, image_id: str, backend: NbdBackend) -> None:
+        start = now_s()
+        try:
+            logging.info("FLUSH start image_id=%s", image_id)
+            backend.flush()
+            self._send_json(HTTPStatus.OK, {"ok": True})
+        except Exception as e:
+            logging.error("FLUSH error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.info("FLUSH end image_id=%s duration_s=%.3f", image_id, dur)
+
+    def _handle_patch_zero(
+        self,
+        image_id: str,
+        cfg: Dict[str, Any],
+        offset: int,
+        size: int,
+        flush: bool,
+    ) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_patch_zero_with_backend(image_id, backend, offset, size, flush)
+        finally:
+            backend.close()
+
+    def _handle_patch_zero_with_backend(
+        self,
+        image_id: str,
+        backend: NbdBackend,
+        offset: int,
+        size: int,
+        flush: bool,
+    ) -> None:
+        start = now_s()
+        try:
+            logging.debug(
+                "PATCH zero start image_id=%s offset=%d size=%d flush=%s",
+                image_id, offset, size, flush,
+            )
+            backend.zero(offset, size)
+            if flush:
+                backend.flush()
+            self._send_json(HTTPStatus.OK, {"ok": True})
+        except ValueError as e:
+            self._send_error_json(HTTPStatus.BAD_REQUEST, str(e))
+        except Exception as e:
+            logging.error("PATCH zero error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.debug("PATCH zero end image_id=%s duration_s=%.3f", image_id, dur)
+
+    def _handle_patch_range(
+        self,
+        image_id: str,
+        cfg: Dict[str, Any],
+        range_header: str,
+        content_length: int,
+    ) -> None:
+        backend = create_backend(cfg)
+        try:
+            self._handle_patch_range_with_backend(
+                image_id,
+                backend,
+                range_header,
+                content_length,
+            )
+        finally:
+            backend.close()
+
+    def _handle_patch_range_with_backend(
+        self,
+        image_id: str,
+        backend: NbdBackend,
+        range_header: str,
+        content_length: int,
+    ) -> None:
+        start = now_s()
+        bytes_written = 0
+        try:
+            logging.debug(
+                "PATCH range start image_id=%s range=%s content_length=%d",
+                image_id, range_header, content_length,
+            )
+            try:
+                image_size = backend.size()
+                try:
+                    start_off, end_inclusive = self._parse_single_range(
+                        range_header, image_size
+                    )
+                except ValueError as e:
+                    if "unsatisfiable" in str(e).lower():
+                        self._send_range_not_satisfiable(image_size)
+                    else:
+                        self._send_error_json(
+                            HTTPStatus.BAD_REQUEST, f"invalid Range header: {e}"
+                        )
+                    return
+                expected_len = end_inclusive - start_off + 1
+                if content_length != expected_len:
+                    self._send_error_json(
+                        HTTPStatus.BAD_REQUEST,
+                        f"Content-Length ({content_length}) must equal range length ({expected_len})",
+                    )
+                    return
+                nbd_backend: NbdBackend = backend  # type: ignore[assignment]
+                bytes_written = nbd_backend.write_range(self.rfile, start_off, content_length)
+                self._send_json(HTTPStatus.OK, {"ok": True, "bytes_written": bytes_written})
+            except ValueError:
+                image_size = backend.size()
+                self._send_range_not_satisfiable(image_size)
+            except IOError as e:
+                self._send_error_json(HTTPStatus.BAD_REQUEST, str(e))
+        except Exception as e:
+            logging.error("PATCH range error image_id=%s err=%r", image_id, e)
+            self._send_error_json(HTTPStatus.INTERNAL_SERVER_ERROR, "backend error")
+        finally:
+            dur = now_s() - start
+            logging.debug(
+                "PATCH range end image_id=%s bytes=%d duration_s=%.3f",
+                image_id, bytes_written, dur,
+            )
diff --git a/scripts/vm/hypervisor/kvm/imageserver/server.py b/scripts/vm/hypervisor/kvm/imageserver/server.py
new file mode 100644
index 000000000000..d842c263bb7f
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/server.py
@@ -0,0 +1,222 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import argparse
+import json
+import logging
+import os
+import socket
+import ssl
+import threading
+import time
+from http.server import HTTPServer
+from socketserver import ThreadingMixIn
+from typing import Type
+
+try:
+    from http.server import ThreadingHTTPServer
+except ImportError:
+    class ThreadingHTTPServer(ThreadingMixIn, HTTPServer):  # type: ignore[no-redef]
+        pass
+
+from .config import TransferRegistry, validate_transfer_config
+from .constants import (
+    CONTROL_RECV_BUFFER,
+    CONTROL_SOCKET,
+    CONTROL_SOCKET_BACKLOG,
+    CONTROL_SOCKET_PERMISSIONS,
+    DEFAULT_HTTP_PORT,
+    DEFAULT_LISTEN_ADDRESS,
+    LOGGING_LEVEL
+)
+from .handler import Handler
+
+
+def make_handler(
+    registry: TransferRegistry,
+) -> Type[Handler]:
+    """
+    Create a Handler subclass with injected dependencies.
+
+    BaseHTTPRequestHandler is instantiated per-request by the server, so we
+    cannot pass constructor args. Instead, we set class-level attributes.
+    """
+
+    class ConfiguredHandler(Handler):
+        _registry = registry
+
+    return ConfiguredHandler
+
+
+def _handle_control_conn(conn: socket.socket, registry: TransferRegistry) -> None:
+    """Handle a single control-socket connection (one JSON request/response)."""
+    try:
+        data = b""
+        while True:
+            chunk = conn.recv(CONTROL_RECV_BUFFER)
+            if not chunk:
+                break
+            data += chunk
+            if b"\n" in data:
+                break
+
+        msg = json.loads(data.strip())
+        action = msg.get("action")
+
+        if action == "register":
+            transfer_id = msg.get("transfer_id")
+            raw_config = msg.get("config")
+            if not transfer_id or not isinstance(raw_config, dict):
+                resp = {"status": "error", "message": "missing transfer_id or config"}
+            else:
+                try:
+                    config = validate_transfer_config(raw_config)
+                except ValueError as e:
+                    resp = {"status": "error", "message": str(e)}
+                else:
+                    if registry.register(transfer_id, config):
+                        resp = {"status": "ok", "active_transfers": registry.active_count()}
+                    else:
+                        resp = {"status": "error", "message": "invalid transfer_id"}
+        elif action == "unregister":
+            transfer_id = msg.get("transfer_id")
+            if not transfer_id:
+                resp = {"status": "error", "message": "missing transfer_id"}
+            else:
+                remaining = registry.unregister(transfer_id)
+                resp = {"status": "ok", "active_transfers": remaining}
+        elif action == "status":
+            resp = {"status": "ok", "active_transfers": registry.active_count()}
+        else:
+            resp = {"status": "error", "message": f"unknown action: {action}"}
+
+        conn.sendall((json.dumps(resp) + "\n").encode("utf-8"))
+    except Exception as e:
+        logging.error("control socket error: %r", e)
+        try:
+            conn.sendall((json.dumps({"status": "error", "message": str(e)}) + "\n").encode("utf-8"))
+        except Exception:
+            pass
+    finally:
+        conn.close()
+
+
+def _idle_sweep_loop(registry: TransferRegistry, interval_s: float = 10.0) -> None:
+    while True:
+        time.sleep(interval_s)
+        try:
+            registry.sweep_expired_transfers()
+        except Exception:
+            logging.exception("idle sweep error")
+
+
+def _control_listener(registry: TransferRegistry, sock_path: str) -> None:
+    """Accept loop for the Unix domain control socket (runs in a daemon thread)."""
+    if os.path.exists(sock_path):
+        os.unlink(sock_path)
+    os.makedirs(os.path.dirname(sock_path), exist_ok=True)
+
+    srv = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    srv.bind(sock_path)
+    os.chmod(sock_path, CONTROL_SOCKET_PERMISSIONS)
+    srv.listen(CONTROL_SOCKET_BACKLOG)
+    logging.info("control socket listening on %s", sock_path)
+
+    while True:
+        conn, _ = srv.accept()
+        threading.Thread(
+            target=_handle_control_conn,
+            args=(conn, registry),
+            daemon=True,
+        ).start()
+
+
+def main() -> None:
+    parser = argparse.ArgumentParser(
+        description="CloudStack image server backed by NBD / local file"
+    )
+    parser.add_argument("--listen", default=DEFAULT_LISTEN_ADDRESS, help="Address to bind")
+    parser.add_argument("--port", type=int, default=DEFAULT_HTTP_PORT, help="Port to listen on")
+    parser.add_argument(
+        "--control-socket",
+        default=CONTROL_SOCKET,
+        help="Path to the Unix domain control socket",
+    )
+    parser.add_argument(
+        "--tls-enabled",
+        action="store_true",
+        help="Enable TLS for the HTTP transfer endpoint",
+    )
+    parser.add_argument(
+        "--tls-cert-file",
+        default=None,
+        help="Path to PEM certificate file used when TLS is enabled",
+    )
+    parser.add_argument(
+        "--tls-key-file",
+        default=None,
+        help="Path to PEM private key file used when TLS is enabled",
+    )
+    args = parser.parse_args()
+
+    if args.tls_enabled and (not args.tls_cert_file or not args.tls_key_file):
+        parser.error("--tls-enabled requires --tls-cert-file and --tls-key-file")
+
+    logging.basicConfig(
+        level=LOGGING_LEVEL,
+        format="%(asctime)s %(levelname)s %(message)s",
+    )
+
+    registry = TransferRegistry()
+    handler_cls = make_handler(registry)
+
+    ctrl_thread = threading.Thread(
+        target=_control_listener,
+        args=(registry, args.control_socket),
+        daemon=True,
+    )
+    ctrl_thread.start()
+
+    sweep_thread = threading.Thread(
+        target=_idle_sweep_loop,
+        args=(registry,),
+        daemon=True,
+    )
+    sweep_thread.start()
+
+    addr = (args.listen, args.port)
+    httpd = ThreadingHTTPServer(addr, handler_cls)
+
+    scheme = "http"
+    if args.tls_enabled:
+        context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+
+        if hasattr(ssl, "TLSVersion") and hasattr(context, "minimum_version"):
+            context.minimum_version = ssl.TLSVersion.TLSv1_2
+        else:
+            if hasattr(ssl, "OP_NO_TLSv1"):
+                context.options |= ssl.OP_NO_TLSv1
+            if hasattr(ssl, "OP_NO_TLSv1_1"):
+                context.options |= ssl.OP_NO_TLSv1_1
+
+        context.load_cert_chain(certfile=args.tls_cert_file, keyfile=args.tls_key_file)
+
+        httpd.socket = context.wrap_socket(httpd.socket, server_side=True)
+        scheme = "https"
+
+    logging.info("listening on %s://%s:%d", scheme, args.listen, args.port)
+    httpd.serve_forever()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/__init__.py b/scripts/vm/hypervisor/kvm/imageserver/tests/__init__.py
new file mode 100644
index 000000000000..f8d0ff6d0061
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/__init__.py
@@ -0,0 +1,22 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+Run:
+cd to the directory containing the imageserver folder
+python3 -m unittest discover -s imageserver/tests -t . -v
+"""
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_base.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_base.py
new file mode 100644
index 000000000000..c8703f8a1082
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_base.py
@@ -0,0 +1,568 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+Shared infrastructure for the image-server test suite (stdlib unittest only).
+
+Provides:
+- A singleton image server process started once for the entire test run.
+- Server stdout/stderr appended to ``<tmp>/imageserver.log``.
+- On shutdown: stop the child process, close the log handle, unlink the control socket;
+  the temp directory and ``imageserver.log`` are left on disk.
+- Control-socket helpers using pure-Python AF_UNIX.
+- qemu-nbd server management.
+- Transfer registration / teardown helpers.
+- HTTP helper functions.
+"""
+
+import atexit
+import functools
+import json
+import logging
+import os
+import random
+import signal
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+import unittest
+import uuid
+from pathlib import Path
+from typing import Any, Dict, Optional, TextIO
+
+IMAGE_SIZE = 1 * 1024 * 1024  # 1 MiB
+SERVER_STARTUP_TIMEOUT = 10
+QEMU_NBD_STARTUP_TIMEOUT = 5
+HTTP_TIMEOUT = 30  # seconds per HTTP request
+
+logging.basicConfig(
+    level=logging.INFO,
+    stream=sys.stderr,
+    format="%(asctime)s [TEST] %(message)s",
+)
+log = logging.getLogger(__name__)
+
+
+def randbytes(seed, n):
+    """Generate n deterministic pseudo-random bytes (works on Python 3.6+)."""
+    rng = random.Random(seed)
+    return rng.getrandbits(8 * n).to_bytes(n, "big")
+
+
+def test_timeout(seconds):
+    """Decorator that fails a test if it exceeds *seconds* (SIGALRM, Unix only)."""
+    def decorator(func):
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            def _alarm(signum, frame):
+                raise TimeoutError(
+                    "{} timed out after {}s".format(func.__qualname__, seconds)
+                )
+            prev = signal.signal(signal.SIGALRM, _alarm)
+            signal.alarm(seconds)
+            try:
+                return func(*args, **kwargs)
+            finally:
+                signal.alarm(0)
+                signal.signal(signal.SIGALRM, prev)
+        return wrapper
+    return decorator
+
+# ── Singleton state shared across all test modules ──────────────────────
+
+_tmp_dir: Optional[str] = None
+_server_proc: Optional[subprocess.Popen] = None
+_server_info: Optional[Dict[str, Any]] = None
+_server_log_fp: Optional[TextIO] = None
+_server_log_path: Optional[str] = None
+_atexit_registered: bool = False
+
+
+def _free_port() -> int:
+    with socket.socket(socket.AF_INET, socket.SOCK_STREAM) as s:
+        s.bind(("127.0.0.1", 0))
+        return s.getsockname()[1]
+
+
+def control_socket_send(sock_path: str, message: dict, retries: int = 5) -> dict:
+    """Send a JSON message to the control socket and return the parsed response."""
+    payload = (json.dumps(message) + "\n").encode("utf-8")
+    last_err = None
+    for attempt in range(retries):
+        try:
+            with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as s:
+                s.settimeout(5)
+                s.connect(sock_path)
+                s.sendall(payload)
+                s.shutdown(socket.SHUT_WR)
+                data = b""
+                while True:
+                    chunk = s.recv(4096)
+                    if not chunk:
+                        break
+                    data += chunk
+            return json.loads(data.strip())
+        except (BlockingIOError, ConnectionRefusedError, OSError) as e:
+            last_err = e
+            time.sleep(0.1 * (attempt + 1))
+    raise last_err
+
+
+def _wait_for_control_socket(sock_path: str, timeout: float = SERVER_STARTUP_TIMEOUT) -> None:
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        try:
+            resp = control_socket_send(sock_path, {"action": "status"})
+            if resp.get("status") == "ok":
+                return
+        except (ConnectionRefusedError, FileNotFoundError, OSError):
+            pass
+        time.sleep(0.2)
+    raise RuntimeError(
+        f"Image server control socket at {sock_path} not ready within {timeout}s"
+    )
+
+
+def _wait_for_nbd_socket(sock_path: str, timeout: float = QEMU_NBD_STARTUP_TIMEOUT) -> None:
+    deadline = time.monotonic() + timeout
+    while time.monotonic() < deadline:
+        if os.path.exists(sock_path):
+            try:
+                with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as s:
+                    s.settimeout(1)
+                    s.connect(sock_path)
+                    return
+            except (ConnectionRefusedError, OSError):
+                pass
+        time.sleep(0.2)
+    raise RuntimeError(
+        f"qemu-nbd socket at {sock_path} not ready within {timeout}s"
+    )
+
+
+def get_tmp_dir() -> str:
+    global _tmp_dir
+    if _tmp_dir is None:
+        _tmp_dir = tempfile.mkdtemp(prefix="imageserver_test_")
+    return _tmp_dir
+
+
+def _read_log_tail(path: str, max_bytes: int = 65536) -> str:
+    """Return up to *max_bytes* of UTF-8 text from the end of *path*."""
+    try:
+        with open(path, "rb") as f:
+            f.seek(0, os.SEEK_END)
+            size = f.tell()
+            f.seek(max(0, size - max_bytes))
+            return f.read().decode("utf-8", errors="replace")
+    except OSError as e:
+        return f"(could not read log: {e})"
+
+
+def get_image_server() -> Dict[str, Any]:
+    """Return the singleton image-server info dict, starting it if needed."""
+    global _server_proc, _server_info, _server_log_fp, _server_log_path, _atexit_registered
+
+    if _server_info is not None:
+        return _server_info
+
+    tmp = get_tmp_dir()
+    port = _free_port()
+    ctrl_sock = os.path.join(tmp, "ctrl.sock")
+    log_path = os.path.join(tmp, "imageserver.log")
+    _server_log_path = log_path
+
+    imageserver_pkg = str(Path(__file__).resolve().parent.parent)
+    parent_dir = str(Path(imageserver_pkg).parent)
+
+    env = os.environ.copy()
+    env["PYTHONPATH"] = parent_dir + os.pathsep + env.get("PYTHONPATH", "")
+
+    _server_log_fp = open(
+        log_path, "a", encoding="utf-8", buffering=1, errors="replace"
+    )
+    try:
+        _server_log_fp.write(
+            "\n========== imageserver test subprocess log ==========\n"
+        )
+        _server_log_fp.flush()
+    except OSError:
+        pass
+
+    proc = subprocess.Popen(
+        [
+            sys.executable, "-m", "imageserver",
+            "--listen", "127.0.0.1",
+            "--port", str(port),
+            "--control-socket", ctrl_sock,
+        ],
+        cwd=parent_dir,
+        env=env,
+        stdout=_server_log_fp,
+        stderr=_server_log_fp,
+    )
+    _server_proc = proc
+
+    try:
+        _wait_for_control_socket(ctrl_sock)
+    except RuntimeError:
+        proc.kill()
+        try:
+            proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            proc.kill()
+            proc.wait(timeout=5)
+        try:
+            _server_log_fp.flush()
+        except OSError:
+            pass
+        tail = _read_log_tail(log_path)
+        try:
+            _server_log_fp.close()
+        except OSError:
+            pass
+        _server_log_fp = None
+        _server_proc = None
+        raise RuntimeError(
+            "Image server failed to start.\n"
+            f"Log file: {log_path}\n"
+            f"--- log tail ---\n{tail}"
+        )
+
+    def send(msg: dict) -> dict:
+        return control_socket_send(ctrl_sock, msg)
+
+    _server_info = {
+        "base_url": f"http://127.0.0.1:{port}",
+        "port": port,
+        "ctrl_sock": ctrl_sock,
+        "send": send,
+        "imageserver_log": log_path,
+    }
+    if not _atexit_registered:
+        atexit.register(shutdown_image_server)
+        _atexit_registered = True
+    sys.stdout.write(
+        "\n[IMAGESERVER_TEST] child image server log file: %s\n\n" % log_path
+    )
+    sys.stdout.flush()
+    return _server_info
+
+
+def shutdown_image_server() -> None:
+    global _server_proc, _server_info, _tmp_dir, _server_log_fp, _server_log_path
+    ctrl_sock: Optional[str] = None
+    if _server_info is not None:
+        ctrl_sock = _server_info.get("ctrl_sock")
+
+    if _server_proc is not None:
+        _server_proc.terminate()
+        try:
+            _server_proc.wait(timeout=5)
+        except subprocess.TimeoutExpired:
+            _server_proc.kill()
+            _server_proc.wait(timeout=5)
+        _server_proc = None
+    if _server_log_fp is not None:
+        try:
+            _server_log_fp.flush()
+            _server_log_fp.close()
+        except OSError:
+            pass
+        _server_log_fp = None
+    _server_info = None
+    _server_log_path = None
+
+    if ctrl_sock:
+        try:
+            os.unlink(ctrl_sock)
+        except FileNotFoundError:
+            pass
+
+    # Leave temp dir and imageserver.log on disk for debugging; clear pointer only.
+    _tmp_dir = None
+
+
+# ── qemu-nbd server ────────────────────────────────────────────────────
+
+class QemuNbdServer:
+    """Manages a qemu-nbd process exporting a disk image over a Unix socket."""
+
+    def __init__(
+        self,
+        image_path: str,
+        socket_path: str,
+        image_size: int = IMAGE_SIZE,
+        image_format: str = "raw",
+    ):
+        self.image_path = image_path
+        self.socket_path = socket_path
+        self.image_size = image_size
+        self.image_format = image_format
+        self._proc: Optional[subprocess.Popen] = None
+
+    def start(self) -> None:
+        if not os.path.exists(self.image_path):
+            if self.image_format == "raw":
+                with open(self.image_path, "wb") as f:
+                    f.truncate(self.image_size)
+            else:
+                raise FileNotFoundError(
+                    f"disk image not found for format {self.image_format!r}: {self.image_path}"
+                )
+
+        self._proc = subprocess.Popen(
+            [
+                "qemu-nbd",
+                "--socket", self.socket_path,
+                "--format", self.image_format,
+                "--persistent",
+                "--shared=0",
+                "--cache=none",
+                self.image_path,
+            ],
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+        )
+        _wait_for_nbd_socket(self.socket_path)
+
+    def stop(self) -> None:
+        if self._proc is not None:
+            for pipe in (self._proc.stdout, self._proc.stderr):
+                if pipe:
+                    try:
+                        pipe.close()
+                    except Exception:
+                        pass
+            self._proc.terminate()
+            try:
+                self._proc.wait(timeout=5)
+            except subprocess.TimeoutExpired:
+                self._proc.kill()
+                self._proc.wait(timeout=5)
+            self._proc = None
+
+
+# ── Factory helpers ─────────────────────────────────────────────────────
+
+def make_tmp_image(data=None, image_size=IMAGE_SIZE) -> str:
+    """Create a temp raw image file in the shared tmp dir; return path."""
+    tmp = get_tmp_dir()
+    path = os.path.join(tmp, f"img_{uuid.uuid4().hex[:8]}.raw")
+    if data is not None:
+        with open(path, "wb") as f:
+            f.write(data)
+    else:
+        with open(path, "wb") as f:
+            f.write(randbytes(42, image_size))
+    return path
+
+
+def make_file_transfer(data=None, image_size=IMAGE_SIZE, idle_timeout_seconds=None):
+    """
+    Create a temp file + register a file-backend transfer.
+    Returns (transfer_id, url, file_path, cleanup_callable).
+
+    If *idle_timeout_seconds* is set, it is sent in the transfer config (for idle expiry tests).
+    """
+    srv = get_image_server()
+    path = make_tmp_image(data=data, image_size=image_size)
+    transfer_id = f"file-{uuid.uuid4().hex[:8]}"
+    cfg = {"backend": "file", "file": path}
+    if idle_timeout_seconds is not None:
+        cfg["idle_timeout_seconds"] = idle_timeout_seconds
+    resp = srv["send"]({
+        "action": "register",
+        "transfer_id": transfer_id,
+        "config": cfg,
+    })
+    assert resp["status"] == "ok", f"register failed: {resp}"
+    url = f"{srv['base_url']}/images/{transfer_id}"
+
+    def cleanup():
+        srv["send"]({"action": "unregister", "transfer_id": transfer_id})
+        try:
+            os.unlink(path)
+        except FileNotFoundError:
+            pass
+
+    return transfer_id, url, path, cleanup
+
+
+def make_nbd_transfer(image_size=IMAGE_SIZE):
+    """
+    Create a qemu-nbd server + register an NBD-backend transfer.
+    Returns (transfer_id, url, QemuNbdServer, cleanup_callable).
+    """
+    srv = get_image_server()
+    tmp = get_tmp_dir()
+    img_path = os.path.join(tmp, f"nbd_{uuid.uuid4().hex[:8]}.raw")
+    sock_path = os.path.join(tmp, f"nbd_{uuid.uuid4().hex[:8]}.sock")
+
+    server = QemuNbdServer(img_path, sock_path, image_size=image_size)
+    server.start()
+
+    transfer_id = f"nbd-{uuid.uuid4().hex[:8]}"
+    resp = srv["send"]({
+        "action": "register",
+        "transfer_id": transfer_id,
+        "config": {"backend": "nbd", "socket": sock_path},
+    })
+    assert resp["status"] == "ok", f"register failed: {resp}"
+    url = f"{srv['base_url']}/images/{transfer_id}"
+
+    def cleanup():
+        srv["send"]({"action": "unregister", "transfer_id": transfer_id})
+        server.stop()
+        for p in (img_path, sock_path):
+            try:
+                os.unlink(p)
+            except FileNotFoundError:
+                pass
+
+    return transfer_id, url, server, cleanup
+
+
+def make_nbd_transfer_existing_disk(image_path: str, image_format: str = "qcow2"):
+    """
+    Start qemu-nbd for an existing on-disk image (e.g. qcow2) and register a transfer.
+
+    Does not delete *image_path* on cleanup (only the Unix socket under tmp).
+
+    Returns (transfer_id, url, QemuNbdServer, cleanup_callable).
+    """
+    srv = get_image_server()
+    tmp = get_tmp_dir()
+    sock_path = os.path.join(tmp, f"nbd_{uuid.uuid4().hex[:8]}.sock")
+
+    server = QemuNbdServer(
+        image_path, sock_path, image_format=image_format
+    )
+    server.start()
+
+    transfer_id = f"nbd-{uuid.uuid4().hex[:8]}"
+    resp = srv["send"]({
+        "action": "register",
+        "transfer_id": transfer_id,
+        "config": {"backend": "nbd", "socket": sock_path},
+    })
+    assert resp["status"] == "ok", f"register failed: {resp}"
+    url = f"{srv['base_url']}/images/{transfer_id}"
+
+    def cleanup():
+        srv["send"]({"action": "unregister", "transfer_id": transfer_id})
+        server.stop()
+        try:
+            os.unlink(sock_path)
+        except FileNotFoundError:
+            pass
+
+    return transfer_id, url, server, cleanup
+
+
+# ── HTTP helpers ────────────────────────────────────────────────────────
+
+import urllib.request
+import urllib.error
+
+
+def http_get(url, headers=None, timeout=HTTP_TIMEOUT):
+    req = urllib.request.Request(url, headers=headers or {})
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+def http_put(url, data, headers=None, timeout=HTTP_TIMEOUT):
+    hdrs = {"Content-Length": str(len(data))}
+    if headers:
+        hdrs.update(headers)
+    req = urllib.request.Request(url, data=data, headers=hdrs, method="PUT")
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+def http_post(url, data=b"", headers=None, timeout=HTTP_TIMEOUT):
+    hdrs = {}
+    if headers:
+        hdrs.update(headers)
+    req = urllib.request.Request(url, data=data, headers=hdrs, method="POST")
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+def http_options(url, timeout=HTTP_TIMEOUT):
+    req = urllib.request.Request(url, method="OPTIONS")
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+def http_patch(url, data, headers=None, timeout=HTTP_TIMEOUT):
+    hdrs = {}
+    if headers:
+        hdrs.update(headers)
+    req = urllib.request.Request(url, data=data, headers=hdrs, method="PATCH")
+    return urllib.request.urlopen(req, timeout=timeout)
+
+
+# ── Base TestCase with shared setUp/tearDown ────────────────────────────
+
+class ImageServerTestCase(unittest.TestCase):
+    """
+    Base class for image-server tests.
+
+    Ensures the image server is running before any test method.
+    Subclasses that need a file or NBD transfer should set them up
+    in setUp() and tear down in tearDown().
+    """
+
+    @classmethod
+    def setUpClass(cls):
+        cls.server = get_image_server()
+        cls.base_url = cls.server["base_url"]
+
+    def ctrl(self, msg):
+        """Send a control-socket message; wraps server['send'] to avoid descriptor issues."""
+        return self.server["send"](msg)
+
+    def _make_tmp_image(self, data=None):
+        return make_tmp_image(data=data)
+
+    def _register_file_transfer(self, data=None):
+        return make_file_transfer(data=data)
+
+    def _register_nbd_transfer(self):
+        return make_nbd_transfer()
+
+    @staticmethod
+    def dump_server_logs(max_bytes: int = 256 * 1024):
+        """Print a tail of the image-server log file (shared by all tests in the run)."""
+        path = _server_log_path
+        if not path or not os.path.isfile(path):
+            return
+        try:
+            if _server_log_fp is not None:
+                _server_log_fp.flush()
+        except OSError:
+            pass
+        try:
+            data = _read_log_tail(path, max_bytes=max_bytes)
+            if data.strip():
+                sys.stderr.write("\n=== IMAGE SERVER LOG (tail) ===\n")
+                sys.stderr.write(data)
+                if not data.endswith("\n"):
+                    sys.stderr.write("\n")
+                sys.stderr.write("=== END IMAGE SERVER LOG ===\n")
+        except Exception:
+            pass
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_combinations.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_combinations.py
new file mode 100644
index 000000000000..509f9fde05a5
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_combinations.py
@@ -0,0 +1,397 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+Multi-operation sequences, parallel reads across multiple transfer objects,
+cross-backend scenarios, and edge cases.
+"""
+
+import json
+import logging
+import unittest
+import urllib.error
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from .test_base import (
+    IMAGE_SIZE,
+    ImageServerTestCase,
+    http_get,
+    http_patch,
+    http_post,
+    http_put,
+    make_file_transfer,
+    make_nbd_transfer,
+    randbytes,
+    shutdown_image_server,
+    test_timeout,
+)
+
+log = logging.getLogger(__name__)
+FUTURES_TIMEOUT = 60  # seconds for as_completed to collect all results
+
+
+def _fetch(url, headers=None):
+    """GET *url* and return the body bytes, properly closing the response."""
+    resp = http_get(url, headers=headers)
+    try:
+        return resp.read()
+    finally:
+        resp.close()
+
+
+class TestParallelReadsFileBackend(ImageServerTestCase):
+    """Multiple concurrent GET requests to multiple file-backed transfers."""
+
+    @test_timeout(120)
+    def test_parallel_reads_single_file_transfer(self):
+        data = randbytes(500, IMAGE_SIZE)
+        tid, url, path, cleanup = make_file_transfer(data=data)
+        try:
+            results = {}
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for i in range(8):
+                    start = i * (IMAGE_SIZE // 8)
+                    end = start + (IMAGE_SIZE // 8) - 1
+                    f = pool.submit(
+                        _fetch, url, headers={"Range": f"bytes={start}-{end}"}
+                    )
+                    futures[f] = (start, end)
+
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    start, end = futures[f]
+                    results[(start, end)] = f.result()
+
+            for (start, end), chunk in sorted(results.items()):
+                self.assertEqual(chunk, data[start:end + 1], f"Mismatch at {start}-{end}")
+        finally:
+            cleanup()
+
+    @test_timeout(120)
+    def test_parallel_reads_multiple_file_transfers(self):
+        """Parallel reads across 4 different file-backed transfer objects."""
+        transfers = []
+        try:
+            for i in range(4):
+                data = randbytes(600 + i, IMAGE_SIZE)
+                tid, url, path, cleanup = make_file_transfer(data=data)
+                transfers.append((tid, url, data, cleanup))
+
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for idx, (tid, url, data, _) in enumerate(transfers):
+                    for j in range(2):
+                        f = pool.submit(_fetch, url)
+                        futures[f] = (idx, data)
+
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    idx, expected_data = futures[f]
+                    got = f.result()
+                    self.assertEqual(got, expected_data, f"Transfer {idx} mismatch")
+        finally:
+            for _, _, _, cleanup in transfers:
+                cleanup()
+
+
+class TestParallelReadsNbdBackend(ImageServerTestCase):
+    """Multiple concurrent GET requests to multiple NBD-backed transfers."""
+
+    @test_timeout(120)
+    def test_parallel_reads_single_nbd_transfer(self):
+        data = randbytes(700, IMAGE_SIZE)
+        tid, url, nbd_server, cleanup = make_nbd_transfer()
+        try:
+            log.info("Writing %d bytes to NBD transfer %s", IMAGE_SIZE, tid)
+            http_put(url, data)
+            log.info("NBD write done, starting 8 parallel range reads")
+
+            results = {}
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for i in range(8):
+                    start = i * (IMAGE_SIZE // 8)
+                    end = start + (IMAGE_SIZE // 8) - 1
+                    f = pool.submit(
+                        _fetch, url, headers={"Range": f"bytes={start}-{end}"}
+                    )
+                    futures[f] = (start, end)
+
+                completed = 0
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    start, end = futures[f]
+                    results[(start, end)] = f.result()
+                    completed += 1
+                    log.info("NBD range read %d/8 done: bytes=%d-%d", completed, start, end)
+
+            for (start, end), chunk in sorted(results.items()):
+                self.assertEqual(chunk, data[start:end + 1], f"Mismatch at {start}-{end}")
+        finally:
+            cleanup()
+
+    @test_timeout(120)
+    def test_parallel_reads_multiple_nbd_transfers(self):
+        """Parallel reads across 4 different NBD-backed transfer objects."""
+        transfers = []
+        try:
+            for i in range(4):
+                data = randbytes(800 + i, IMAGE_SIZE)
+                log.info("Setting up NBD transfer %d", i)
+                tid, url, nbd_server, cleanup = make_nbd_transfer()
+                log.info("Writing data to NBD transfer %d (tid=%s)", i, tid)
+                http_put(url, data)
+                transfers.append((tid, url, data, cleanup))
+                log.info("NBD transfer %d ready", i)
+
+            log.info("Starting parallel reads across %d NBD transfers", len(transfers))
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for idx, (tid, url, data, _) in enumerate(transfers):
+                    for j in range(2):
+                        f = pool.submit(_fetch, url)
+                        futures[f] = (idx, data)
+
+                completed = 0
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    idx, expected_data = futures[f]
+                    got = f.result()
+                    completed += 1
+                    log.info("Read %d/%d done: NBD transfer idx=%d, %d bytes",
+                             completed, len(futures), idx, len(got))
+                    self.assertEqual(got, expected_data, f"NBD transfer {idx} mismatch")
+        finally:
+            for _, _, _, cleanup in transfers:
+                cleanup()
+
+
+class TestParallelReadsMixedBackends(ImageServerTestCase):
+    """Parallel reads across a mix of file and NBD transfers simultaneously."""
+
+    @test_timeout(120)
+    def test_parallel_reads_file_and_nbd_mixed(self):
+        transfers = []
+        try:
+            for i in range(2):
+                log.info("Setting up file transfer %d", i)
+                data = randbytes(900 + i, IMAGE_SIZE)
+                tid, url, path, cleanup = make_file_transfer(data=data)
+                transfers.append(("file", tid, url, data, cleanup))
+                log.info("File transfer %d ready: tid=%s", i, tid)
+
+            for i in range(2):
+                log.info("Setting up NBD transfer %d", i)
+                data = randbytes(950 + i, IMAGE_SIZE)
+                tid, url, nbd_server, cleanup = make_nbd_transfer()
+                log.info("NBD transfer %d registered: tid=%s, writing data...", i, tid)
+                http_put(url, data)
+                transfers.append(("nbd", tid, url, data, cleanup))
+                log.info("NBD transfer %d ready", i)
+
+            log.info("Starting parallel reads across %d transfers (2 file + 2 nbd)",
+                     len(transfers))
+            with ThreadPoolExecutor(max_workers=8) as pool:
+                futures = {}
+                for idx, (backend_type, tid, url, data, _) in enumerate(transfers):
+                    for j in range(2):
+                        f = pool.submit(_fetch, url)
+                        futures[f] = (idx, backend_type, data)
+
+                completed = 0
+                for f in as_completed(futures, timeout=FUTURES_TIMEOUT):
+                    idx, backend_type, expected = futures[f]
+                    got = f.result()
+                    completed += 1
+                    log.info("Read %d/%d done: %s transfer idx=%d, %d bytes",
+                             completed, len(futures), backend_type, idx, len(got))
+                    self.assertEqual(got, expected, f"{backend_type} transfer {idx} mismatch")
+
+            log.info("All parallel mixed reads completed successfully")
+        except TimeoutError:
+            log.error("TIMEOUT in mixed parallel reads — dumping server logs")
+            self.dump_server_logs()
+            raise
+        finally:
+            for _, _, _, _, cleanup in transfers:
+                cleanup()
+
+
+class TestWriteThenReadNbd(ImageServerTestCase):
+    """Multi-step write sequences on NBD backend."""
+
+    def setUp(self):
+        self._tid, self._url, self._nbd, self._cleanup = make_nbd_transfer()
+
+    def tearDown(self):
+        self._cleanup()
+
+    def test_partial_writes_then_full_read(self):
+        http_put(self._url, b"\x00" * IMAGE_SIZE)
+
+        chunk_size = IMAGE_SIZE // 4
+        for i in range(4):
+            offset = i * chunk_size
+            end = offset + chunk_size - 1
+            data = bytes([i & 0xFF]) * chunk_size
+            http_patch(self._url, data, headers={
+                "Range": f"bytes={offset}-{end}",
+                "Content-Type": "application/octet-stream",
+                "Content-Length": str(chunk_size),
+            })
+
+        resp = http_get(self._url)
+        full = resp.read()
+        for i in range(4):
+            offset = i * chunk_size
+            self.assertEqual(full[offset:offset + chunk_size], bytes([i & 0xFF]) * chunk_size)
+
+    def test_zero_then_extents(self):
+        http_put(self._url, randbytes(1000, IMAGE_SIZE))
+
+        payload = json.dumps({"op": "zero", "size": IMAGE_SIZE // 2, "offset": 0}).encode()
+        http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+
+        resp = http_get(f"{self._url}/extents")
+        extents = json.loads(resp.read())
+        total = sum(e["length"] for e in extents)
+        self.assertEqual(total, IMAGE_SIZE)
+
+    def test_write_flush_read(self):
+        data = randbytes(1001, IMAGE_SIZE)
+        resp = http_put(f"{self._url}?flush=y", data)
+        body = json.loads(resp.read())
+        self.assertTrue(body["flushed"])
+
+        resp2 = http_get(self._url)
+        self.assertEqual(resp2.read(), data)
+
+
+class TestWriteThenReadFile(ImageServerTestCase):
+    def setUp(self):
+        self._tid, self._url, self._path, self._cleanup = make_file_transfer()
+
+    def tearDown(self):
+        self._cleanup()
+
+    def test_put_then_get_roundtrip(self):
+        data = randbytes(1100, IMAGE_SIZE)
+        http_put(self._url, data)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), data)
+
+
+class TestRegisterUseUnregisterUse(ImageServerTestCase):
+    def test_unregistered_transfer_returns_404(self):
+        data = randbytes(1200, IMAGE_SIZE)
+        tid, url, path, cleanup = make_file_transfer(data=data)
+
+        resp = http_get(url)
+        self.assertEqual(resp.read(), data)
+
+        cleanup()
+
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(url)
+        self.assertEqual(ctx.exception.code, 404)
+
+
+class TestMultipleTransfersSimultaneous(ImageServerTestCase):
+    @test_timeout(120)
+    def test_operate_on_file_and_nbd_concurrently(self):
+        file_data = randbytes(1300, IMAGE_SIZE)
+        nbd_data = randbytes(1301, IMAGE_SIZE)
+
+        ftid, furl, fpath, fcleanup = make_file_transfer(data=file_data)
+        ntid, nurl, nbd_server, ncleanup = make_nbd_transfer()
+
+        try:
+            log.info("Writing data to NBD transfer %s", ntid)
+            http_put(nurl, nbd_data)
+
+            log.info("Starting concurrent file + NBD reads")
+            with ThreadPoolExecutor(max_workers=4) as pool:
+                f_file = pool.submit(_fetch, furl)
+                f_nbd = pool.submit(_fetch, nurl)
+
+                self.assertEqual(f_file.result(timeout=FUTURES_TIMEOUT), file_data)
+                self.assertEqual(f_nbd.result(timeout=FUTURES_TIMEOUT), nbd_data)
+            log.info("Concurrent reads completed successfully")
+        finally:
+            fcleanup()
+            ncleanup()
+
+
+class TestLargeChunkedTransfer(ImageServerTestCase):
+    def test_put_larger_than_chunk_size_file(self):
+        """Upload data that spans multiple CHUNK_SIZE boundaries."""
+        tid, url, path, cleanup = make_file_transfer()
+        try:
+            data = randbytes(1400, IMAGE_SIZE)
+            http_put(url, data)
+            resp = http_get(url)
+            self.assertEqual(resp.read(), data)
+        finally:
+            cleanup()
+
+    def test_nbd_put_larger_than_chunk_size(self):
+        tid, url, nbd_server, cleanup = make_nbd_transfer()
+        try:
+            data = randbytes(1401, IMAGE_SIZE)
+            http_put(url, data)
+            resp = http_get(url)
+            self.assertEqual(resp.read(), data)
+        finally:
+            cleanup()
+
+
+class TestEdgeCases(ImageServerTestCase):
+    def test_get_not_found_path(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(f"{self.base_url}/not/images/path")
+        self.assertEqual(ctx.exception.code, 404)
+
+    def test_post_unknown_tail(self):
+        tid, url, path, cleanup = make_file_transfer()
+        try:
+            with self.assertRaises(urllib.error.HTTPError) as ctx:
+                http_post(f"{url}/unknown")
+            self.assertEqual(ctx.exception.code, 404)
+        finally:
+            cleanup()
+
+    def test_get_extents_then_flush_nbd(self):
+        tid, url, nbd_server, cleanup = make_nbd_transfer()
+        try:
+            http_put(url, randbytes(1500, IMAGE_SIZE))
+
+            resp = http_get(f"{url}/extents")
+            self.assertEqual(resp.status, 200)
+            resp.read()
+
+            resp2 = http_post(f"{url}/flush")
+            body = json.loads(resp2.read())
+            self.assertTrue(body["ok"])
+        finally:
+            cleanup()
+
+
+if __name__ == "__main__":
+    try:
+        unittest.main()
+    finally:
+        shutdown_image_server()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_control_socket.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_control_socket.py
new file mode 100644
index 000000000000..187592ff1070
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_control_socket.py
@@ -0,0 +1,258 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Tests for the Unix domain control socket protocol (register / unregister / status)."""
+
+import json
+import socket
+import unittest
+import uuid
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from .test_base import ImageServerTestCase, make_tmp_image, shutdown_image_server, test_timeout
+
+
+class TestStatus(ImageServerTestCase):
+    def test_status_returns_ok(self):
+        resp = self.ctrl({"action": "status"})
+        self.assertEqual(resp["status"], "ok")
+        self.assertIn("active_transfers", resp)
+
+    def test_status_count_is_integer(self):
+        resp = self.ctrl({"action": "status"})
+        self.assertIsInstance(resp["active_transfers"], int)
+        self.assertGreaterEqual(resp["active_transfers"], 0)
+
+
+class TestRegister(ImageServerTestCase):
+    def test_register_file_backend(self):
+        img = make_tmp_image()
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        try:
+            resp = self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+            self.assertEqual(resp["status"], "ok")
+            self.assertGreaterEqual(resp["active_transfers"], 1)
+        finally:
+            self.ctrl({"action": "unregister", "transfer_id": tid})
+
+    def test_register_nbd_backend(self):
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        try:
+            resp = self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "nbd", "socket": "/tmp/fake.sock"},
+            })
+            self.assertEqual(resp["status"], "ok")
+        finally:
+            self.ctrl({"action": "unregister", "transfer_id": tid})
+
+    def test_register_increments_active_count(self):
+        img = make_tmp_image()
+        before = self.ctrl({"action": "status"})["active_transfers"]
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        try:
+            self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+            after = self.ctrl({"action": "status"})["active_transfers"]
+            self.assertEqual(after, before + 1)
+        finally:
+            self.ctrl({"action": "unregister", "transfer_id": tid})
+
+    def test_register_missing_transfer_id(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_empty_transfer_id(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": "",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_missing_config(self):
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": f"test-{uuid.uuid4().hex[:8]}",
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_invalid_backend(self):
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": f"test-{uuid.uuid4().hex[:8]}",
+            "config": {"backend": "invalid"},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_file_missing_path(self):
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": f"test-{uuid.uuid4().hex[:8]}",
+            "config": {"backend": "file"},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_nbd_missing_socket(self):
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": f"test-{uuid.uuid4().hex[:8]}",
+            "config": {"backend": "nbd"},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_path_traversal_rejected(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": "../etc/passwd",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_dot_rejected(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": ".",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_slash_rejected(self):
+        img = make_tmp_image()
+        resp = self.ctrl({
+            "action": "register",
+            "transfer_id": "a/b",
+            "config": {"backend": "file", "file": img},
+        })
+        self.assertEqual(resp["status"], "error")
+
+    def test_register_duplicate_replaces(self):
+        img = make_tmp_image()
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        try:
+            self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+            count_before = self.ctrl({"action": "status"})["active_transfers"]
+            self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+            count_after = self.ctrl({"action": "status"})["active_transfers"]
+            self.assertEqual(count_after, count_before)
+        finally:
+            self.ctrl({"action": "unregister", "transfer_id": tid})
+
+
+class TestUnregister(ImageServerTestCase):
+    def test_unregister_existing(self):
+        img = make_tmp_image()
+        tid = f"test-{uuid.uuid4().hex[:8]}"
+        self.ctrl({
+            "action": "register",
+            "transfer_id": tid,
+            "config": {"backend": "file", "file": img},
+        })
+        before = self.ctrl({"action": "status"})["active_transfers"]
+        resp = self.ctrl({"action": "unregister", "transfer_id": tid})
+        self.assertEqual(resp["status"], "ok")
+        self.assertEqual(resp["active_transfers"], before - 1)
+
+    def test_unregister_nonexistent(self):
+        resp = self.ctrl({"action": "unregister", "transfer_id": "does-not-exist"})
+        self.assertEqual(resp["status"], "ok")
+
+    def test_unregister_missing_id(self):
+        resp = self.ctrl({"action": "unregister"})
+        self.assertEqual(resp["status"], "error")
+
+
+class TestUnknownAction(ImageServerTestCase):
+    def test_unknown_action(self):
+        resp = self.ctrl({"action": "foobar"})
+        self.assertEqual(resp["status"], "error")
+        self.assertIn("unknown", resp.get("message", "").lower())
+
+
+class TestMalformed(ImageServerTestCase):
+    def test_malformed_json(self):
+        sock_path = self.server["ctrl_sock"]
+        payload = b"not valid json\n"
+        with socket.socket(socket.AF_UNIX, socket.SOCK_STREAM) as s:
+            s.settimeout(5)
+            s.connect(sock_path)
+            s.sendall(payload)
+            s.shutdown(socket.SHUT_WR)
+            data = b""
+            while True:
+                chunk = s.recv(4096)
+                if not chunk:
+                    break
+                data += chunk
+        resp = json.loads(data.strip())
+        self.assertEqual(resp["status"], "error")
+
+
+class TestConcurrentRegistrations(ImageServerTestCase):
+    @test_timeout(60)
+    def test_concurrent_registers(self):
+        img = make_tmp_image()
+        tids = [f"conc-{uuid.uuid4().hex[:8]}" for _ in range(20)]
+        results = []
+
+        def register_one(tid):
+            return self.ctrl({
+                "action": "register",
+                "transfer_id": tid,
+                "config": {"backend": "file", "file": img},
+            })
+
+        try:
+            with ThreadPoolExecutor(max_workers=10) as pool:
+                futures = {pool.submit(register_one, tid): tid for tid in tids}
+                for f in as_completed(futures, timeout=30):
+                    results.append(f.result())
+
+            self.assertTrue(all(r["status"] == "ok" for r in results))
+        finally:
+            for tid in tids:
+                self.ctrl({"action": "unregister", "transfer_id": tid})
+
+
+if __name__ == "__main__":
+    try:
+        unittest.main()
+    finally:
+        shutdown_image_server()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_file_backend.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_file_backend.py
new file mode 100644
index 000000000000..be6eb259cc38
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_file_backend.py
@@ -0,0 +1,230 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Tests for HTTP operations against a file-backend transfer."""
+
+import json
+import os
+import unittest
+import urllib.error
+
+from .test_base import (
+    IMAGE_SIZE,
+    ImageServerTestCase,
+    http_get,
+    http_options,
+    http_patch,
+    http_post,
+    http_put,
+    make_file_transfer,
+    randbytes,
+    shutdown_image_server,
+)
+
+
+class FileBackendTestCase(ImageServerTestCase):
+    """Base that creates a file-backend transfer per test."""
+
+    def setUp(self):
+        self._tid, self._url, self._path, self._cleanup = make_file_transfer()
+
+    def tearDown(self):
+        self._cleanup()
+
+
+class TestOptions(FileBackendTestCase):
+    def test_options_returns_features(self):
+        resp = http_options(self._url)
+        self.assertEqual(resp.status, 200)
+        body = json.loads(resp.read())
+        self.assertIn("flush", body["features"])
+        self.assertGreaterEqual(body["max_readers"], 1)
+        self.assertGreaterEqual(body["max_writers"], 1)
+
+    def test_options_allowed_methods(self):
+        resp = http_options(self._url)
+        methods = resp.getheader("Access-Control-Allow-Methods")
+        for m in ("GET", "PUT", "POST", "OPTIONS"):
+            self.assertIn(m, methods)
+
+
+class TestGetFull(FileBackendTestCase):
+    def test_get_full_returns_file_content(self):
+        with open(self._path, "rb") as f:
+            expected = f.read()
+        resp = http_get(self._url)
+        self.assertEqual(resp.status, 200)
+        data = resp.read()
+        self.assertEqual(len(data), len(expected))
+        self.assertEqual(data, expected)
+
+    def test_get_full_content_type(self):
+        resp = http_get(self._url)
+        resp.read()
+        self.assertIn("application/octet-stream", resp.getheader("Content-Type"))
+
+    def test_get_full_content_length(self):
+        resp = http_get(self._url)
+        resp.read()
+        self.assertEqual(int(resp.getheader("Content-Length")), os.path.getsize(self._path))
+
+
+class TestGetRange(FileBackendTestCase):
+    def test_get_range_partial(self):
+        with open(self._path, "rb") as f:
+            f.seek(100)
+            expected = f.read(200)
+        resp = http_get(self._url, headers={"Range": "bytes=100-299"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), expected)
+
+    def test_get_range_content_range_header(self):
+        size = os.path.getsize(self._path)
+        resp = http_get(self._url, headers={"Range": "bytes=0-99"})
+        self.assertEqual(resp.status, 206)
+        resp.read()
+        self.assertEqual(resp.getheader("Content-Range"), f"bytes 0-99/{size}")
+
+    def test_get_range_suffix(self):
+        with open(self._path, "rb") as f:
+            expected = f.read()[-100:]
+        resp = http_get(self._url, headers={"Range": "bytes=-100"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), expected)
+
+    def test_get_range_open_ended(self):
+        with open(self._path, "rb") as f:
+            f.seek(IMAGE_SIZE - 50)
+            expected = f.read()
+        resp = http_get(self._url, headers={"Range": f"bytes={IMAGE_SIZE - 50}-"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), expected)
+
+    def test_get_range_unsatisfiable(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(self._url, headers={"Range": f"bytes={IMAGE_SIZE + 100}-{IMAGE_SIZE + 200}"})
+        self.assertEqual(ctx.exception.code, 416)
+
+
+class TestPut(FileBackendTestCase):
+    def test_put_full_upload(self):
+        new_data = randbytes(99, IMAGE_SIZE)
+        resp = http_put(self._url, new_data)
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+        self.assertEqual(body["bytes_written"], IMAGE_SIZE)
+
+        with open(self._path, "rb") as f:
+            self.assertEqual(f.read(), new_data)
+
+    def test_put_with_flush(self):
+        new_data = randbytes(100, IMAGE_SIZE)
+        resp = http_put(f"{self._url}?flush=y", new_data)
+        body = json.loads(resp.read())
+        self.assertTrue(body["ok"])
+        self.assertTrue(body["flushed"])
+
+    def test_put_verify_by_get(self):
+        new_data = randbytes(101, IMAGE_SIZE)
+        http_put(self._url, new_data)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), new_data)
+
+    def test_put_with_content_range_rejected(self):
+        data = b"x" * 100
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_put(self._url, data, headers={"Content-Range": "bytes 0-99/*"})
+        self.assertEqual(ctx.exception.code, 400)
+
+    def test_put_with_range_header_rejected(self):
+        data = b"x" * 100
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_put(self._url, data, headers={"Range": "bytes=0-99"})
+        self.assertEqual(ctx.exception.code, 400)
+
+
+class TestFlush(FileBackendTestCase):
+    def test_post_flush(self):
+        resp = http_post(f"{self._url}/flush")
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+
+
+class TestPatchRejected(FileBackendTestCase):
+    def test_patch_rejected_for_file(self):
+        data = json.dumps({"op": "zero", "size": 100}).encode()
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_patch(self._url, data, headers={
+                "Content-Type": "application/json",
+                "Content-Length": str(len(data)),
+            })
+        self.assertEqual(ctx.exception.code, 400)
+
+
+class TestExtentsRejected(FileBackendTestCase):
+    def test_extents_rejected_for_file(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(f"{self._url}/extents")
+        self.assertEqual(ctx.exception.code, 400)
+
+
+class TestUnknownImage(ImageServerTestCase):
+    def test_get_unknown_image(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(f"{self.base_url}/images/nonexistent-id")
+        self.assertEqual(ctx.exception.code, 404)
+
+    def test_put_unknown_image(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_put(f"{self.base_url}/images/nonexistent-id", b"data")
+        self.assertEqual(ctx.exception.code, 404)
+
+    def test_options_unknown_image(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_options(f"{self.base_url}/images/nonexistent-id")
+        self.assertEqual(ctx.exception.code, 404)
+
+
+class TestRoundTrip(FileBackendTestCase):
+    def test_put_then_get_roundtrip(self):
+        payload = randbytes(200, IMAGE_SIZE)
+        http_put(self._url, payload)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), payload)
+
+    def test_put_then_ranged_get_roundtrip(self):
+        payload = randbytes(201, IMAGE_SIZE)
+        http_put(self._url, payload)
+        resp = http_get(self._url, headers={"Range": "bytes=512-1023"})
+        self.assertEqual(resp.read(), payload[512:1024])
+
+    def test_multiple_puts_last_wins(self):
+        first = randbytes(300, IMAGE_SIZE)
+        second = randbytes(301, IMAGE_SIZE)
+        http_put(self._url, first)
+        http_put(self._url, second)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), second)
+
+
+if __name__ == "__main__":
+    try:
+        unittest.main()
+    finally:
+        shutdown_image_server()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_http11_lifecycle.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_http11_lifecycle.py
new file mode 100644
index 000000000000..99740fa13323
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_http11_lifecycle.py
@@ -0,0 +1,148 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Integration tests for HTTP/1.1 connection lifecycle behavior."""
+
+import http.client
+import socket
+import threading
+import time
+
+from .test_base import (
+    HTTP_TIMEOUT,
+    ImageServerTestCase,
+    make_file_transfer,
+    randbytes,
+    test_timeout,
+)
+
+
+def _read_http_headers(sock: socket.socket, timeout: float = HTTP_TIMEOUT) -> bytes:
+    sock.settimeout(timeout)
+    data = b""
+    while b"\r\n\r\n" not in data:
+        chunk = sock.recv(4096)
+        if not chunk:
+            break
+        data += chunk
+    return data
+
+
+class TestHttp11PersistentConnections(ImageServerTestCase):
+    @test_timeout(60)
+    def test_multiple_get_requests_reuse_single_socket(self):
+        data = randbytes(1111, 512 * 1024)
+        transfer_id, _url, _path, cleanup = make_file_transfer(data=data)
+        try:
+            conn = http.client.HTTPConnection("127.0.0.1", self.server["port"], timeout=HTTP_TIMEOUT)
+            try:
+                path = f"/images/{transfer_id}"
+
+                conn.request("GET", path, headers={"Range": "bytes=0-1023"})
+                resp1 = conn.getresponse()
+                body1 = resp1.read()
+                self.assertEqual(resp1.status, 206)
+                self.assertEqual(body1, data[:1024])
+                self.assertIsNotNone(conn.sock)
+                first_local_port = conn.sock.getsockname()[1]
+
+                conn.request("GET", path, headers={"Range": "bytes=1024-2047"})
+                resp2 = conn.getresponse()
+                body2 = resp2.read()
+                self.assertEqual(resp2.status, 206)
+                self.assertEqual(body2, data[1024:2048])
+                self.assertIsNotNone(conn.sock)
+                second_local_port = conn.sock.getsockname()[1]
+
+                conn.request("OPTIONS", path)
+                resp3 = conn.getresponse()
+                _ = resp3.read()
+                self.assertEqual(resp3.status, 200)
+                self.assertIsNotNone(conn.sock)
+                third_local_port = conn.sock.getsockname()[1]
+
+                self.assertEqual(first_local_port, second_local_port)
+                self.assertEqual(second_local_port, third_local_port)
+            finally:
+                conn.close()
+        finally:
+            cleanup()
+
+
+class TestTeardownTiming(ImageServerTestCase):
+    @test_timeout(60)
+    def test_unregister_waits_for_inflight_put(self):
+        transfer_id, _url, _path, cleanup = make_file_transfer(data=b"\x00" * (2 * 1024 * 1024))
+        started = threading.Event()
+        put_done = threading.Event()
+        put_result = {"status_line": "", "error": None}
+        body = randbytes(2222, 1024 * 1024)
+
+        def send_slow_put() -> None:
+            sock = None
+            try:
+                sock = socket.create_connection(("127.0.0.1", self.server["port"]), timeout=HTTP_TIMEOUT)
+                request_headers = (
+                    f"PUT /images/{transfer_id} HTTP/1.1\r\n"
+                    f"Host: 127.0.0.1:{self.server['port']}\r\n"
+                    f"Content-Length: {len(body)}\r\n"
+                    "Connection: close\r\n"
+                    "\r\n"
+                ).encode("ascii")
+                sock.sendall(request_headers)
+
+                sent = 0
+                chunk_size = 16 * 1024
+                while sent < len(body):
+                    end = min(sent + chunk_size, len(body))
+                    sock.sendall(body[sent:end])
+                    sent = end
+                    if sent >= chunk_size and not started.is_set():
+                        started.set()
+                    time.sleep(0.02)
+
+                headers = _read_http_headers(sock)
+                if headers:
+                    put_result["status_line"] = headers.split(b"\r\n", 1)[0].decode("ascii", "replace")
+            except Exception as e:
+                put_result["error"] = repr(e)
+            finally:
+                if sock is not None:
+                    try:
+                        sock.close()
+                    except OSError:
+                        pass
+                put_done.set()
+
+        sender = threading.Thread(target=send_slow_put, daemon=True)
+        sender.start()
+
+        try:
+            self.assertTrue(started.wait(5), "PUT request did not start in time")
+
+            t0 = time.monotonic()
+            unregister_resp = self.ctrl({"action": "unregister", "transfer_id": transfer_id})
+            elapsed = time.monotonic() - t0
+
+            self.assertTrue(put_done.wait(5), "PUT request did not finish in time")
+            self.assertEqual(unregister_resp.get("status"), "ok")
+            self.assertGreater(elapsed, 0.2)
+            self.assertIsNone(put_result["error"], put_result["error"])
+            self.assertIn(" 200 ", put_result["status_line"])
+        finally:
+            sender.join(timeout=1)
+            cleanup()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_backend.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_backend.py
new file mode 100644
index 000000000000..da120ae6bad5
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_nbd_backend.py
@@ -0,0 +1,706 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Tests for HTTP operations against an NBD-backend transfer (real qemu-nbd)."""
+
+import json
+import os
+import subprocess
+import unittest
+import uuid
+import urllib.error
+import urllib.request
+from concurrent.futures import ThreadPoolExecutor
+
+from imageserver.constants import MAX_PARALLEL_READS, MAX_PARALLEL_WRITES
+
+from .test_base import (
+    IMAGE_SIZE,
+    ImageServerTestCase,
+    get_tmp_dir,
+    http_get,
+    http_options,
+    http_patch,
+    http_post,
+    http_put,
+    make_nbd_transfer,
+    make_nbd_transfer_existing_disk,
+    randbytes,
+    shutdown_image_server,
+)
+
+
+class NbdBackendTestCase(ImageServerTestCase):
+    """Base that creates an NBD-backend transfer per test."""
+
+    def setUp(self):
+        self._tid, self._url, self._nbd, self._cleanup = make_nbd_transfer()
+
+    def tearDown(self):
+        self._cleanup()
+
+
+class TestOptions(NbdBackendTestCase):
+    def test_options_returns_extents_feature(self):
+        resp = http_options(self._url)
+        self.assertEqual(resp.status, 200)
+        body = json.loads(resp.read())
+        self.assertIn("extents", body["features"])
+
+    def test_options_includes_patch_method(self):
+        resp = http_options(self._url)
+        methods = resp.getheader("Access-Control-Allow-Methods")
+        self.assertIn("PATCH", methods)
+
+    def test_options_has_capabilities(self):
+        resp = http_options(self._url)
+        body = json.loads(resp.read())
+        self.assertGreaterEqual(body["max_readers"], 1)
+        self.assertGreaterEqual(body["max_writers"], 1)
+
+
+class TestGetFull(NbdBackendTestCase):
+    def test_get_full_returns_image_data(self):
+        with open(self._nbd.image_path, "rb") as f:
+            expected = f.read()
+        resp = http_get(self._url)
+        data = resp.read()
+        self.assertEqual(resp.status, 200)
+        self.assertEqual(len(data), len(expected))
+        self.assertEqual(data, expected)
+
+    def test_get_full_content_length(self):
+        resp = http_get(self._url)
+        resp.read()
+        self.assertEqual(int(resp.getheader("Content-Length")), IMAGE_SIZE)
+
+
+class TestGetRange(NbdBackendTestCase):
+    def test_get_range_partial(self):
+        test_data = randbytes(50, IMAGE_SIZE)
+        http_put(self._url, test_data)
+
+        resp = http_get(self._url, headers={"Range": "bytes=100-299"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), test_data[100:300])
+
+    def test_get_range_content_range_header(self):
+        resp = http_get(self._url, headers={"Range": "bytes=0-99"})
+        self.assertEqual(resp.status, 206)
+        resp.read()
+        self.assertEqual(resp.getheader("Content-Range"), f"bytes 0-99/{IMAGE_SIZE}")
+
+    def test_get_range_suffix(self):
+        test_data = randbytes(51, IMAGE_SIZE)
+        http_put(self._url, test_data)
+
+        resp = http_get(self._url, headers={"Range": "bytes=-100"})
+        self.assertEqual(resp.status, 206)
+        self.assertEqual(resp.read(), test_data[-100:])
+
+    def test_get_range_unsatisfiable(self):
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_get(self._url, headers={"Range": f"bytes={IMAGE_SIZE + 100}-{IMAGE_SIZE + 200}"})
+        self.assertEqual(ctx.exception.code, 416)
+
+
+class TestPutFull(NbdBackendTestCase):
+    def test_put_full_upload(self):
+        new_data = randbytes(60, IMAGE_SIZE)
+        resp = http_put(self._url, new_data)
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+        self.assertEqual(body["bytes_written"], IMAGE_SIZE)
+
+        resp2 = http_get(self._url)
+        self.assertEqual(resp2.read(), new_data)
+
+    def test_put_with_flush(self):
+        new_data = randbytes(61, IMAGE_SIZE)
+        resp = http_put(f"{self._url}?flush=y", new_data)
+        body = json.loads(resp.read())
+        self.assertTrue(body["ok"])
+        self.assertTrue(body["flushed"])
+
+
+class TestPutRange(NbdBackendTestCase):
+    def test_put_content_range(self):
+        base_data = randbytes(70, IMAGE_SIZE)
+        http_put(self._url, base_data)
+
+        patch_data = b"\xAB" * 512
+        resp = http_put(self._url, patch_data, headers={
+            "Content-Range": "bytes 0-511/*",
+            "Content-Length": str(len(patch_data)),
+        })
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+        self.assertEqual(body["bytes_written"], 512)
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=0-511"})
+        self.assertEqual(resp2.read(), patch_data)
+
+        resp3 = http_get(self._url, headers={"Range": "bytes=512-1023"})
+        self.assertEqual(resp3.read(), base_data[512:1024])
+
+    def test_put_content_range_with_flush(self):
+        base_data = b"\x00" * IMAGE_SIZE
+        http_put(self._url, base_data)
+
+        patch_data = b"\xFF" * 256
+        resp = http_put(f"{self._url}?flush=y", patch_data, headers={
+            "Content-Range": "bytes 1024-1279/*",
+            "Content-Length": str(len(patch_data)),
+        })
+        body = json.loads(resp.read())
+        self.assertTrue(body["ok"])
+        self.assertTrue(body["flushed"])
+
+
+class TestPatchRange(NbdBackendTestCase):
+    def test_patch_binary_range(self):
+        base_data = randbytes(80, IMAGE_SIZE)
+        http_put(self._url, base_data)
+
+        patch_data = b"\xCD" * 1024
+        resp = http_patch(self._url, patch_data, headers={
+            "Range": "bytes=2048-3071",
+            "Content-Type": "application/octet-stream",
+            "Content-Length": str(len(patch_data)),
+        })
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+        self.assertEqual(body["bytes_written"], 1024)
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=2048-3071"})
+        self.assertEqual(resp2.read(), patch_data)
+
+    def test_patch_multiple_ranges_preserves_unwritten(self):
+        base_data = randbytes(81, IMAGE_SIZE)
+        http_put(self._url, base_data)
+
+        patch1 = b"\x11" * 256
+        http_patch(self._url, patch1, headers={
+            "Range": "bytes=0-255",
+            "Content-Type": "application/octet-stream",
+            "Content-Length": "256",
+        })
+
+        patch2 = b"\x22" * 256
+        http_patch(self._url, patch2, headers={
+            "Range": "bytes=512-767",
+            "Content-Type": "application/octet-stream",
+            "Content-Length": "256",
+        })
+
+        resp = http_get(self._url, headers={"Range": "bytes=0-767"})
+        got = resp.read()
+        self.assertEqual(got[:256], patch1)
+        self.assertEqual(got[256:512], base_data[256:512])
+        self.assertEqual(got[512:768], patch2)
+
+
+class TestPatchZero(NbdBackendTestCase):
+    def test_patch_zero(self):
+        data = randbytes(90, IMAGE_SIZE)
+        http_put(self._url, data)
+
+        payload = json.dumps({"op": "zero", "size": 4096, "offset": 0}).encode()
+        resp = http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=0-4095"})
+        self.assertEqual(resp2.read(), b"\x00" * 4096)
+
+    def test_patch_zero_with_flush(self):
+        data = b"\xFF" * IMAGE_SIZE
+        http_put(self._url, data)
+
+        payload = json.dumps({"op": "zero", "size": 512, "offset": 1024, "flush": True}).encode()
+        resp = http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+        body = json.loads(resp.read())
+        self.assertTrue(body["ok"])
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=1024-1535"})
+        self.assertEqual(resp2.read(), b"\x00" * 512)
+
+    def test_patch_zero_preserves_neighbors(self):
+        data = randbytes(91, IMAGE_SIZE)
+        http_put(self._url, data)
+
+        payload = json.dumps({"op": "zero", "size": 256, "offset": 512}).encode()
+        http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+
+        resp = http_get(self._url, headers={"Range": "bytes=0-1023"})
+        got = resp.read()
+        self.assertEqual(got[:512], data[:512])
+        self.assertEqual(got[512:768], b"\x00" * 256)
+        self.assertEqual(got[768:1024], data[768:1024])
+
+
+class TestPatchFlush(NbdBackendTestCase):
+    def test_patch_flush_op(self):
+        payload = json.dumps({"op": "flush"}).encode()
+        resp = http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+
+
+class TestPostFlush(NbdBackendTestCase):
+    def test_post_flush(self):
+        resp = http_post(f"{self._url}/flush")
+        body = json.loads(resp.read())
+        self.assertEqual(resp.status, 200)
+        self.assertTrue(body["ok"])
+
+
+class TestExtents(NbdBackendTestCase):
+    def test_get_allocation_extents(self):
+        resp = http_get(f"{self._url}/extents")
+        self.assertEqual(resp.status, 200)
+        extents = json.loads(resp.read())
+        self.assertIsInstance(extents, list)
+        self.assertGreaterEqual(len(extents), 1)
+        for ext in extents:
+            self.assertIn("start", ext)
+            self.assertIn("length", ext)
+            self.assertIn("zero", ext)
+
+    def test_extents_cover_full_image(self):
+        resp = http_get(f"{self._url}/extents")
+        extents = json.loads(resp.read())
+        total = sum(e["length"] for e in extents)
+        self.assertEqual(total, IMAGE_SIZE)
+
+    def test_extents_dirty_context_without_bitmap(self):
+        resp = http_get(f"{self._url}/extents?context=dirty")
+        self.assertEqual(resp.status, 200)
+        extents = json.loads(resp.read())
+        self.assertIsInstance(extents, list)
+        self.assertGreaterEqual(len(extents), 1)
+        for ext in extents:
+            self.assertIn("dirty", ext)
+            self.assertTrue(ext["dirty"])
+
+    def test_extents_after_write_and_zero(self):
+        http_put(self._url, randbytes(95, IMAGE_SIZE))
+
+        payload = json.dumps({"op": "zero", "size": 4096, "offset": 0}).encode()
+        http_patch(self._url, payload, headers={
+            "Content-Type": "application/json",
+            "Content-Length": str(len(payload)),
+        })
+
+        resp = http_get(f"{self._url}/extents")
+        extents = json.loads(resp.read())
+        self.assertGreaterEqual(len(extents), 1)
+        total = sum(e["length"] for e in extents)
+        self.assertEqual(total, IMAGE_SIZE)
+
+
+def _allocated_subranges(extents, granularity):
+    """Split each non-hole extent (zero=False) into [start, end] inclusive byte ranges."""
+    out = []
+    for ext in extents:
+        if ext.get("zero"):
+            continue
+        start = int(ext["start"])
+        length = int(ext["length"])
+        pos = start
+        end_abs = start + length
+        while pos < end_abs:
+            chunk_end = min(pos + granularity, end_abs)
+            out.append((pos, chunk_end - 1))
+            pos = chunk_end
+    return out
+
+
+def _qemu_img_virtual_size(path: str) -> int:
+    """Return virtual size in bytes (requires ``qemu-img`` on PATH)."""
+    # stdout=PIPE + universal_newlines: Python 3.6 compatible (no capture_output/text).
+    cp = subprocess.run(
+        ["qemu-img", "info", "--output=json", path],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        universal_newlines=True,
+        check=True,
+    )
+    return int(json.loads(cp.stdout)["virtual-size"])
+
+
+def _http_error_detail(exc: urllib.error.HTTPError) -> str:
+    """Build a readable message from an ``HTTPError`` (status, url, JSON/text body)."""
+    parts = ["HTTP %s %r" % (exc.code, exc.reason), "url=%r" % getattr(exc, "url", "")]
+    try:
+        if exc.fp is not None:
+            raw = exc.fp.read()
+            if raw:
+                text = raw.decode("utf-8", errors="replace")
+                parts.append("response_body=%r" % (text,))
+    except Exception as read_err:
+        parts.append("read_body_error=%r" % (read_err,))
+    return "; ".join(parts)
+
+
+def _http_get_checked(
+    url,
+    headers=None,
+    expected_status=200,
+    label="GET",
+):
+    """
+    Like ``http_get`` but raises ``AssertionError`` with ``_http_error_detail`` on failure.
+    """
+    try:
+        resp = http_get(url, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError(
+            "%s failed for %r: %s" % (label, url, _http_error_detail(e))
+        ) from e
+    if resp.status != expected_status:
+        body = resp.read()
+        raise AssertionError(
+            "%s %r: expected HTTP %s, got %s; body=%r"
+            % (label, url, expected_status, resp.status, body)
+        )
+    return resp
+
+
+def _http_put_checked(url, data, headers, label="PUT"):
+    try:
+        resp = http_put(url, data, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError(
+            "%s failed for %r: %s" % (label, url, _http_error_detail(e))
+        ) from e
+    body = resp.read()
+    if resp.status != 200:
+        raise AssertionError(
+            "%s %r: expected HTTP 200, got %s; body=%r"
+            % (label, url, resp.status, body)
+        )
+    return resp, body
+
+
+def _http_post_checked(url, data=b"", headers=None, label="POST"):
+    try:
+        resp = http_post(url, data=data, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError(
+            "%s failed for %r: %s" % (label, url, _http_error_detail(e))
+        ) from e
+    body = resp.read()
+    if resp.status != 200:
+        raise AssertionError(
+            "%s %r: expected HTTP 200, got %s; body=%r"
+            % (label, url, resp.status, body)
+        )
+    return resp, body
+
+
+class TestQcow2ExtentsParallelReads(ImageServerTestCase):
+    """
+    Optional integration tests: export a user-supplied qcow2 via qemu-nbd, fetch
+    allocation extents, parallel range GETs over allocated regions, and (second
+    test) per-range GET-then-PUT pipeline with ``min(MAX_PARALLEL_READS,
+    MAX_PARALLEL_WRITES)`` workers.
+
+    Requires ``qemu-img`` and ``qemu-nbd`` on PATH.
+
+    Set IMAGESERVER_TEST_QCOW2 to the absolute path of a qcow2 file.
+    Optional: IMAGESERVER_TEST_QCOW2_READ_GRANULARITY — byte step (default 4 MiB).
+    """
+
+    def setUp(self):
+        super().setUp()
+        self._qcow2_path = os.environ.get("IMAGESERVER_TEST_QCOW2", "").strip()
+        if not self._qcow2_path or not os.path.isfile(self._qcow2_path):
+            self.skipTest(
+                "Set IMAGESERVER_TEST_QCOW2 to an existing qcow2 path to run this test"
+            )
+        raw_g = os.environ.get("IMAGESERVER_TEST_QCOW2_READ_GRANULARITY", "").strip()
+        self._read_granularity = int(raw_g) if raw_g else 4 * 1024 * 1024
+        if self._read_granularity <= 0:
+            self.skipTest("IMAGESERVER_TEST_QCOW2_READ_GRANULARITY must be positive")
+
+    def test_parallel_range_reads_allocated_extents(self):
+        _, url, _, cleanup = make_nbd_transfer_existing_disk(
+            self._qcow2_path, "qcow2"
+        )
+        try:
+            resp = _http_get_checked(
+                "%s/extents" % (url,),
+                expected_status=200,
+                label="GET /extents",
+            )
+            extents = json.loads(resp.read())
+            self.assertIsInstance(extents, list)
+            ranges = _allocated_subranges(extents, self._read_granularity)
+            if not ranges:
+                self.skipTest("no allocated extents (all holes/zero) in qcow2")
+
+            def fetch(span):
+                start_b, end_b = span
+                range_hdr = "bytes=%s-%s" % (start_b, end_b)
+                r = _http_get_checked(
+                    url,
+                    headers={"Range": range_hdr},
+                    expected_status=206,
+                    label="Range GET %s" % (range_hdr,),
+                )
+                data = r.read()
+                expected_len = end_b - start_b + 1
+                if len(data) != expected_len:
+                    raise AssertionError(
+                        "Range GET %s: got %d bytes, expected %d (url=%r)"
+                        % (range_hdr, len(data), expected_len, url)
+                    )
+
+            with ThreadPoolExecutor(max_workers=MAX_PARALLEL_READS) as pool:
+                pool.map(fetch, ranges)
+        finally:
+            cleanup()
+
+    def test_parallel_reads_then_put_range_copy_matches_source(self):
+        """
+        Create an empty qcow2 with the same virtual size as the source, copy every
+        allocated range using one worker pool: for each span, Range GET from src
+        then Content-Range PUT to dest.
+        Worker count is ``min(MAX_PARALLEL_READS, MAX_PARALLEL_WRITES)`` so each
+        worker holds at most one chunk.
+        """
+        src_path = self._qcow2_path
+        try:
+            vsize = _qemu_img_virtual_size(src_path)
+        except (FileNotFoundError, subprocess.CalledProcessError, KeyError, json.JSONDecodeError, TypeError, ValueError) as e:
+            self.skipTest(f"qemu-img info failed: {e}")
+
+        tmp = get_tmp_dir()
+        dest_path = os.path.join(tmp, f"qcow2_copy_{uuid.uuid4().hex[:8]}.qcow2")
+        try:
+            subprocess.run(
+                ["qemu-img", "create", "-f", "qcow2", dest_path, str(vsize)],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                universal_newlines=True,
+                check=True,
+            )
+        except (FileNotFoundError, subprocess.CalledProcessError) as e:
+            self.skipTest(f"qemu-img create failed: {e}")
+
+        _, src_url, _, cleanup_src = make_nbd_transfer_existing_disk(
+            src_path, "qcow2"
+        )
+        _, dest_url, _, cleanup_dest = make_nbd_transfer_existing_disk(
+            dest_path, "qcow2"
+        )
+        try:
+            resp = _http_get_checked(
+                "%s/extents" % (src_url,),
+                expected_status=200,
+                label="GET src /extents",
+            )
+            extents = json.loads(resp.read())
+            ranges = _allocated_subranges(extents, self._read_granularity)
+            if not ranges:
+                self.skipTest("no allocated extents (all holes/zero) in qcow2")
+
+            transfer_workers = max(
+                1, min(MAX_PARALLEL_READS, MAX_PARALLEL_WRITES)
+            )
+
+            def transfer_span(span):
+                start_b, end_b = span
+                range_hdr = "bytes=%s-%s" % (start_b, end_b)
+                r = _http_get_checked(
+                    src_url,
+                    headers={"Range": range_hdr},
+                    expected_status=206,
+                    label="Range GET src %s" % (range_hdr,),
+                )
+                data = r.read()
+                expected_len = end_b - start_b + 1
+                if len(data) != expected_len:
+                    raise AssertionError(
+                        "Range GET src %s: got %d bytes, expected %d (url=%r)"
+                        % (range_hdr, len(data), expected_len, src_url)
+                    )
+                end_inclusive = start_b + len(data) - 1
+                cr = "bytes %s-%s/*" % (start_b, end_inclusive)
+                _put_resp, put_body = _http_put_checked(
+                    dest_url,
+                    data,
+                    headers={
+                        "Content-Range": cr,
+                        "Content-Length": str(len(data)),
+                    },
+                    label="PUT dest %s" % (cr,),
+                )
+                try:
+                    body = json.loads(put_body)
+                except ValueError:
+                    raise AssertionError(
+                        "PUT dest %s: invalid JSON body=%r (url=%r)"
+                        % (cr, put_body, dest_url)
+                    )
+                if not body.get("ok"):
+                    raise AssertionError(
+                        "PUT dest %s: JSON ok=false, full=%r (url=%r)"
+                        % (cr, body, dest_url)
+                    )
+                if body.get("bytes_written") != len(data):
+                    raise AssertionError(
+                        "PUT dest %s: bytes_written=%r expected %d (url=%r)"
+                        % (cr, body.get("bytes_written"), len(data), dest_url)
+                    )
+
+            with ThreadPoolExecutor(max_workers=transfer_workers) as pool:
+                pool.map(transfer_span, ranges)
+
+            _flush, flush_body = _http_post_checked(
+                "%s/flush" % (dest_url,),
+                label="POST dest /flush",
+            )
+            try:
+                flush_json = json.loads(flush_body)
+            except ValueError:
+                raise AssertionError(
+                    "POST dest /flush: invalid JSON body=%r (url=%r)"
+                    % (flush_body, dest_url)
+                )
+            if not flush_json.get("ok"):
+                raise AssertionError(
+                    "POST dest /flush: ok=false, full=%r (url=%r)"
+                    % (flush_json, dest_url)
+                )
+        finally:
+            cleanup_dest()
+            cleanup_src()
+
+        try:
+            cmp = subprocess.run(
+                ["qemu-img", "compare", src_path, dest_path],
+                stdout=subprocess.PIPE,
+                stderr=subprocess.PIPE,
+                universal_newlines=True,
+            )
+            self.assertEqual(
+                cmp.returncode,
+                0,
+                "qemu-img compare %r vs %r failed (rc=%s): stderr=%r stdout=%r"
+                % (
+                    src_path,
+                    dest_path,
+                    cmp.returncode,
+                    cmp.stderr,
+                    cmp.stdout,
+                ),
+            )
+        finally:
+            try:
+                os.unlink(dest_path)
+            except FileNotFoundError:
+                pass
+
+
+class TestErrorCases(NbdBackendTestCase):
+    def test_patch_unsupported_op(self):
+        payload = json.dumps({"op": "invalid"}).encode()
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_patch(self._url, payload, headers={
+                "Content-Type": "application/json",
+                "Content-Length": str(len(payload)),
+            })
+        self.assertEqual(ctx.exception.code, 400)
+
+    def test_patch_zero_missing_size(self):
+        payload = json.dumps({"op": "zero", "offset": 0}).encode()
+        with self.assertRaises(urllib.error.HTTPError) as ctx:
+            http_patch(self._url, payload, headers={
+                "Content-Type": "application/json",
+                "Content-Length": str(len(payload)),
+            })
+        self.assertEqual(ctx.exception.code, 400)
+
+    def test_put_missing_content_length(self):
+        import http.client
+        from urllib.parse import urlparse
+        parsed = urlparse(self._url)
+        conn = http.client.HTTPConnection(parsed.hostname, parsed.port, timeout=30)
+        try:
+            conn.putrequest("PUT", parsed.path)
+            conn.endheaders()
+            resp = conn.getresponse()
+            self.assertEqual(resp.status, 400)
+        finally:
+            conn.close()
+
+
+class TestRoundTrip(NbdBackendTestCase):
+    def test_write_read_full_roundtrip(self):
+        payload = randbytes(110, IMAGE_SIZE)
+        http_put(self._url, payload)
+        resp = http_get(self._url)
+        self.assertEqual(resp.read(), payload)
+
+    def test_write_read_range_roundtrip(self):
+        payload = randbytes(111, IMAGE_SIZE)
+        http_put(self._url, payload)
+
+        for start, end in [(0, 255), (1024, 2047), (IMAGE_SIZE - 512, IMAGE_SIZE - 1)]:
+            resp = http_get(self._url, headers={"Range": f"bytes={start}-{end}"})
+            self.assertEqual(resp.read(), payload[start:end + 1])
+
+    def test_range_write_read_roundtrip(self):
+        http_put(self._url, b"\x00" * IMAGE_SIZE)
+
+        chunk = randbytes(112, 4096)
+        http_put(self._url, chunk, headers={
+            "Content-Range": "bytes 8192-12287/*",
+            "Content-Length": str(len(chunk)),
+        })
+
+        resp = http_get(self._url, headers={"Range": "bytes=8192-12287"})
+        self.assertEqual(resp.read(), chunk)
+
+        resp2 = http_get(self._url, headers={"Range": "bytes=0-4095"})
+        self.assertEqual(resp2.read(), b"\x00" * 4096)
+
+
+if __name__ == "__main__":
+    try:
+        unittest.main()
+    finally:
+        shutdown_image_server()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_registry_idle.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_registry_idle.py
new file mode 100644
index 000000000000..3fa592d8953a
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_registry_idle.py
@@ -0,0 +1,101 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Unit tests for transfer idle timeout (no image server / nbd dependency)."""
+
+import unittest
+from unittest.mock import patch
+
+from imageserver.config import (
+    TransferRegistry,
+    parse_idle_timeout_seconds,
+    validate_transfer_config,
+)
+from imageserver.constants import DEFAULT_IDLE_TIMEOUT_SECONDS
+
+
+class TestParseIdleTimeout(unittest.TestCase):
+    def test_default_600(self):
+        self.assertEqual(parse_idle_timeout_seconds({}), DEFAULT_IDLE_TIMEOUT_SECONDS)
+
+    def test_explicit(self):
+        self.assertEqual(
+            parse_idle_timeout_seconds({"idle_timeout_seconds": 30}), 30
+        )
+
+    def test_zero_timeout(self):
+        self.assertEqual(
+            parse_idle_timeout_seconds({"idle_timeout_seconds": 0}), 86400
+        )
+
+
+class TestValidateTransferConfig(unittest.TestCase):
+    def test_file_merges_idle(self):
+        c = validate_transfer_config(
+            {"backend": "file", "file": "/tmp/x", "idle_timeout_seconds": 3}
+        )
+        self.assertEqual(c["idle_timeout_seconds"], 3)
+        self.assertEqual(c["backend"], "file")
+
+
+class TestRegistryIdleSweep(unittest.TestCase):
+    def test_sweep_unregisters_after_idle(self):
+        clock = [0.0]
+
+        def mono():
+            return clock[0]
+
+        with patch("imageserver.config.time.monotonic", mono):
+            r = TransferRegistry()
+            r.register(
+                "t1",
+                validate_transfer_config(
+                    {"backend": "file", "file": "/x", "idle_timeout_seconds": 2}
+                ),
+            )
+            clock[0] = 5.0
+            r.sweep_expired_transfers()
+            self.assertIsNone(r.get("t1"))
+
+    def test_inflight_prevents_sweep_until_request_ends(self):
+        clock = [0.0]
+
+        def mono():
+            return clock[0]
+
+        with patch("imageserver.config.time.monotonic", mono):
+            r = TransferRegistry()
+            r.register(
+                "t1",
+                validate_transfer_config(
+                    {"backend": "file", "file": "/x", "idle_timeout_seconds": 2}
+                ),
+            )
+            clock[0] = 1.0
+            ctx = r.request_lifecycle("t1")
+            ctx.__enter__()
+            clock[0] = 100.0
+            r.sweep_expired_transfers()
+            self.assertIsNotNone(r.get("t1"))
+            ctx.__exit__(None, None, None)
+            clock[0] = 103.0
+            r.sweep_expired_transfers()
+            self.assertIsNone(r.get("t1"))
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_stress_io.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_stress_io.py
new file mode 100644
index 000000000000..39b24ebf39f2
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_stress_io.py
@@ -0,0 +1,412 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""
+Stress IO tests
+They run only when IMAGESERVER_STRESS_TEST_QCOW_DIR is set to an existing
+directory containing qcow2 files.
+"""
+
+import json
+import os
+import subprocess
+import time
+import unittest
+import uuid
+import urllib.error
+from concurrent.futures import ThreadPoolExecutor, as_completed
+
+from imageserver.constants import MAX_PARALLEL_READS, MAX_PARALLEL_WRITES
+
+from .test_base import get_tmp_dir, http_get, http_post, http_put, make_nbd_transfer_existing_disk
+
+
+def _allocated_subranges(extents, granularity):
+    """Split each non-hole extent (zero=False) into [start, end] inclusive byte ranges."""
+    out = []
+    for ext in extents:
+        if ext.get("zero"):
+            continue
+        start = int(ext["start"])
+        length = int(ext["length"])
+        pos = start
+        end_abs = start + length
+        while pos < end_abs:
+            chunk_end = min(pos + granularity, end_abs)
+            out.append((pos, chunk_end - 1))
+            pos = chunk_end
+    return out
+
+
+def _qemu_img_virtual_size(path: str) -> int:
+    """Return virtual size in bytes (requires ``qemu-img`` on PATH)."""
+    cp = subprocess.run(
+        ["qemu-img", "info", "--output=json", path],
+        stdout=subprocess.PIPE,
+        stderr=subprocess.PIPE,
+        universal_newlines=True,
+        check=True,
+    )
+    return int(json.loads(cp.stdout)["virtual-size"])
+
+
+def _http_error_detail(exc: urllib.error.HTTPError) -> str:
+    parts = ["HTTP %s %r" % (exc.code, exc.reason), "url=%r" % getattr(exc, "url", "")]
+    try:
+        if exc.fp is not None:
+            raw = exc.fp.read()
+            if raw:
+                text = raw.decode("utf-8", errors="replace")
+                parts.append("response_body=%r" % (text,))
+    except Exception as read_err:
+        parts.append("read_body_error=%r" % (read_err,))
+    return "; ".join(parts)
+
+
+def _http_get_checked(url, headers=None, expected_status=200, label="GET"):
+    try:
+        resp = http_get(url, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError("%s failed for %r: %s" % (label, url, _http_error_detail(e))) from e
+    if resp.status != expected_status:
+        body = resp.read()
+        raise AssertionError(
+            "%s %r: expected HTTP %s, got %s; body=%r"
+            % (label, url, expected_status, resp.status, body)
+        )
+    return resp
+
+
+def _http_put_checked(url, data, headers, label="PUT"):
+    try:
+        resp = http_put(url, data, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError("%s failed for %r: %s" % (label, url, _http_error_detail(e))) from e
+    body = resp.read()
+    if resp.status != 200:
+        raise AssertionError(
+            "%s %r: expected HTTP 200, got %s; body=%r" % (label, url, resp.status, body)
+        )
+    return resp, body
+
+
+def _http_post_checked(url, data=b"", headers=None, label="POST"):
+    try:
+        resp = http_post(url, data=data, headers=headers)
+    except urllib.error.HTTPError as e:
+        raise AssertionError("%s failed for %r: %s" % (label, url, _http_error_detail(e))) from e
+    body = resp.read()
+    if resp.status != 200:
+        raise AssertionError(
+            "%s %r: expected HTTP 200, got %s; body=%r" % (label, url, resp.status, body)
+        )
+    return resp, body
+
+
+def _list_qcow2_files(dir_path: str):
+    entries = []
+    for name in os.listdir(dir_path):
+        p = os.path.join(dir_path, name)
+        if not os.path.isfile(p):
+            continue
+        # Keep this intentionally permissive; qemu-nbd can still reject invalid files.
+        if name.lower().endswith(".qcow2") or name.lower().endswith(".qcow"):
+            entries.append(p)
+    entries.sort()
+    return entries
+
+
+class TestQcow2ExtentsParallelReads(unittest.TestCase):
+    """
+    For each qcow2 in IMAGESERVER_STRESS_TEST_QCOW_DIR,
+    export it via qemu-nbd, fetch allocation extents, and perform parallel range reads
+    over allocated regions. A second test copies allocated extents into a new qcow2
+    and validates via qemu-img compare.
+
+    Env:
+    - IMAGESERVER_STRESS_TEST_QCOW_DIR: directory containing qcow2 files (required)
+    - IMAGESERVER_STRESS_TEST_READ_GRANULARITY: byte step (default 4 MiB)
+      (fallback: IMAGESERVER_TEST_QCOW2_READ_GRANULARITY for compatibility)
+    """
+
+    def setUp(self):
+        super().setUp()
+        self._qcow_dir = os.environ.get("IMAGESERVER_STRESS_TEST_QCOW_DIR", "").strip()
+        if not self._qcow_dir or not os.path.isdir(self._qcow_dir):
+            self.skipTest(
+                "Set IMAGESERVER_STRESS_TEST_QCOW_DIR to an existing directory containing qcow2 files"
+            )
+
+        self._dest_dir = self._qcow_dir.rstrip(os.sep) + ".test"
+        try:
+            os.makedirs(self._dest_dir, exist_ok=True)
+        except OSError as e:
+            self.skipTest("failed to create dest dir %r: %r" % (self._dest_dir, e))
+
+        raw_g = os.environ.get("IMAGESERVER_STRESS_TEST_READ_GRANULARITY", "").strip()
+        if not raw_g:
+            raw_g = os.environ.get("IMAGESERVER_TEST_QCOW2_READ_GRANULARITY", "").strip()
+        self._read_granularity = int(raw_g) if raw_g else 4 * 1024 * 1024
+        if self._read_granularity <= 0:
+            self.skipTest("IMAGESERVER_STRESS_TEST_READ_GRANULARITY must be positive")
+
+        self._qcow2_files = _list_qcow2_files(self._qcow_dir)
+        if not self._qcow2_files:
+            self.skipTest("no qcow2 files found in IMAGESERVER_STRESS_TEST_QCOW_DIR")
+
+        # Avoid pathological oversubscription by default; still runs multiple files concurrently.
+        cpu = os.cpu_count() or 4
+        self._file_workers = max(1, min(len(self._qcow2_files), cpu))
+
+    def test_parallel_range_reads_allocated_extents(self):
+        """
+        For every qcow2 in the directory: GET /extents then do parallel Range GETs across
+        allocated spans. All qcow2 files are processed concurrently.
+        """
+
+        def run_one(path: str):
+            _, url, server, cleanup = make_nbd_transfer_existing_disk(path, "qcow2")
+            try:
+                resp = _http_get_checked(
+                    "%s/extents" % (url,),
+                    expected_status=200,
+                    label="GET /extents",
+                )
+                extents = json.loads(resp.read())
+                ranges = _allocated_subranges(extents, self._read_granularity)
+                if not ranges:
+                    # Not an error; some images can legitimately be all holes.
+                    return {"path": path, "ranges": 0, "skipped": True}
+
+                def fetch(span):
+                    start_b, end_b = span
+                    range_hdr = "bytes=%s-%s" % (start_b, end_b)
+                    r = _http_get_checked(
+                        url,
+                        headers={"Range": range_hdr},
+                        expected_status=206,
+                        label="Range GET %s" % (range_hdr,),
+                    )
+                    data = r.read()
+                    expected_len = end_b - start_b + 1
+                    if len(data) != expected_len:
+                        raise AssertionError(
+                            "Range GET %s: got %d bytes, expected %d (url=%r, file=%r)"
+                            % (range_hdr, len(data), expected_len, url, path)
+                        )
+
+                with ThreadPoolExecutor(max_workers=MAX_PARALLEL_READS) as pool:
+                    list(pool.map(fetch, ranges))
+                return {"path": path, "ranges": len(ranges), "skipped": False}
+            finally:
+                cleanup()
+
+        started = time.perf_counter()
+        results = []
+        failures = []
+        with ThreadPoolExecutor(max_workers=self._file_workers) as pool:
+            futs = {pool.submit(run_one, p): p for p in self._qcow2_files}
+            for fut in as_completed(futs):
+                p = futs[fut]
+                try:
+                    results.append(fut.result())
+                except Exception as e:
+                    failures.append((p, e))
+
+        elapsed = time.perf_counter() - started
+        skipped = sum(1 for r in results if r.get("skipped"))
+        total_ranges = sum(int(r.get("ranges", 0)) for r in results)
+        print(
+            "stress_io: test_parallel_range_reads_allocated_extents: files=%d workers=%d skipped=%d total_ranges=%d elapsed=%.3fs"
+            % (len(self._qcow2_files), self._file_workers, skipped, total_ranges, elapsed)
+        )
+
+        if failures:
+            first_path, first_exc = failures[0]
+            raise AssertionError(
+                "stress_io: %d/%d files failed (first=%r): %r"
+                % (len(failures), len(self._qcow2_files), first_path, first_exc)
+            ) from first_exc
+
+    def test_parallel_reads_then_put_range_copy_matches_source(self):
+        """
+        For every qcow2 in the directory: create an empty qcow2 with same virtual size,
+        then copy every allocated range using a worker pool (Range GET then Content-Range PUT),
+        flush, and validate via qemu-img compare. All qcow2 files are processed concurrently.
+        """
+
+        def run_one(src_path: str):
+            try:
+                vsize = _qemu_img_virtual_size(src_path)
+            except (
+                FileNotFoundError,
+                subprocess.CalledProcessError,
+                KeyError,
+                json.JSONDecodeError,
+                TypeError,
+                ValueError,
+            ) as e:
+                raise AssertionError("qemu-img info failed for %r: %r" % (src_path, e)) from e
+
+            base = os.path.basename(src_path)
+            # Keep dest names unique in case the same basename appears more than once.
+            dest_name = "%s.copy.%s.qcow2" % (base, uuid.uuid4().hex[:8])
+            dest_path = os.path.join(self._dest_dir, dest_name)
+            try:
+                subprocess.run(
+                    ["qemu-img", "create", "-f", "qcow2", dest_path, str(vsize)],
+                    stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE,
+                    universal_newlines=True,
+                    check=True,
+                )
+            except (FileNotFoundError, subprocess.CalledProcessError) as e:
+                raise AssertionError("qemu-img create failed for %r: %r" % (dest_path, e)) from e
+
+            _, src_url, _, cleanup_src = make_nbd_transfer_existing_disk(src_path, "qcow2")
+            _, dest_url, _, cleanup_dest = make_nbd_transfer_existing_disk(dest_path, "qcow2")
+            try:
+                resp = _http_get_checked(
+                    "%s/extents" % (src_url,),
+                    expected_status=200,
+                    label="GET src /extents",
+                )
+                extents = json.loads(resp.read())
+                ranges = _allocated_subranges(extents, self._read_granularity)
+                if not ranges:
+                    return {"path": src_path, "ranges": 0, "skipped": True}
+
+                transfer_workers = max(1, min(MAX_PARALLEL_READS, MAX_PARALLEL_WRITES))
+
+                def transfer_span(span):
+                    start_b, end_b = span
+                    range_hdr = "bytes=%s-%s" % (start_b, end_b)
+                    r = _http_get_checked(
+                        src_url,
+                        headers={"Range": range_hdr},
+                        expected_status=206,
+                        label="Range GET src %s" % (range_hdr,),
+                    )
+                    data = r.read()
+                    expected_len = end_b - start_b + 1
+                    if len(data) != expected_len:
+                        raise AssertionError(
+                            "Range GET src %s: got %d bytes, expected %d (url=%r, file=%r)"
+                            % (range_hdr, len(data), expected_len, src_url, src_path)
+                        )
+                    end_inclusive = start_b + len(data) - 1
+                    cr = "bytes %s-%s/*" % (start_b, end_inclusive)
+                    _put_resp, put_body = _http_put_checked(
+                        dest_url,
+                        data,
+                        headers={
+                            "Content-Range": cr,
+                            "Content-Length": str(len(data)),
+                        },
+                        label="PUT dest %s" % (cr,),
+                    )
+                    try:
+                        body = json.loads(put_body)
+                    except ValueError:
+                        raise AssertionError(
+                            "PUT dest %s: invalid JSON body=%r (url=%r, file=%r)"
+                            % (cr, put_body, dest_url, src_path)
+                        )
+                    if not body.get("ok"):
+                        raise AssertionError(
+                            "PUT dest %s: JSON ok=false, full=%r (url=%r, file=%r)"
+                            % (cr, body, dest_url, src_path)
+                        )
+                    if body.get("bytes_written") != len(data):
+                        raise AssertionError(
+                            "PUT dest %s: bytes_written=%r expected %d (url=%r, file=%r)"
+                            % (cr, body.get("bytes_written"), len(data), dest_url, src_path)
+                        )
+
+                with ThreadPoolExecutor(max_workers=transfer_workers) as pool:
+                    list(pool.map(transfer_span, ranges))
+
+                _flush, flush_body = _http_post_checked(
+                    "%s/flush" % (dest_url,),
+                    label="POST dest /flush",
+                )
+                try:
+                    flush_json = json.loads(flush_body)
+                except ValueError as e:
+                    raise AssertionError(
+                        "POST dest /flush: invalid JSON body=%r (url=%r, file=%r)"
+                        % (flush_body, dest_url, src_path)
+                    ) from e
+                if not flush_json.get("ok"):
+                    raise AssertionError(
+                        "POST dest /flush: ok=false, full=%r (url=%r, file=%r)"
+                        % (flush_json, dest_url, src_path)
+                    )
+            finally:
+                cleanup_dest()
+                cleanup_src()
+
+            try:
+                cmp = subprocess.run(
+                    ["qemu-img", "compare", src_path, dest_path],
+                    stdout=subprocess.PIPE,
+                    stderr=subprocess.PIPE,
+                    universal_newlines=True,
+                )
+                if cmp.returncode != 0:
+                    raise AssertionError(
+                        "qemu-img compare %r vs %r failed (rc=%s): stderr=%r stdout=%r"
+                        % (src_path, dest_path, cmp.returncode, cmp.stderr, cmp.stdout)
+                    )
+            finally:
+                try:
+                    os.unlink(dest_path)
+                except FileNotFoundError:
+                    pass
+
+            return {"path": src_path, "ranges": len(ranges), "skipped": False}
+
+        started = time.perf_counter()
+        results = []
+        failures = []
+        with ThreadPoolExecutor(max_workers=self._file_workers) as pool:
+            futs = {pool.submit(run_one, p): p for p in self._qcow2_files}
+            for fut in as_completed(futs):
+                p = futs[fut]
+                try:
+                    results.append(fut.result())
+                except Exception as e:
+                    failures.append((p, e))
+
+        elapsed = time.perf_counter() - started
+        skipped = sum(1 for r in results if r.get("skipped"))
+        total_ranges = sum(int(r.get("ranges", 0)) for r in results)
+        print(
+            "stress_io: test_parallel_reads_then_put_range_copy_matches_source: files=%d workers=%d skipped=%d total_ranges=%d elapsed=%.3fs"
+            % (len(self._qcow2_files), self._file_workers, skipped, total_ranges, elapsed)
+        )
+
+        if failures:
+            first_path, first_exc = failures[0]
+            raise AssertionError(
+                "stress_io: %d/%d files failed (first=%r): %r"
+                % (len(failures), len(self._qcow2_files), first_path, first_exc)
+            ) from first_exc
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_transfer_idle_expiry.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_transfer_idle_expiry.py
new file mode 100644
index 000000000000..2730c8ed16ca
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_transfer_idle_expiry.py
@@ -0,0 +1,57 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Integration tests for per-transfer HTTP idle timeout (requires image server deps e.g. nbd)."""
+
+import time
+import urllib.error
+
+from .test_base import (
+    ImageServerTestCase,
+    http_options,
+    make_file_transfer,
+)
+
+
+class TestTransferIdleExpiry(ImageServerTestCase):
+    def test_transfer_expires_after_idle(self):
+        """No HTTP activity after registration: transfer is unregistered after idle_timeout_seconds."""
+        _tid, url, _path, cleanup = make_file_transfer(idle_timeout_seconds=15)
+        try:
+            time.sleep(30)
+            with self.assertRaises(urllib.error.HTTPError) as ctx:
+                http_options(url)
+            self.assertEqual(ctx.exception.code, 404)
+            st = self.ctrl({"action": "status"})
+            self.assertEqual(st.get("status"), "ok")
+        finally:
+            cleanup()
+
+    def test_http_activity_resets_idle_deadline(self):
+        """Completing a request resets the idle timer; transfer stays past a single interval."""
+        _tid, url, _path, cleanup = make_file_transfer(idle_timeout_seconds=15)
+        try:
+            http_options(url)
+            time.sleep(10)
+            http_options(url)
+            time.sleep(10)
+            http_options(url)
+            time.sleep(10)
+            resp = http_options(url)
+            self.assertEqual(resp.status, 200)
+        finally:
+            cleanup()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/tests/test_util.py b/scripts/vm/hypervisor/kvm/imageserver/tests/test_util.py
new file mode 100644
index 000000000000..159dff30a929
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/tests/test_util.py
@@ -0,0 +1,122 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+"""Unit tests for imageserver.util extent coalescing helpers."""
+
+import unittest
+
+from imageserver.util import (
+    coalesce_allocation_extents,
+    coalesce_dirty_zero_extents,
+    merge_dirty_zero_extents,
+)
+
+
+class TestCoalesceAllocationExtents(unittest.TestCase):
+    def test_empty(self):
+        self.assertEqual(coalesce_allocation_extents([]), [])
+
+    def test_single(self):
+        inp = [{"start": 0, "length": 4096, "zero": False}]
+        out = coalesce_allocation_extents(inp)
+        self.assertEqual(out, [{"start": 0, "length": 4096, "zero": False}])
+        self.assertIsNot(out[0], inp[0])
+
+    def test_merges_contiguous_same_zero(self):
+        inp = [
+            {"start": 0, "length": 10, "zero": False},
+            {"start": 10, "length": 5, "zero": False},
+            {"start": 15, "length": 100, "zero": False},
+        ]
+        self.assertEqual(
+            coalesce_allocation_extents(inp),
+            [{"start": 0, "length": 115, "zero": False}],
+        )
+
+    def test_does_not_merge_different_zero(self):
+        inp = [
+            {"start": 0, "length": 64, "zero": False},
+            {"start": 64, "length": 64, "zero": True},
+            {"start": 128, "length": 64, "zero": False},
+        ]
+        self.assertEqual(coalesce_allocation_extents(inp), inp)
+
+    def test_does_not_merge_gap(self):
+        inp = [
+            {"start": 0, "length": 100, "zero": False},
+            {"start": 200, "length": 50, "zero": False},
+        ]
+        self.assertEqual(coalesce_allocation_extents(inp), inp)
+
+    def test_does_not_merge_same_zero_with_gap(self):
+        inp = [
+            {"start": 0, "length": 10, "zero": True},
+            {"start": 20, "length": 10, "zero": True},
+        ]
+        self.assertEqual(coalesce_allocation_extents(inp), inp)
+
+
+class TestCoalesceDirtyZeroExtents(unittest.TestCase):
+    def test_empty(self):
+        self.assertEqual(coalesce_dirty_zero_extents([]), [])
+
+    def test_single(self):
+        inp = [{"start": 0, "length": 8192, "dirty": True, "zero": False}]
+        out = coalesce_dirty_zero_extents(inp)
+        self.assertEqual(
+            out, [{"start": 0, "length": 8192, "dirty": True, "zero": False}]
+        )
+
+    def test_merges_contiguous_same_flags(self):
+        inp = [
+            {"start": 0, "length": 50, "dirty": True, "zero": False},
+            {"start": 50, "length": 50, "dirty": True, "zero": False},
+        ]
+        self.assertEqual(
+            coalesce_dirty_zero_extents(inp),
+            [{"start": 0, "length": 100, "dirty": True, "zero": False}],
+        )
+
+    def test_does_not_merge_differing_dirty(self):
+        inp = [
+            {"start": 0, "length": 32, "dirty": False, "zero": False},
+            {"start": 32, "length": 32, "dirty": True, "zero": False},
+        ]
+        self.assertEqual(coalesce_dirty_zero_extents(inp), inp)
+
+    def test_does_not_merge_differing_zero(self):
+        inp = [
+            {"start": 0, "length": 16, "dirty": False, "zero": False},
+            {"start": 16, "length": 16, "dirty": False, "zero": True},
+        ]
+        self.assertEqual(coalesce_dirty_zero_extents(inp), inp)
+
+
+class TestMergeDirtyZeroExtentsCoalescing(unittest.TestCase):
+    def test_coalesces_adjacent_identical_flags_after_boundary_merge(self):
+        """Boundary grid can split one logical run; coalesce should reunite."""
+        allocation = [(0, 200, False)]
+        dirty = [(0, 100, False), (100, 100, False)]
+        merged = merge_dirty_zero_extents(allocation, dirty, 200)
+        self.assertEqual(
+            merged,
+            [{"start": 0, "length": 200, "dirty": False, "zero": False}],
+        )
+
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/scripts/vm/hypervisor/kvm/imageserver/util.py b/scripts/vm/hypervisor/kvm/imageserver/util.py
new file mode 100644
index 000000000000..473f58a50c07
--- /dev/null
+++ b/scripts/vm/hypervisor/kvm/imageserver/util.py
@@ -0,0 +1,125 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+import json
+import time
+from typing import Any, Dict, List, Set, Tuple
+
+
+def coalesce_allocation_extents(
+    extents: List[Dict[str, Any]],
+) -> List[Dict[str, Any]]:
+    """Merge contiguous extents that share the same ``zero`` flag."""
+    if not extents:
+        return []
+    out: List[Dict[str, Any]] = [dict(extents[0])]
+    for e in extents[1:]:
+        prev = out[-1]
+        if (
+            prev["start"] + prev["length"] == e["start"]
+            and prev["zero"] == e["zero"]
+        ):
+            prev["length"] += e["length"]
+        else:
+            out.append({"start": e["start"], "length": e["length"], "zero": e["zero"]})
+    return out
+
+
+def coalesce_dirty_zero_extents(
+    extents: List[Dict[str, Any]],
+) -> List[Dict[str, Any]]:
+    """Merge contiguous extents that share the same ``dirty`` and ``zero`` flags."""
+    if not extents:
+        return []
+    out: List[Dict[str, Any]] = [dict(extents[0])]
+    for e in extents[1:]:
+        prev = out[-1]
+        if (
+            prev["start"] + prev["length"] == e["start"]
+            and prev["dirty"] == e["dirty"]
+            and prev["zero"] == e["zero"]
+        ):
+            prev["length"] += e["length"]
+        else:
+            out.append(
+                {
+                    "start": e["start"],
+                    "length": e["length"],
+                    "dirty": e["dirty"],
+                    "zero": e["zero"],
+                }
+            )
+    return out
+
+
+def json_bytes(obj: Any) -> bytes:
+    return json.dumps(obj, separators=(",", ":"), ensure_ascii=False).encode("utf-8")
+
+
+def merge_dirty_zero_extents(
+    allocation_extents: List[Tuple[int, int, bool]],
+    dirty_extents: List[Tuple[int, int, bool]],
+    size: int,
+) -> List[Dict[str, Any]]:
+    """
+    Merge allocation (start, length, zero) and dirty (start, length, dirty) extents
+    into a single list of {start, length, dirty, zero} with unified boundaries.
+    """
+    boundaries: Set[int] = {0, size}
+    for start, length, _ in allocation_extents:
+        boundaries.add(start)
+        boundaries.add(start + length)
+    for start, length, _ in dirty_extents:
+        boundaries.add(start)
+        boundaries.add(start + length)
+    sorted_boundaries = sorted(boundaries)
+
+    def lookup(
+        extents: List[Tuple[int, int, bool]], offset: int, default: bool
+    ) -> bool:
+        for start, length, flag in extents:
+            if start <= offset < start + length:
+                return flag
+        return default
+
+    result: List[Dict[str, Any]] = []
+    for i in range(len(sorted_boundaries) - 1):
+        a, b = sorted_boundaries[i], sorted_boundaries[i + 1]
+        if a >= b:
+            continue
+        result.append(
+            {
+                "start": a,
+                "length": b - a,
+                "dirty": lookup(dirty_extents, a, False),
+                "zero": lookup(allocation_extents, a, False),
+            }
+        )
+    return coalesce_dirty_zero_extents(result)
+
+
+def is_fallback_dirty_response(extents: List[Dict[str, Any]]) -> bool:
+    """True if extents is the single-extent fallback (dirty=false, zero=false)."""
+    return (
+        len(extents) == 1
+        and extents[0].get("dirty") is False
+        and extents[0].get("zero") is False
+    )
+
+
+def now_s() -> float:
+    return time.monotonic()
diff --git a/server/src/main/java/com/cloud/api/ApiServer.java b/server/src/main/java/com/cloud/api/ApiServer.java
index dc07814c9724..1bda053ec19a 100644
--- a/server/src/main/java/com/cloud/api/ApiServer.java
+++ b/server/src/main/java/com/cloud/api/ApiServer.java
@@ -16,6 +16,10 @@
 // under the License.
 package com.cloud.api;
 
+import static com.cloud.user.AccountManagerImpl.apiKeyAccess;
+import static org.apache.cloudstack.api.ApiConstants.PASSWORD_CHANGE_REQUIRED;
+import static org.apache.cloudstack.user.UserPasswordResetManager.UserPasswordResetEnabled;
+
 import java.io.ByteArrayInputStream;
 import java.io.IOException;
 import java.io.InterruptedIOException;
@@ -31,6 +35,7 @@
 import java.security.Security;
 import java.text.ParseException;
 import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.Collections;
 import java.util.Date;
 import java.util.EnumSet;
@@ -39,7 +44,6 @@
 import java.util.HashSet;
 import java.util.Iterator;
 import java.util.List;
-import java.util.Arrays;
 import java.util.Map;
 import java.util.Set;
 import java.util.TimeZone;
@@ -58,16 +62,6 @@
 import javax.servlet.http.HttpServletResponse;
 import javax.servlet.http.HttpSession;
 
-import com.cloud.cluster.ManagementServerHostVO;
-import com.cloud.cluster.dao.ManagementServerHostDao;
-import com.cloud.utils.Ternary;
-import com.cloud.user.Account;
-import com.cloud.user.AccountManager;
-import com.cloud.user.AccountManagerImpl;
-import com.cloud.user.DomainManager;
-import com.cloud.user.User;
-import com.cloud.user.UserAccount;
-import com.cloud.user.UserVO;
 import org.apache.cloudstack.acl.APIChecker;
 import org.apache.cloudstack.acl.ApiKeyPairManagerImpl;
 import org.apache.cloudstack.acl.apikeypair.ApiKeyPair;
@@ -161,6 +155,8 @@
 import com.cloud.api.dispatch.DispatchChainFactory;
 import com.cloud.api.dispatch.DispatchTask;
 import com.cloud.api.response.ApiResponseSerializer;
+import com.cloud.cluster.ManagementServerHostVO;
+import com.cloud.cluster.dao.ManagementServerHostDao;
 import com.cloud.domain.Domain;
 import com.cloud.domain.DomainVO;
 import com.cloud.domain.dao.DomainDao;
@@ -179,14 +175,22 @@
 import com.cloud.exception.UnavailableCommandException;
 import com.cloud.projects.dao.ProjectDao;
 import com.cloud.storage.VolumeApiService;
+import com.cloud.user.Account;
+import com.cloud.user.AccountManager;
+import com.cloud.user.AccountManagerImpl;
+import com.cloud.user.DomainManager;
+import com.cloud.user.User;
+import com.cloud.user.UserAccount;
+import com.cloud.user.UserVO;
 import com.cloud.utils.ConstantTimeComparator;
 import com.cloud.utils.DateUtil;
 import com.cloud.utils.HttpUtils;
-import com.cloud.utils.HttpUtils.ApiSessionKeySameSite;
 import com.cloud.utils.HttpUtils.ApiSessionKeyCheckOption;
+import com.cloud.utils.HttpUtils.ApiSessionKeySameSite;
 import com.cloud.utils.Pair;
 import com.cloud.utils.ReflectUtil;
 import com.cloud.utils.StringUtils;
+import com.cloud.utils.Ternary;
 import com.cloud.utils.component.ComponentContext;
 import com.cloud.utils.component.ManagerBase;
 import com.cloud.utils.component.PluggableService;
@@ -199,10 +203,6 @@
 import com.cloud.utils.net.NetUtils;
 import com.google.gson.reflect.TypeToken;
 
-import static com.cloud.user.AccountManagerImpl.apiKeyAccess;
-import static org.apache.cloudstack.api.ApiConstants.PASSWORD_CHANGE_REQUIRED;
-import static org.apache.cloudstack.user.UserPasswordResetManager.UserPasswordResetEnabled;
-
 @Component
 public class ApiServer extends ManagerBase implements HttpRequestHandler, ApiServerService, Configurable {
     private static final Logger ACCESSLOGGER = LogManager.getLogger("apiserver." + ApiServer.class.getName());
@@ -792,85 +792,14 @@ private String queueCommand(final BaseCmd cmdObj, final Map<String, String> para
         // BaseAsyncCreateCmd: cmd params are processed and create() is called, then same workflow as BaseAsyncCmd.
         // BaseAsyncCmd: cmd is processed and submitted as an AsyncJob, job related info is serialized and returned.
         if (cmdObj instanceof BaseAsyncCmd) {
-            if (!asyncMgr.isAsyncJobsEnabled()) {
-                String msg = "Maintenance or Shutdown has been initiated on this management server. Can not accept new jobs";
-                logger.warn(msg);
-                throw new ServerApiException(ApiErrorCode.SERVICE_UNAVAILABLE, msg);
-            }
-            Long objectId = null;
-            String objectUuid;
-            if (cmdObj instanceof BaseAsyncCreateCmd) {
-                final BaseAsyncCreateCmd createCmd = (BaseAsyncCreateCmd)cmdObj;
-                dispatcher.dispatchCreateCmd(createCmd, params);
-                objectId = createCmd.getEntityId();
-                objectUuid = createCmd.getEntityUuid();
-                params.put("id", objectId.toString());
-                Class entityClass = EventTypes.getEntityClassForEvent(createCmd.getEventType());
-                if (entityClass != null)
-                    ctx.putContextParameter(entityClass, objectUuid);
-            } else {
-                // Extract the uuid before params are processed and id reflects internal db id
-                objectUuid = params.get(ApiConstants.ID);
-                dispatchChainFactory.getStandardDispatchChain().dispatch(new DispatchTask(cmdObj, params));
-            }
-
-            final BaseAsyncCmd asyncCmd = (BaseAsyncCmd)cmdObj;
-
-            if (callerUserId != null) {
-                params.put("ctxUserId", callerUserId.toString());
-            }
-            if (caller != null) {
-                params.put("ctxAccountId", String.valueOf(caller.getId()));
-            }
-            if (objectUuid != null) {
-                params.put("uuid", objectUuid);
-            }
-
-            long startEventId = ctx.getStartEventId();
-            asyncCmd.setStartEventId(startEventId);
-
-            // save the scheduled event
-            final Long eventId =
-                    ActionEventUtils.onScheduledActionEvent((callerUserId == null) ? (Long)User.UID_SYSTEM : callerUserId, asyncCmd.getEntityOwnerId(), asyncCmd.getEventType(),
-                            asyncCmd.getEventDescription(), asyncCmd.getApiResourceId(), asyncCmd.getApiResourceType().toString(), asyncCmd.isDisplay(), startEventId);
-            if (startEventId == 0) {
-                // There was no create event before, set current event id as start eventId
-                startEventId = eventId;
-            }
-
-            params.put("ctxStartEventId", String.valueOf(startEventId));
-            params.put("cmdEventType", asyncCmd.getEventType());
-            params.put("ctxDetails", ApiGsonHelper.getBuilder().create().toJson(ctx.getContextParameters()));
-            if (asyncCmd.getHttpMethod() != null) {
-                params.put(ApiConstants.HTTPMETHOD, asyncCmd.getHttpMethod().toString());
-            }
-
-            Long instanceId = (objectId == null) ? asyncCmd.getApiResourceId() : objectId;
-
-            // users can provide the job id they want to use, so log as it is a uuid and is unique
-            String injectedJobId = asyncCmd.getInjectedJobId();
-            uuidMgr.checkUuidSimple(injectedJobId, AsyncJob.class);
-
-            AsyncJobVO job = new AsyncJobVO("", callerUserId, caller.getId(), cmdObj.getClass().getName(),
-                    ApiGsonHelper.getBuilder().create().toJson(params), instanceId,
-                    asyncCmd.getApiResourceType() != null ? asyncCmd.getApiResourceType().toString() : null,
-                            injectedJobId);
-            job.setDispatcher(asyncDispatcher.getName());
-
-            final long jobId = asyncMgr.submitAsyncJob(job);
-
-            if (jobId == 0L) {
-                final String errorMsg = "Unable to schedule async job for command " + job.getCmd();
-                logger.warn(errorMsg);
-                throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, errorMsg);
-            }
+            AsyncCmdResult result = processAsyncCmd((BaseAsyncCmd)cmdObj, params, ctx, callerUserId, caller);
             final String response;
-            if (objectId != null) {
-                final String objUuid = (objectUuid == null) ? objectId.toString() : objectUuid;
-                response = getBaseAsyncCreateResponse(jobId, (BaseAsyncCreateCmd)asyncCmd, objUuid);
+            if (result.objectId != null) {
+                final String objUuid = (result.objectUuid == null) ? result.objectId.toString() : result.objectUuid;
+                response = getBaseAsyncCreateResponse(result.jobId, (BaseAsyncCreateCmd) result.asyncCmd, objUuid);
             } else {
                 SerializationContext.current().setUuidTranslation(true);
-                response = getBaseAsyncResponse(jobId, asyncCmd);
+                response = getBaseAsyncResponse(result.jobId, result.asyncCmd);
             }
             // Always log response for async for now, I don't think any sensitive data will be in here.
             // It might be nice to send this through scrubbing similar to how
@@ -900,6 +829,81 @@ private String queueCommand(final BaseCmd cmdObj, final Map<String, String> para
         }
     }
 
+    @Override
+    public AsyncCmdResult processAsyncCmd(BaseAsyncCmd asyncCmd, Map<String, String> params, CallContext ctx, Long callerUserId, Account caller) throws Exception {
+        if (!asyncMgr.isAsyncJobsEnabled()) {
+            String msg = "Maintenance or Shutdown has been initiated on this management server. Can not accept new jobs";
+            logger.warn(msg);
+            throw new ServerApiException(ApiErrorCode.SERVICE_UNAVAILABLE, msg);
+        }
+        Long objectId = null;
+        String objectUuid;
+        if (asyncCmd instanceof BaseAsyncCreateCmd) {
+            final BaseAsyncCreateCmd createCmd = (BaseAsyncCreateCmd) asyncCmd;
+            dispatcher.dispatchCreateCmd(createCmd, params);
+            objectId = createCmd.getEntityId();
+            objectUuid = createCmd.getEntityUuid();
+            params.put("id", objectId.toString());
+            Class entityClass = EventTypes.getEntityClassForEvent(createCmd.getEventType());
+            if (entityClass != null)
+                ctx.putContextParameter(entityClass, objectUuid);
+        } else {
+            // Extract the uuid before params are processed and id reflects internal db id
+            objectUuid = params.get(ApiConstants.ID);
+            dispatchChainFactory.getStandardDispatchChain().dispatch(new DispatchTask(asyncCmd, params));
+        }
+
+        if (callerUserId != null) {
+            params.put("ctxUserId", callerUserId.toString());
+        }
+        if (caller != null) {
+            params.put("ctxAccountId", String.valueOf(caller.getId()));
+        }
+        if (objectUuid != null) {
+            params.put("uuid", objectUuid);
+        }
+
+        long startEventId = ctx.getStartEventId();
+        asyncCmd.setStartEventId(startEventId);
+
+        // save the scheduled event
+        final Long eventId =
+                ActionEventUtils.onScheduledActionEvent((callerUserId == null) ? (Long)User.UID_SYSTEM : callerUserId, asyncCmd.getEntityOwnerId(), asyncCmd.getEventType(),
+                        asyncCmd.getEventDescription(), asyncCmd.getApiResourceId(), asyncCmd.getApiResourceType().toString(), asyncCmd.isDisplay(), startEventId);
+        if (startEventId == 0) {
+            // There was no create event before, set current event id as start eventId
+            startEventId = eventId;
+        }
+
+        params.put("ctxStartEventId", String.valueOf(startEventId));
+        params.put("cmdEventType", asyncCmd.getEventType());
+        params.put("ctxDetails", ApiGsonHelper.getBuilder().create().toJson(ctx.getContextParameters()));
+        if (asyncCmd.getHttpMethod() != null) {
+            params.put(ApiConstants.HTTPMETHOD, asyncCmd.getHttpMethod().toString());
+        }
+
+        Long instanceId = (objectId == null) ? asyncCmd.getApiResourceId() : objectId;
+
+        // users can provide the job id they want to use, so log as it is a uuid and is unique
+        String injectedJobId = asyncCmd.getInjectedJobId();
+        uuidMgr.checkUuidSimple(injectedJobId, AsyncJob.class);
+
+        AsyncJobVO job = new AsyncJobVO("", callerUserId, caller.getId(), asyncCmd.getClass().getName(),
+                ApiGsonHelper.getBuilder().create().toJson(params), instanceId,
+                asyncCmd.getApiResourceType() != null ? asyncCmd.getApiResourceType().toString() : null,
+                        injectedJobId);
+        job.setDispatcher(asyncDispatcher.getName());
+
+        final long jobId = asyncMgr.submitAsyncJob(job);
+
+        if (jobId == 0L) {
+            final String errorMsg = "Unable to schedule async job for command " + job.getCmd();
+            logger.warn(errorMsg);
+            throw new ServerApiException(ApiErrorCode.INTERNAL_ERROR, errorMsg);
+        }
+        return new AsyncCmdResult(objectId, objectUuid, asyncCmd, jobId);
+    }
+
     @SuppressWarnings("unchecked")
     private void buildAsyncListResponse(final BaseListCmd command, final Account account) {
         final List<ResponseObject> responses = ((ListResponse<ResponseObject>)command.getResponseObject()).getResponses();
diff --git a/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDao.java
index 756425f5093e..43974bcf9cc6 100644
--- a/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDao.java
@@ -16,6 +16,8 @@
 // under the License.
 package com.cloud.api.query.dao;
 
+import java.util.List;
+
 import org.apache.cloudstack.api.response.AsyncJobResponse;
 import org.apache.cloudstack.framework.jobs.AsyncJob;
 
@@ -28,4 +30,6 @@ public interface AsyncJobJoinDao extends GenericDao<AsyncJobJoinVO, Long> {
 
     AsyncJobJoinVO newAsyncJobView(AsyncJob vol);
 
+    List<AsyncJobJoinVO> listByIds(List<Long> ids);
+
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDaoImpl.java
index 10ef67bbbea1..93af9a04e144 100644
--- a/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/AsyncJobJoinDaoImpl.java
@@ -16,17 +16,17 @@
 // under the License.
 package com.cloud.api.query.dao;
 
+import java.util.Collections;
 import java.util.Date;
 import java.util.List;
 
-
 import javax.inject.Inject;
 
-import org.springframework.stereotype.Component;
-
 import org.apache.cloudstack.api.ResponseObject;
 import org.apache.cloudstack.api.response.AsyncJobResponse;
 import org.apache.cloudstack.framework.jobs.AsyncJob;
+import org.apache.commons.collections.CollectionUtils;
+import org.springframework.stereotype.Component;
 
 import com.cloud.api.ApiResponseHelper;
 import com.cloud.api.ApiSerializerHelper;
@@ -115,4 +115,16 @@ public AsyncJobJoinVO newAsyncJobView(AsyncJob job) {
 
     }
 
+    @Override
+    public List<AsyncJobJoinVO> listByIds(List<Long> ids) {
+        if (CollectionUtils.isEmpty(ids)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<AsyncJobJoinVO> idsSearch = createSearchBuilder();
+        idsSearch.and("ids", idsSearch.entity().getId(), SearchCriteria.Op.IN);
+        idsSearch.done();
+        SearchCriteria<AsyncJobJoinVO> sc = idsSearch.create();
+        sc.setParameters("ids", ids.toArray());
+        return listBy(sc);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDao.java
index 8e32cd010746..7d76349113b5 100644
--- a/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDao.java
@@ -16,11 +16,14 @@
 // under the License.
 package com.cloud.api.query.dao;
 
+import java.util.List;
+
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
 import org.apache.cloudstack.api.response.ZoneResponse;
 
 import com.cloud.api.query.vo.DataCenterJoinVO;
 import com.cloud.dc.DataCenter;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 
 public interface DataCenterJoinDao extends GenericDao<DataCenterJoinVO, Long> {
@@ -30,4 +33,6 @@ public interface DataCenterJoinDao extends GenericDao<DataCenterJoinVO, Long> {
     ZoneResponse newDataCenterResponse(ResponseView view, DataCenterJoinVO dof, Boolean showCapacities, Boolean showResourceImage);
 
     DataCenterJoinVO newDataCenterView(DataCenter dof);
+
+    List<DataCenterJoinVO> listByIds(List<Long> ids, Filter filter);
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDaoImpl.java
index f2d061c7bb0a..35d27e0cb791 100644
--- a/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/DataCenterJoinDaoImpl.java
@@ -16,22 +16,13 @@
 // under the License.
 package com.cloud.api.query.dao;
 
+import java.util.Collections;
 import java.util.List;
 import java.util.Objects;
 import java.util.stream.Collectors;
 
 import javax.inject.Inject;
 
-import com.cloud.cpu.CPU;
-import com.cloud.dc.ASNumberRangeVO;
-import com.cloud.dc.dao.ASNumberRangeDao;
-import com.cloud.gpu.dao.HostGpuGroupsDao;
-import com.cloud.network.Network;
-import com.cloud.network.dao.NetrisProviderDao;
-import com.cloud.network.dao.NsxProviderDao;
-import com.cloud.network.element.NetrisProviderVO;
-import com.cloud.network.element.NsxProviderVO;
-import com.cloud.utils.Pair;
 import org.apache.cloudstack.annotation.AnnotationService;
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
@@ -48,11 +39,22 @@
 import com.cloud.api.ApiResponseHelper;
 import com.cloud.api.query.vo.DataCenterJoinVO;
 import com.cloud.api.query.vo.ResourceTagJoinVO;
+import com.cloud.cpu.CPU;
+import com.cloud.dc.ASNumberRangeVO;
 import com.cloud.dc.DataCenter;
+import com.cloud.dc.dao.ASNumberRangeDao;
+import com.cloud.gpu.dao.HostGpuGroupsDao;
+import com.cloud.network.Network;
 import com.cloud.network.NetworkService;
+import com.cloud.network.dao.NetrisProviderDao;
+import com.cloud.network.dao.NsxProviderDao;
+import com.cloud.network.element.NetrisProviderVO;
+import com.cloud.network.element.NsxProviderVO;
 import com.cloud.resource.icon.ResourceIconVO;
 import com.cloud.server.ResourceTag.ResourceObjectType;
 import com.cloud.user.AccountManager;
+import com.cloud.utils.Pair;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
@@ -200,4 +202,15 @@ public DataCenterJoinVO newDataCenterView(DataCenter dataCenter) {
         return dcs.get(0);
     }
 
+    @Override
+    public List<DataCenterJoinVO> listByIds(List<Long> ids, Filter filter) {
+        if (CollectionUtils.isEmpty(ids)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<DataCenterJoinVO> sb = createSearchBuilder();
+        sb.and("ids", sb.entity().getId(), SearchCriteria.Op.IN);
+        SearchCriteria<DataCenterJoinVO> sc = sb.create();
+        sc.setParameters("ids", ids.toArray());
+        return listBy(sc, filter);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/HostJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/HostJoinDao.java
index bc6ec7931366..c4128178b5e6 100644
--- a/server/src/main/java/com/cloud/api/query/dao/HostJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/HostJoinDao.java
@@ -25,6 +25,8 @@
 
 import com.cloud.api.query.vo.HostJoinVO;
 import com.cloud.host.Host;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 
 public interface HostJoinDao extends GenericDao<HostJoinVO, Long> {
@@ -41,4 +43,6 @@ public interface HostJoinDao extends GenericDao<HostJoinVO, Long> {
 
     List<HostJoinVO> findByClusterId(Long clusterId, Host.Type type);
 
+    List<HostJoinVO> listAvailableRoutingByZonesAndHypervisor(List<Long> zoneIds, Hypervisor.HypervisorType hypervisorType, Filter filter);
+
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java
index e7265a7e3b9a..0200dec2cd3c 100644
--- a/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java
@@ -19,6 +19,7 @@
 import java.text.DecimalFormat;
 import java.util.ArrayList;
 import java.util.Arrays;
+import java.util.Collections;
 import java.util.Date;
 import java.util.EnumSet;
 import java.util.Iterator;
@@ -40,6 +41,7 @@
 import org.apache.cloudstack.ha.HAResource;
 import org.apache.cloudstack.ha.dao.HAConfigDao;
 import org.apache.cloudstack.outofbandmanagement.dao.OutOfBandManagementDao;
+import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
 
@@ -53,8 +55,10 @@
 import com.cloud.host.HostStats;
 import com.cloud.host.dao.HostDetailsDao;
 import com.cloud.hypervisor.Hypervisor;
+import com.cloud.resource.ResourceState;
 import com.cloud.storage.StorageStats;
 import com.cloud.user.AccountManager;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
@@ -413,4 +417,26 @@ private String calculateResourceAllocatedPercentage(float resource, float resour
         return decimalFormat.format(((float)resource / resourceWithOverProvision * 100.0f)) + "%";
     }
 
+    @Override
+    public List<HostJoinVO> listAvailableRoutingByZonesAndHypervisor(List<Long> zoneIds, Hypervisor.HypervisorType hypervisorType, Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        List<ResourceState> availableStates = Arrays.asList(
+                ResourceState.Enabled, ResourceState.Disabled, ResourceState.Degraded
+        );
+        SearchBuilder<HostJoinVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getZoneId(), SearchCriteria.Op.IN);
+        sb.and("type", sb.entity().getType(), SearchCriteria.Op.EQ);
+        sb.and("hypervisorType", sb.entity().getHypervisorType(), SearchCriteria.Op.EQ);
+        sb.and("resourceStates", sb.entity().getResourceState(), SearchCriteria.Op.IN);
+        sb.done();
+
+        SearchCriteria<HostJoinVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("type", Host.Type.Routing);
+        sc.setParameters("hypervisorType", hypervisorType);
+        sc.setParameters("resourceStates", availableStates.toArray());
+        return listBy(sc, filter);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDao.java
index bc19e0892057..ed381743c354 100644
--- a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDao.java
@@ -18,11 +18,14 @@
 
 import java.util.List;
 
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.storage.ScopeType;
 import org.apache.cloudstack.api.response.StoragePoolResponse;
 
 import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.storage.Storage;
 import com.cloud.storage.StoragePool;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 
@@ -44,4 +47,6 @@ public interface StoragePoolJoinDao extends GenericDao<StoragePoolJoinVO, Long>
 
     List<StoragePoolVO> findStoragePoolByScopeAndRuleTags(Long datacenterId, Long podId, Long clusterId, ScopeType scopeType, List<String> tags);
 
+    List<StoragePoolJoinVO> listAvailableByZoneHypervisorAndType(long zoneId, Hypervisor.HypervisorType hypervisorType, List<Storage.StoragePoolType> types, Filter filter);
+
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java
index 8bfce47b1204..a9d5b726b860 100644
--- a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java
@@ -19,6 +19,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
+import java.util.Map;
 
 import javax.inject.Inject;
 
@@ -35,26 +36,28 @@
 import org.apache.cloudstack.storage.datastore.db.StoragePoolDetailsDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.collections.MapUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.api.ApiDBUtils;
 import com.cloud.api.query.vo.StoragePoolJoinVO;
 import com.cloud.capacity.CapacityManager;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.server.ResourceTag;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.ScopeType;
 import com.cloud.storage.Storage;
 import com.cloud.storage.StoragePool;
+import com.cloud.storage.StoragePoolStatus;
 import com.cloud.storage.StorageStats;
 import com.cloud.storage.VolumeApiServiceImpl;
 import com.cloud.user.AccountManager;
 import com.cloud.utils.StringUtils;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
-import org.apache.commons.collections.MapUtils;
-
-import java.util.Map;
 
 @Component
 public class StoragePoolJoinDaoImpl extends GenericDaoBase<StoragePoolJoinVO, Long> implements StoragePoolJoinDao {
@@ -410,4 +413,26 @@ public List<StoragePoolVO> findStoragePoolByScopeAndRuleTags(Long datacenterId,
         return filteredPools;
     }
 
+    public List<StoragePoolJoinVO> listAvailableByZoneHypervisorAndType(long zoneId, Hypervisor.HypervisorType hypervisorType, List<Storage.StoragePoolType> types, Filter filter) {
+        List<StoragePoolStatus> availableStatus = Arrays.asList(
+                StoragePoolStatus.Up, StoragePoolStatus.Disabled
+        );
+        SearchBuilder<StoragePoolJoinVO> sb = createSearchBuilder();
+        sb.and("zoneId", sb.entity().getZoneId(), SearchCriteria.Op.EQ);
+        sb.and("hypervisors", sb.entity().getHypervisor(), SearchCriteria.Op.IN);
+        sb.and("types", sb.entity().getPoolType(), SearchCriteria.Op.IN);
+        sb.and("status", sb.entity().getStatus(), SearchCriteria.Op.IN);
+        sb.done();
+        SearchCriteria<StoragePoolJoinVO> sc = sb.create();
+        sc.setParameters("zoneId", zoneId);
+        List<Hypervisor.HypervisorType> hypervisors = new ArrayList<>();
+        hypervisors.add(Hypervisor.HypervisorType.Any);
+        hypervisors.add(hypervisorType);
+        sc.setParameters("hypervisors", hypervisors.toArray());
+        if (CollectionUtils.isNotEmpty(types)) {
+            sc.setParameters("types", types.toArray());
+        }
+        sc.setParameters("status", availableStatus.toArray());
+        return listBy(sc, filter);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDao.java
index 79312460d2c0..ae62f301f466 100644
--- a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDao.java
@@ -17,8 +17,10 @@
 package com.cloud.api.query.dao;
 
 import com.cloud.api.query.vo.UserVmJoinVO;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.user.Account;
 import com.cloud.uservm.UserVm;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 import com.cloud.vm.VirtualMachine;
 import org.apache.cloudstack.api.ApiConstants.VMDetails;
@@ -49,4 +51,8 @@ List<UserVmJoinVO> listByAccountServiceOfferingTemplateAndNotInState(long accoun
     List<UserVmJoinVO> listEligibleInstancesWithExpiredLease();
 
     List<UserVmJoinVO> listLeaseInstancesExpiringInDays(int days);
+
+    List<UserVmJoinVO> listByZonesHypervisorNotTypesAndOwners(List<Long> zoneIds, Hypervisor.HypervisorType hypervisorType,
+                                                              List<String> excludeTypes, List<Long> accountIds,
+                                                              String domainPath, Filter filter);
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java
index 72690091e40e..39cca06c1002 100644
--- a/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/UserVmJoinDaoImpl.java
@@ -61,6 +61,7 @@
 import com.cloud.gpu.GPU;
 import com.cloud.gpu.dao.VgpuProfileDao;
 import com.cloud.host.ControlState;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.network.IpAddress;
 import com.cloud.network.vpc.VpcVO;
 import com.cloud.network.vpc.dao.VpcDao;
@@ -83,6 +84,7 @@
 import com.cloud.user.dao.UserDao;
 import com.cloud.user.dao.UserStatisticsDao;
 import com.cloud.uservm.UserVm;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
 import com.cloud.utils.db.SearchCriteria.Op;
@@ -507,7 +509,7 @@ public UserVmResponse newUserVmResponse(ResponseView view, String objectName, Us
         }
 
         if (userVm.getUserDataId() != null) {
-            userVmResponse.setUserDataId(userVm.getUserDataUUid());
+            userVmResponse.setUserDataId(userVm.getUserDataUuid());
             userVmResponse.setUserDataName(userVm.getUserDataName());
             userVmResponse.setUserDataDetails(userVm.getUserDataDetails());
             userVmResponse.setUserDataPolicy(userVm.getUserDataPolicy());
@@ -841,4 +843,43 @@ public List<UserVmJoinVO> listLeaseInstancesExpiringInDays(int days) {
         }
         return listBy(sc);
     }
+
+    @Override
+    public List<UserVmJoinVO> listByZonesHypervisorNotTypesAndOwners(List<Long> zoneIds,
+                                                                     Hypervisor.HypervisorType hypervisorType,
+                                                                     List<String> excludeTypes, List<Long> accountIds,
+                                                                     String domainPath, Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<UserVmJoinVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        sb.and("hypervisorType", sb.entity().getHypervisorType(), Op.EQ);
+        if (CollectionUtils.isNotEmpty(excludeTypes)) {
+            sb.and().op("typeNull", sb.entity().getUserVmType(), Op.NULL);
+            sb.or("type", sb.entity().getUserVmType(), Op.NOTIN);
+            sb.cp();
+        }
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainPathNotBlank = StringUtils.isNotBlank(domainPath);
+        if (accountIdsNotEmpty || domainPathNotBlank) {
+            sb.and().op("account", sb.entity().getAccountId(), Op.IN);
+            sb.or("domainPath", sb.entity().getDomainPath(), Op.LIKE);
+            sb.cp();
+        }
+        sb.done();
+        SearchCriteria<UserVmJoinVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("hypervisorType", hypervisorType);
+        if (CollectionUtils.isNotEmpty(excludeTypes)) {
+            sc.setParameters("type", excludeTypes.toArray());
+        }
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainPathNotBlank) {
+            sc.setParameters("domainPath", domainPath + "%");
+        }
+        return listBy(sc, filter);
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDao.java b/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDao.java
index ebcf0bca391e..7336bdfb3b58 100644
--- a/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDao.java
+++ b/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDao.java
@@ -22,7 +22,9 @@
 import org.apache.cloudstack.api.response.VolumeResponse;
 
 import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.hypervisor.Hypervisor;
 import com.cloud.storage.Volume;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDao;
 
 public interface VolumeJoinDao extends GenericDao<VolumeJoinVO, Long> {
@@ -34,4 +36,9 @@ public interface VolumeJoinDao extends GenericDao<VolumeJoinVO, Long> {
     List<VolumeJoinVO> newVolumeView(Volume vol);
 
     List<VolumeJoinVO> searchByIds(Long... ids);
+
+    List<VolumeJoinVO> listByInstanceId(long instanceId);
+
+    List<VolumeJoinVO> listByZonesHypervisorTypeAndOwners(List<Long> zoneIds, Hypervisor.HypervisorType hypervisorType,
+                                                          List<Long> accountIds, String domainPath, Filter filter);
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDaoImpl.java
index 4f5d984c969a..a92427ca19f0 100644
--- a/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/VolumeJoinDaoImpl.java
@@ -17,12 +17,11 @@
 package com.cloud.api.query.dao;
 
 import java.util.ArrayList;
+import java.util.Collections;
 import java.util.List;
 
 import javax.inject.Inject;
 
-import com.cloud.hypervisor.Hypervisor;
-import com.cloud.offering.DiskOffering;
 import org.apache.cloudstack.annotation.AnnotationService;
 import org.apache.cloudstack.annotation.dao.AnnotationDao;
 import org.apache.cloudstack.api.ResponseObject.ResponseView;
@@ -31,11 +30,15 @@
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
 import org.springframework.stereotype.Component;
 
 import com.cloud.api.ApiDBUtils;
 import com.cloud.api.ApiResponseHelper;
 import com.cloud.api.query.vo.VolumeJoinVO;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.offering.DiskOffering;
 import com.cloud.offering.ServiceOffering;
 import com.cloud.storage.Storage;
 import com.cloud.storage.VMTemplateStorageResourceAssoc.Status;
@@ -43,8 +46,10 @@
 import com.cloud.user.AccountManager;
 import com.cloud.user.VmDiskStatisticsVO;
 import com.cloud.user.dao.VmDiskStatisticsDao;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.SearchBuilder;
 import com.cloud.utils.db.SearchCriteria;
+import com.cloud.vm.VirtualMachine;
 
 @Component
 public class VolumeJoinDaoImpl extends GenericDaoBaseWithTagInformation<VolumeJoinVO, VolumeResponse> implements VolumeJoinDao {
@@ -372,4 +377,44 @@ public List<VolumeJoinVO> searchByIds(Long... volIds) {
         return uvList;
     }
 
+    @Override
+    public List<VolumeJoinVO> listByInstanceId(long instanceId) {
+        SearchCriteria<VolumeJoinVO> sc = createSearchCriteria();
+        sc.addAnd("vmId", SearchCriteria.Op.EQ, instanceId);
+        return search(sc, null);
+    }
+
+    @Override
+    public List<VolumeJoinVO> listByZonesHypervisorTypeAndOwners(List<Long> zoneIds,
+                                                                 Hypervisor.HypervisorType hypervisorType,
+                                                                 List<Long> accountIds, String domainPath,
+                                                                 Filter filter) {
+        if (CollectionUtils.isEmpty(zoneIds)) {
+            return Collections.emptyList();
+        }
+        SearchBuilder<VolumeJoinVO> sb = createSearchBuilder();
+        sb.and("dataCenterId", sb.entity().getDataCenterId(), SearchCriteria.Op.IN);
+        sb.and("vmType", sb.entity().getVmType(), SearchCriteria.Op.EQ);
+        sb.and("hypervisorType", sb.entity().getHypervisorType(), SearchCriteria.Op.EQ);
+        boolean accountIdsNotEmpty = CollectionUtils.isNotEmpty(accountIds);
+        boolean domainPathNotBlank = StringUtils.isNotBlank(domainPath);
+        if (accountIdsNotEmpty || domainPathNotBlank) {
+            sb.and().op("account", sb.entity().getAccountId(), SearchCriteria.Op.IN);
+            sb.or("domainPath", sb.entity().getDomainPath(), SearchCriteria.Op.LIKE);
+            sb.cp();
+        }
+        sb.done();
+        SearchCriteria<VolumeJoinVO> sc = sb.create();
+        sc.setParameters("dataCenterId", zoneIds.toArray());
+        sc.setParameters("vmType", VirtualMachine.Type.User);
+        sc.setParameters("hypervisorType", hypervisorType);
+        if (accountIdsNotEmpty) {
+            sc.setParameters("account", accountIds.toArray());
+        }
+        if (domainPathNotBlank) {
+            sc.setParameters("domainPath", domainPath + "%");
+        }
+        return search(sc, filter);
+    }
+
 }
diff --git a/server/src/main/java/com/cloud/api/query/vo/UserVmJoinVO.java b/server/src/main/java/com/cloud/api/query/vo/UserVmJoinVO.java
index c59a13ccd1b2..b697c3571159 100644
--- a/server/src/main/java/com/cloud/api/query/vo/UserVmJoinVO.java
+++ b/server/src/main/java/com/cloud/api/query/vo/UserVmJoinVO.java
@@ -131,6 +131,9 @@ public class UserVmJoinVO extends BaseViewWithTagInformationVO implements Contro
     @Column(name = "guest_os_uuid")
     private String guestOsUuid;
 
+    @Column(name = "guest_os_display_name")
+    private String guestOsDisplayName;
+
     @Column(name = "hypervisor_type")
     @Convert(converter = HypervisorTypeConverter.class)
     private HypervisorType hypervisorType;
@@ -432,7 +435,7 @@ public class UserVmJoinVO extends BaseViewWithTagInformationVO implements Contro
     private int jobStatus;
 
     @Column(name = "affinity_group_id")
-    private long affinityGroupId;
+    private Long affinityGroupId;
 
     @Column(name = "affinity_group_uuid")
     private String affinityGroupUuid;
@@ -615,6 +618,10 @@ public String getGuestOsUuid() {
         return guestOsUuid;
     }
 
+    public String getGuestOsDisplayName() {
+        return guestOsDisplayName;
+    }
+
     public HypervisorType getHypervisorType() {
         return hypervisorType;
     }
@@ -1019,7 +1026,7 @@ public String getIp6Cidr() {
         return ip6Cidr;
     }
 
-    public long getAffinityGroupId() {
+    public Long getAffinityGroupId() {
         return affinityGroupId;
     }
 
@@ -1064,7 +1071,7 @@ public Long getUserDataId() {
         return userDataId;
     }
 
-    public String getUserDataUUid() {
+    public String getUserDataUuid() {
         return userDataUuid;
     }
 
diff --git a/server/src/main/java/com/cloud/api/query/vo/VolumeJoinVO.java b/server/src/main/java/com/cloud/api/query/vo/VolumeJoinVO.java
index 2ae720fa8524..ba932c775beb 100644
--- a/server/src/main/java/com/cloud/api/query/vo/VolumeJoinVO.java
+++ b/server/src/main/java/com/cloud/api/query/vo/VolumeJoinVO.java
@@ -23,6 +23,7 @@
 import javax.persistence.Entity;
 import javax.persistence.EnumType;
 import javax.persistence.Enumerated;
+import javax.persistence.Id;
 import javax.persistence.Table;
 import javax.persistence.Temporal;
 import javax.persistence.TemporalType;
@@ -40,6 +41,10 @@
 @Table(name = "volume_view")
 public class VolumeJoinVO extends BaseViewWithTagInformationVO implements ControlledViewEntity {
 
+    @Id
+    @Column(name = "id", updatable = false, nullable = false)
+    private long id;
+
     @Column(name = "uuid")
     private String uuid;
 
diff --git a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
index 6da5dda967d0..ad31cfbaef9a 100644
--- a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -160,6 +160,9 @@
 import com.cloud.api.query.vo.NetworkOfferingJoinVO;
 import com.cloud.capacity.CapacityManager;
 import com.cloud.capacity.dao.CapacityDao;
+import com.cloud.cluster.ManagementServerHostVO;
+import com.cloud.cluster.dao.ManagementServerHostDao;
+import com.cloud.cluster.dao.ManagementServerHostDetailsDao;
 import com.cloud.configuration.Resource.ResourceType;
 import com.cloud.dc.AccountVlanMapVO;
 import com.cloud.dc.ClusterDetailsDao;
@@ -469,6 +472,10 @@ public class ConfigurationManagerImpl extends ManagerBase implements Configurati
     @Inject
     ImageStoreDetailsDao _imageStoreDetailsDao;
     @Inject
+    ManagementServerHostDao managementServerHostDao;
+    @Inject
+    ManagementServerHostDetailsDao managementServerHostDetailsDao;
+    @Inject
     MessageBus messageBus;
     @Inject
     AgentManager _agentManager;
@@ -885,6 +892,13 @@ public String updateConfiguration(final long userId, final String name, final St
                 }
                 break;
 
+                case ManagementServer:
+                    final ManagementServerHostVO managementServer = managementServerHostDao.findById(resourceId);
+                    Preconditions.checkState(managementServer != null);
+                    resourceType = ApiCommandResourceType.ManagementServer;
+                    managementServerHostDetailsDao.addDetail(resourceId, name, value, true);
+                    break;
+
             default:
                 throw new InvalidParameterValueException("Scope provided is invalid");
             }
@@ -1032,8 +1046,9 @@ public Configuration updateConfiguration(final UpdateCfgCmd cmd) throws InvalidP
         String value = cmd.getValue();
         final Long zoneId = cmd.getZoneId();
         final Long clusterId = cmd.getClusterId();
-        final Long storagepoolId = cmd.getStoragepoolId();
+        final Long storagepoolId = cmd.getStoragePoolId();
         final Long imageStoreId = cmd.getImageStoreId();
+        final Long managementServerId = cmd.getManagementServerId();
         Long accountId = cmd.getAccountId();
         Long domainId = cmd.getDomainId();
         // check if config value exists
@@ -1113,6 +1128,11 @@ public Configuration updateConfiguration(final UpdateCfgCmd cmd) throws InvalidP
             id = imageStoreId;
             paramCountCheck++;
         }
+        if (managementServerId != null) {
+            scope = ConfigKey.Scope.ManagementServer;
+            id = managementServerId;
+            paramCountCheck++;
+        }
 
         if (paramCountCheck > 1) {
             throw new InvalidParameterValueException("cannot handle multiple IDs, provide only one ID corresponding to the scope");
@@ -1168,6 +1188,7 @@ public Pair<Configuration, String> resetConfiguration(final ResetCfgCmd cmd) thr
         final Long accountId = cmd.getAccountId();
         final Long domainId = cmd.getDomainId();
         final Long imageStoreId = cmd.getImageStoreId();
+        final Long managementServerId = cmd.getManagementServerId();
         ConfigKey<?> configKey = null;
         Optional optionalValue;
         String defaultValue;
@@ -1201,6 +1222,7 @@ public Pair<Configuration, String> resetConfiguration(final ResetCfgCmd cmd) thr
         scopeMap.put(ConfigKey.Scope.Account.toString(), accountId);
         scopeMap.put(ConfigKey.Scope.StoragePool.toString(), storagepoolId);
         scopeMap.put(ConfigKey.Scope.ImageStore.toString(), imageStoreId);
+        scopeMap.put(ConfigKey.Scope.ManagementServer.toString(), managementServerId);
 
         ParamCountPair paramCountPair = getParamCount(scopeMap);
         id = paramCountPair.getId();
@@ -1297,6 +1319,16 @@ public Pair<Configuration, String> resetConfiguration(final ResetCfgCmd cmd) thr
                 newValue = optionalValue.isPresent() ? optionalValue.get().toString() : defaultValue;
                 break;
 
+            case ManagementServer:
+                final ManagementServerHostVO managementServer = managementServerHostDao.findById(id);
+                if (managementServer == null) {
+                    throw new InvalidParameterValueException("unable to find management server by id " + id);
+                }
+                managementServerHostDetailsDao.removeDetail(id, name);
+                optionalValue = Optional.ofNullable(configKey != null ? configKey.valueIn(id) : config.getValue());
+                newValue = optionalValue.isPresent() ? optionalValue.get().toString() : defaultValue;
+                break;
+
             default:
                 if (!_configDao.update(name, category, defaultValue)) {
                     logger.error("Failed to reset configuration option, name: {}, defaultValue: {}", name, defaultValue);
diff --git a/server/src/main/java/com/cloud/server/ManagementServerImpl.java b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
index e5066b6da5cc..cadcf97626e3 100644
--- a/server/src/main/java/com/cloud/server/ManagementServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ManagementServerImpl.java
@@ -2357,6 +2357,7 @@ public Pair<List<? extends Configuration>, Integer> searchForConfigurations(fina
         final Long clusterId = cmd.getClusterId();
         final Long storagepoolId = cmd.getStoragepoolId();
         final Long imageStoreId = cmd.getImageStoreId();
+        final Long managementServerId = cmd.getManagementServerId();
         Long accountId = cmd.getAccountId();
         Long domainId = cmd.getDomainId();
         final String groupName = cmd.getGroupName();
@@ -2410,6 +2411,11 @@ public Pair<List<? extends Configuration>, Integer> searchForConfigurations(fina
             id = imageStoreId;
             paramCountCheck++;
         }
+        if (managementServerId != null) {
+            scope = ConfigKey.Scope.ManagementServer;
+            id = managementServerId;
+            paramCountCheck++;
+        }
 
         if (paramCountCheck > 1) {
             throw new InvalidParameterValueException("cannot handle multiple IDs, provide only one ID corresponding to the scope");
diff --git a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
index 6872d2070d66..afe16c2b574e 100644
--- a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
+++ b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
@@ -219,10 +219,10 @@
 import com.cloud.utils.fsm.NoTransitionException;
 import com.cloud.utils.fsm.StateMachine2;
 import com.cloud.vm.DiskProfile;
-import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.UserVmManager;
 import com.cloud.vm.UserVmService;
 import com.cloud.vm.UserVmVO;
+import com.cloud.vm.VMInstanceDetailVO;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.VirtualMachine;
 import com.cloud.vm.VirtualMachine.State;
@@ -241,14 +241,13 @@
 import com.cloud.vm.VmWorkSerializer;
 import com.cloud.vm.VmWorkTakeVolumeSnapshot;
 import com.cloud.vm.dao.UserVmDao;
-import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
 import com.cloud.vm.snapshot.VMSnapshot;
 import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
 import com.cloud.vm.snapshot.VMSnapshotVO;
 import com.cloud.vm.snapshot.dao.VMSnapshotDao;
 import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
-
 import com.google.gson.Gson;
 import com.google.gson.GsonBuilder;
 import com.google.gson.JsonParseException;
@@ -656,21 +655,6 @@ private Long getDefaultCustomOfferingId(Account owner, DataCenter zone) {
         return null;
     }
 
-    private Long getCustomDiskOfferingIdForVolumeUpload(Account owner, DataCenter zone) {
-        Long offeringId = getDefaultCustomOfferingId(owner, zone);
-        if (offeringId != null) {
-            return offeringId;
-        }
-        List<DiskOfferingVO> offerings = _diskOfferingDao.findCustomDiskOfferings();
-        for (DiskOfferingVO offering : offerings) {
-            try {
-                _configMgr.checkDiskOfferingAccess(owner, offering, zone);
-                return offering.getId();
-            } catch (PermissionDeniedException ignored) {}
-        }
-        return null;
-    }
-
     @DB
     protected VolumeVO persistVolume(final Account owner, final Long zoneId, final String volumeName, final String url, final String format, final Long diskOfferingId, final Volume.State state) {
         return Transaction.execute(new TransactionCallbackWithException<VolumeVO, CloudRuntimeException>() {
@@ -689,7 +673,7 @@ public VolumeVO doInTransaction(TransactionStatus status) {
 
                 Long volumeDiskOfferingId = diskOfferingId;
                 if (volumeDiskOfferingId == null) {
-                    volumeDiskOfferingId = getCustomDiskOfferingIdForVolumeUpload(owner, zone);
+                    volumeDiskOfferingId = getCustomDiskOfferingIdForVolumeUpload(owner, zone, false);
                     if (volumeDiskOfferingId == null) {
                         throw new CloudRuntimeException(String.format("Unable to find custom disk offering in zone: %s for volume upload", zone.getUuid()));
                     }
@@ -736,17 +720,41 @@ public VolumeVO doInTransaction(TransactionStatus status) {
      * If the retrieved volume name is null, empty or blank, then A random name
      * will be generated using getRandomVolumeName method.
      *
-     * @param cmd
+     * @param userSpecifiedName
      * @return Either the retrieved name or a random name.
      */
-    public String getVolumeNameFromCommand(CreateVolumeCmd cmd) {
-        String userSpecifiedName = cmd.getVolumeName();
-
-        if (StringUtils.isBlank(userSpecifiedName)) {
-            userSpecifiedName = getRandomVolumeName();
+    public String getVolumeNameFromCommand(String userSpecifiedName) {
+        if (StringUtils.isNotBlank(userSpecifiedName)) {
+            return userSpecifiedName;
         }
 
-        return userSpecifiedName;
+        return getRandomVolumeName();
+    }
+
+    @Override
+    public Long getCustomDiskOfferingIdForVolumeUpload(Account owner, DataCenter zone, boolean encryptEnabledOnly) {
+        Long offeringId = getDefaultCustomOfferingId(owner, zone);
+        if (offeringId != null) {
+            if (encryptEnabledOnly) {
+                DiskOfferingVO offering = _diskOfferingDao.findById(offeringId);
+                if (offering != null && offering.getEncrypt()) {
+                    return offeringId;
+                }
+            } else {
+                return offeringId;
+            }
+        }
+        List<DiskOfferingVO> offerings = _diskOfferingDao.listCustomDiskOfferings();
+        for (DiskOfferingVO offering : offerings) {
+            if (encryptEnabledOnly && !offering.getEncrypt()) {
+                continue;
+            }
+            try {
+                _configMgr.checkDiskOfferingAccess(owner, offering, zone);
+                return offering.getId();
+            } catch (PermissionDeniedException ignored) {}
+        }
+        return null;
     }
 
     /*
@@ -758,11 +766,20 @@ public String getVolumeNameFromCommand(CreateVolumeCmd cmd) {
     @DB
     @ActionEvent(eventType = EventTypes.EVENT_VOLUME_CREATE, eventDescription = "creating volume", create = true)
     public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationException {
+        return allocVolume(cmd.getEntityOwnerId(), cmd.getZoneId(), cmd.getDiskOfferingId(), cmd.getVirtualMachineId(),
+                cmd.getSnapshotId(), getVolumeNameFromCommand(cmd.getVolumeName()), cmd.getSize(),
+                cmd.getDisplayVolume(), cmd.getMinIops(), cmd.getMaxIops(), cmd.getCustomId());
+    }
+
+    @Override
+    @DB
+    @ActionEvent(eventType = EventTypes.EVENT_VOLUME_CREATE, eventDescription = "creating volume", create = true)
+    public VolumeVO allocVolume(long ownerId, Long zoneId, Long diskOfferingId, Long vmId, Long snapshotId,
+            String name, Long cmdSize, Boolean displayVolume, Long cmdMinIops, Long cmdMaxIops, String customId)
+            throws ResourceAllocationException {
         Account caller = CallContext.current().getCallingAccount();
 
-        long ownerId = cmd.getEntityOwnerId();
         Account owner = _accountMgr.getActiveAccountById(ownerId);
-        Boolean displayVolume = cmd.getDisplayVolume();
 
         // permission check
         _accountMgr.checkAccess(caller, null, true, _accountMgr.getActiveAccountById(ownerId));
@@ -775,8 +792,6 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
             }
         }
 
-        Long zoneId = cmd.getZoneId();
-        Long diskOfferingId = null;
         DiskOfferingVO diskOffering = null;
         Long size = null;
         Long minIops = null;
@@ -785,13 +800,13 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
         VolumeVO parentVolume = null;
 
         // validate input parameters before creating the volume
-        if (cmd.getSnapshotId() == null && cmd.getDiskOfferingId() == null) {
+        if (snapshotId == null && diskOfferingId == null) {
             throw new InvalidParameterValueException("At least one of disk Offering ID or snapshot ID must be passed whilst creating volume");
         }
 
         // disallow passing disk offering ID with DATA disk volume snapshots
-        if (cmd.getSnapshotId() != null && cmd.getDiskOfferingId() != null) {
-            SnapshotVO snapshot = _snapshotDao.findById(cmd.getSnapshotId());
+        if (snapshotId != null && diskOfferingId != null) {
+            SnapshotVO snapshot = _snapshotDao.findById(snapshotId);
             if (snapshot != null) {
                 parentVolume = _volsDao.findByIdIncludingRemoved(snapshot.getVolumeId());
                 if (parentVolume != null && parentVolume.getVolumeType() != Volume.Type.ROOT)
@@ -801,10 +816,8 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
         }
 
         Map<String, String> details = new HashMap<>();
-        if (cmd.getDiskOfferingId() != null) { // create a new volume
-
-            diskOfferingId = cmd.getDiskOfferingId();
-            size = cmd.getSize();
+        if (diskOfferingId != null) { // create a new volume
+            size = cmdSize;
             Long sizeInGB = size;
             if (size != null) {
                 if (size > 0) {
@@ -850,8 +863,8 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
 
             if (isCustomizedIops != null) {
                 if (isCustomizedIops) {
-                    minIops = cmd.getMinIops();
-                    maxIops = cmd.getMaxIops();
+                    minIops = cmdMinIops;
+                    maxIops = cmdMaxIops;
 
                     if (minIops == null && maxIops == null) {
                         minIops = 0L;
@@ -883,8 +896,7 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
             }
         }
 
-        if (cmd.getSnapshotId() != null) { // create volume from snapshot
-            Long snapshotId = cmd.getSnapshotId();
+        if (snapshotId != null) { // create volume from snapshot
             SnapshotVO snapshotCheck = _snapshotDao.findById(snapshotId);
             if (snapshotCheck == null) {
                 throw new InvalidParameterValueException("unable to find a snapshot with id " + snapshotId);
@@ -935,7 +947,6 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
 
             // one step operation - create volume in VM's cluster and attach it
             // to the VM
-            Long vmId = cmd.getVirtualMachineId();
             if (vmId != null) {
                 // Check that the virtual machine ID is valid and it's a user vm
                 UserVmVO vm = _userVmDao.findById(vmId);
@@ -983,10 +994,10 @@ public VolumeVO allocVolume(CreateVolumeCmd cmd) throws ResourceAllocationExcept
                 throw new InvalidParameterValueException("Zone is not configured to use local storage but volume's disk offering " + diskOffering.getName() + " uses it");
             }
 
-            String userSpecifiedName = getVolumeNameFromCommand(cmd);
+            String userSpecifiedName = getVolumeNameFromCommand(name);
 
-            return commitVolume(cmd.getSnapshotId(), caller, owner, displayVolume, zoneId, diskOfferingId, provisioningType, size, minIops, maxIops, parentVolume, userSpecifiedName,
-                    _uuidMgr.generateUuid(Volume.class, cmd.getCustomId()), details);
+            return commitVolume(snapshotId, caller, owner, displayVolume, zoneId, diskOfferingId, provisioningType, size, minIops, maxIops, parentVolume, userSpecifiedName,
+                    _uuidMgr.generateUuid(Volume.class, customId), details);
         } finally {
             ReservationHelper.closeAll(reservations);
         }
@@ -1106,25 +1117,33 @@ private VolumeVO createVolumeOnStoragePool(Long volumeId, Long storageId) throws
     @DB
     @ActionEvent(eventType = EventTypes.EVENT_VOLUME_CREATE, eventDescription = "creating volume", async = true)
     public VolumeVO createVolume(CreateVolumeCmd cmd) {
-        VolumeVO volume = _volsDao.findById(cmd.getEntityId());
+        return createVolume(cmd.getEntityId(), cmd.getVirtualMachineId(), cmd.getSnapshotId(), cmd.getStorageId(),
+                cmd.getDisplayVolume());
+    }
+
+    @Override
+    @DB
+    @ActionEvent(eventType = EventTypes.EVENT_VOLUME_CREATE, eventDescription = "creating volume", async = true)
+    public VolumeVO createVolume(long volumeId, Long vmId, Long snapshotId, Long storageId, Boolean display) {
+        VolumeVO volume = _volsDao.findById(volumeId);
         boolean created = true;
 
         try {
-            if (cmd.getSnapshotId() != null) {
-                volume = createVolumeFromSnapshot(volume, cmd.getSnapshotId(), cmd.getVirtualMachineId());
+            if (snapshotId != null) {
+                volume = createVolumeFromSnapshot(volume, snapshotId, vmId);
                 if (volume.getState() != Volume.State.Ready) {
                     created = false;
                 }
 
                 // if VM Id is provided, attach the volume to the VM
-                if (cmd.getVirtualMachineId() != null) {
+                if (vmId != null) {
                     try {
-                        attachVolumeToVM(cmd.getVirtualMachineId(), volume.getId(), volume.getDeviceId(), false);
+                        attachVolumeToVM(vmId, volume.getId(), volume.getDeviceId(), false);
                     } catch (Exception ex) {
                         StringBuilder message = new StringBuilder("Volume: ");
                         message.append(volume.getUuid());
                         message.append(" created successfully, but failed to attach the newly created volume to VM: ");
-                        message.append(cmd.getVirtualMachineId());
+                        message.append(vmId);
                         message.append(" due to error: ");
                         message.append(ex.getMessage());
                         if (logger.isDebugEnabled()) {
@@ -1133,20 +1152,20 @@ public VolumeVO createVolume(CreateVolumeCmd cmd) {
                         throw new CloudRuntimeException(message.toString());
                     }
                 }
-            } else if (cmd.getStorageId() != null) {
-                volume = createVolumeOnStoragePool(cmd.getEntityId(), cmd.getStorageId());
+            } else if (storageId != null) {
+                volume = createVolumeOnStoragePool(volumeId, storageId);
             }
             return volume;
         } catch (Exception e) {
             created = false;
-            VolumeInfo vol = volFactory.getVolume(cmd.getEntityId());
+            VolumeInfo vol = volFactory.getVolume(volumeId);
             vol.stateTransit(Volume.Event.DestroyRequested);
             throw new CloudRuntimeException(String.format("Failed to create volume: %s", volume), e);
         } finally {
             if (!created) {
                 VolumeVO finalVolume = volume;
                 logger.trace("Decrementing volume resource count for account {} as volume failed to create on the backend", () -> _accountMgr.getAccount(finalVolume.getAccountId()));
-                _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), cmd.getDisplayVolume(),
+                _resourceLimitMgr.decrementVolumeResourceCount(volume.getAccountId(), display,
                         volume.getSize(), _diskOfferingDao.findByIdIncludingRemoved(volume.getDiskOfferingId()));
             }
         }
@@ -2748,6 +2767,8 @@ private Volume orchestrateAttachVolumeToVM(Long vmId, Long volumeId, Long device
         return newVol;
     }
 
+    @Override
+    @ActionEvent(eventType = EventTypes.EVENT_VOLUME_ATTACH, eventDescription = "attaching volume", async = true)
     public Volume attachVolumeToVM(Long vmId, Long volumeId, Long deviceId, Boolean allowAttachForSharedFS) {
         Account caller = CallContext.current().getCallingAccount();
 
diff --git a/server/src/main/java/com/cloud/user/AccountManager.java b/server/src/main/java/com/cloud/user/AccountManager.java
index 98d2419e0486..eca1a571dd88 100644
--- a/server/src/main/java/com/cloud/user/AccountManager.java
+++ b/server/src/main/java/com/cloud/user/AccountManager.java
@@ -204,6 +204,8 @@ void buildACLViewSearchCriteria(SearchCriteria<? extends ControlledViewEntity> s
 
     void checkApiAccess(Account caller, String command, String apiKey);
 
+    void checkApiAccess(Account caller, String command);
+
     UserAccount clearUserTwoFactorAuthenticationInSetupStateOnLogin(UserAccount user);
 
     void verifyCallerPrivilegeForUserOrAccountOperations(Account userAccount);
diff --git a/server/src/main/java/com/cloud/user/AccountManagerImpl.java b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
index 52ec26661c9d..c073b5437d77 100644
--- a/server/src/main/java/com/cloud/user/AccountManagerImpl.java
+++ b/server/src/main/java/com/cloud/user/AccountManagerImpl.java
@@ -1534,6 +1534,12 @@ public void checkApiAccess(Account caller, String command, String apiKey) {
         checkApiAccess(apiCheckers, caller, command, keyPairPermissions.toArray(new ApiKeyPairPermission[0]));
     }
 
+    @Override
+    public void checkApiAccess(Account caller, String command) {
+        List<APIChecker> apiCheckers = getEnabledApiCheckers();
+        checkApiAccess(apiCheckers, caller, command);
+    }
+
     @NotNull
     private List<APIChecker> getEnabledApiCheckers() {
         // we are really only interested in the dynamic access checker
@@ -2772,11 +2778,21 @@ public Account getActiveAccountById(long accountId) {
         return _accountDao.findById(accountId);
     }
 
+    @Override
+    public Account getActiveAccountByUuid(String accountUuid) {
+        return _accountDao.findByUuid(accountUuid);
+    }
+
     @Override
     public Account getAccount(long accountId) {
         return _accountDao.findByIdIncludingRemoved(accountId);
     }
 
+    @Override
+    public Account getAccountByUuid(String accountUuid) {
+        return _accountDao.findByUuidIncludingRemoved(accountUuid);
+    }
+
     @Override
     public RoleType getRoleType(Account account) {
         if (account == null) {
@@ -2790,6 +2806,15 @@ public User getActiveUser(long userId) {
         return _userDao.findById(userId);
     }
 
+    @Override
+    public User getOneActiveUserForAccount(Account account) {
+        List<UserVO> users = _userDao.listByAccount(account.getId());
+        if (CollectionUtils.isEmpty(users)) {
+            return null;
+        }
+        return users.get(0);
+    }
+
     @Override
     public User getUserIncludingRemoved(long userId) {
         return _userDao.findByIdIncludingRemoved(userId);
diff --git a/server/src/main/java/com/cloud/vm/UserVmManager.java b/server/src/main/java/com/cloud/vm/UserVmManager.java
index 300803bfa986..543da444706b 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManager.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManager.java
@@ -16,13 +16,14 @@
 // under the License.
 package com.cloud.vm;
 
+import static com.cloud.user.ResourceLimitService.ResourceLimitHostTags;
+
 import java.util.HashMap;
 import java.util.HashSet;
 import java.util.List;
 import java.util.Map;
 import java.util.Set;
 
-import com.cloud.utils.StringUtils;
 import org.apache.cloudstack.api.BaseCmd.HTTPMethod;
 import org.apache.cloudstack.framework.config.ConfigKey;
 
@@ -40,8 +41,7 @@
 import com.cloud.template.VirtualMachineTemplate;
 import com.cloud.uservm.UserVm;
 import com.cloud.utils.Pair;
-
-import static com.cloud.user.ResourceLimitService.ResourceLimitHostTags;
+import com.cloud.utils.StringUtils;
 
 /**
  *
@@ -210,5 +210,4 @@ static Set<String> getStrictHostTags() {
      * @return true if the VM is part of a CKS cluster, false otherwise.
      */
     boolean isVMPartOfAnyCKSCluster(VMInstanceVO vm);
-
 }
diff --git a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
index bb55f570927b..0e14846b00b3 100644
--- a/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
+++ b/server/src/main/java/com/cloud/vm/UserVmManagerImpl.java
@@ -313,8 +313,8 @@
 import com.cloud.resource.ResourceManager;
 import com.cloud.resource.ResourceState;
 import com.cloud.resourcelimit.CheckedReservation;
-import com.cloud.resourcelimit.ReservationHelper;
 import com.cloud.serializer.GsonHelper;
+import com.cloud.resourcelimit.ReservationHelper;
 import com.cloud.server.ManagementService;
 import com.cloud.server.ResourceTag;
 import com.cloud.service.ServiceOfferingVO;
@@ -322,8 +322,10 @@
 import com.cloud.service.dao.ServiceOfferingDetailsDao;
 import com.cloud.storage.DataStoreRole;
 import com.cloud.storage.DiskOfferingVO;
+import com.cloud.storage.GuestOS;
 import com.cloud.storage.GuestOSCategoryVO;
 import com.cloud.storage.GuestOSVO;
+import com.cloud.storage.LaunchPermissionVO;
 import com.cloud.storage.ScopeType;
 import com.cloud.storage.Snapshot;
 import com.cloud.storage.SnapshotPolicyVO;
@@ -344,6 +346,7 @@
 import com.cloud.storage.dao.DiskOfferingDao;
 import com.cloud.storage.dao.GuestOSCategoryDao;
 import com.cloud.storage.dao.GuestOSDao;
+import com.cloud.storage.dao.LaunchPermissionDao;
 import com.cloud.storage.dao.SnapshotDao;
 import com.cloud.storage.dao.SnapshotPolicyDao;
 import com.cloud.storage.dao.VMTemplateDao;
@@ -424,6 +427,7 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
 
     private static final long GiB_TO_BYTES = 1024 * 1024 * 1024;
 
+
     @Inject
     private EntityManager _entityMgr;
     @Inject
@@ -620,6 +624,8 @@ public class UserVmManagerImpl extends ManagerBase implements UserVmManager, Vir
     @Inject
     BackupScheduleDao backupScheduleDao;
     @Inject
+    LaunchPermissionDao launchPermissionDao;
+    @Inject
     private UserDataDao userDataDao;
     @Inject
     protected SnapshotHelper snapshotHelper;
@@ -1499,11 +1505,8 @@ public UserVm addNicToVirtualMachine(AddNicToVMCmd cmd) throws InvalidParameterV
         // Perform permission check on VM
         _accountMgr.checkAccess(caller, null, true, vmInstance);
 
-        // Verify that zone is not Basic
         DataCenterVO dc = _dcDao.findById(vmInstance.getDataCenterId());
-        if (dc.getNetworkType() == DataCenter.NetworkType.Basic) {
-            throw new CloudRuntimeException(String.format("Zone %s, has a NetworkType of Basic. Can't add a new NIC to a Instance on a Basic Network", dc));
-        }
+        validateVmZoneTypeForAddNic(vmInstance, dc);
 
         //ensure network belongs in zone
         if (network.getDataCenterId() != vmInstance.getDataCenterId()) {
@@ -1552,6 +1555,16 @@ public UserVm addNicToVirtualMachine(AddNicToVMCmd cmd) throws InvalidParameterV
         return _vmDao.findById(vmInstance.getId());
     }
 
+    private void validateVmZoneTypeForAddNic(UserVmVO vmInstance, DataCenter dc) {
+        if (!NetworkType.Basic.equals(dc.getNetworkType())) {
+            return;
+        }
+        if (_nicDao.countByVmId(vmInstance.getId()) == 0) {
+            return;
+        }
+        throw new CloudRuntimeException(String.format("Zone %s, has a NetworkType of Basic. Can't add a new NIC to a Instance on a Basic Network", dc));
+    }
+
     /**
      * Set NIC as default if VM has no default NIC
      * @param vmInstance VM instance to be checked
@@ -2365,9 +2378,9 @@ public HashMap<String, VolumeStatsEntry> getVolumeStatistics(long clusterId, Str
     }
 
     private List<String> getVolumesByHost(HostVO host, StoragePool pool) {
-        List<VMInstanceVO> vmsPerHost = _vmInstanceDao.listByHostId(host.getId());
+        List<Long> vmsPerHost = _vmInstanceDao.listIdsByHostIdForVolumeStats(host.getId());
         return vmsPerHost.stream()
-                .flatMap(vm -> _volsDao.findNonDestroyedVolumesByInstanceIdAndPoolId(vm.getId(),pool.getId()).stream().map(vol ->
+                .flatMap(vmId -> _volsDao.findNonDestroyedVolumesByInstanceIdAndPoolId(vmId,pool.getId()).stream().map(vol ->
                 vol.getState() == Volume.State.Ready ? (vol.getFormat() == ImageFormat.OVA ? vol.getChainInfo() : vol.getPath()) : null).filter(Objects::nonNull))
                 .collect(Collectors.toList());
     }
@@ -2532,7 +2545,6 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
         _scaleRetry = NumbersUtil.parseInt(configs.get(Config.ScaleRetry.key()), 2);
 
         _vmIpFetchThreadExecutor = Executors.newFixedThreadPool(VmIpFetchThreadPoolMax.value(), new NamedThreadFactory("vmIpFetchThread"));
-
         logger.info("User VM Manager is configured.");
 
         return true;
@@ -3574,6 +3586,7 @@ public UserVm destroyVm(DestroyVMCmd cmd) throws ResourceUnavailableException, C
         CallContext ctx = CallContext.current();
         long vmId = cmd.getId();
         boolean expunge = cmd.getExpunge();
+        boolean forced = cmd.isForced();
 
         if (expunge) {
             String jobParamsString = ((AsyncJobVO) cmd.getJob()).getCmdInfo();
@@ -3588,26 +3601,13 @@ public UserVm destroyVm(DestroyVMCmd cmd) throws ResourceUnavailableException, C
         if (vm == null || vm.getRemoved() != null) {
             throw new InvalidParameterValueException("unable to find a virtual machine with id " + vmId);
         }
-        if (UserVmManager.SHAREDFSVM.equals(vm.getUserVmType())) {
-            throw new InvalidParameterValueException("Operation not supported on Shared FileSystem Instance");
-        }
 
         if (Arrays.asList(State.Destroyed, State.Expunging).contains(vm.getState()) && !expunge) {
             logger.debug("Vm {} is already destroyed", vm);
             return vm;
         }
 
-        if (vm.isDeleteProtection()) {
-            throw new InvalidParameterValueException(String.format(
-                    "Instance [id = %s, name = %s] has delete protection enabled and cannot be deleted.",
-                    vm.getUuid(), vm.getName()));
-        }
-
-        // check if vm belongs to AutoScale vm group in Disabled state
-        autoScaleManager.checkIfVmActionAllowed(vmId);
-
-        // check if vm belongs to any plugin resources
-        checkPluginsIfVmCanBeDestroyed(vm);
+        validateVmDestroyAllowed(vm, forced);
 
         // check if there are active volume snapshots tasks
         logger.debug("Checking if there are any ongoing Snapshots on the ROOT volumes associated with Instance {}", vm);
@@ -3666,6 +3666,26 @@ public UserVm destroyVm(DestroyVMCmd cmd) throws ResourceUnavailableException, C
         return destroyedVm;
     }
 
+    private void validateVmDestroyAllowed(UserVmVO vm, boolean forced) {
+        if (forced) {
+            return;
+        }
+        if (UserVmManager.SHAREDFSVM.equals(vm.getUserVmType())) {
+            throw new InvalidParameterValueException("Operation not supported on Shared FileSystem Instance");
+        }
+        if (vm.isDeleteProtection()) {
+            throw new InvalidParameterValueException(String.format(
+                    "Instance [id = %s, name = %s] has delete protection enabled and cannot be deleted.",
+                    vm.getUuid(), vm.getName()));
+        }
+
+        // check if vm belongs to AutoScale vm group in Disabled state
+        autoScaleManager.checkIfVmActionAllowed(vm.getId());
+
+        // check if vm belongs to any plugin resources
+        checkPluginsIfVmCanBeDestroyed(vm);
+    }
+
     private List<VolumeVO> getVolumesFromIds(DestroyVMCmd cmd) {
         List<VolumeVO> volumes = new ArrayList<>();
         if (cmd.getVolumeIds() != null) {
@@ -3890,16 +3910,31 @@ public UserVm createBasicSecurityGroupVirtualMachine(DataCenter zone, ServiceOff
         if (defaultNetwork == null) {
             throw new InvalidParameterValueException("Unable to find a default network to start a vm");
         } else {
-            networkList.add(_networkDao.findById(defaultNetwork.getId()));
+            if (!_itMgr.isBlankInstance(template)) {
+                networkList.add(_networkDao.findById(defaultNetwork.getId()));
+            }
         }
 
+
         boolean isVmWare = (template.getHypervisorType() == HypervisorType.VMware || (hypervisor != null && hypervisor == HypervisorType.VMware));
 
+        securityGroupIdList = validateAndUpdateSecurityGroupsIfNeeded(securityGroupIdList, owner, isVmWare, defaultNetwork, template);
+
+        return createVirtualMachine(zone, serviceOffering, template, hostName, displayName, owner, diskOfferingId, diskSize, dataDiskInfoList, networkList, securityGroupIdList, group, httpmethod,
+                userData, userDataId, userDataDetails, sshKeyPairs, hypervisor, caller, requestedIps, defaultIps, displayVm, keyboard, affinityGroupIdList, customParametes, customId, dhcpOptionMap,
+                dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, null, overrideDiskOfferingId, volume, snapshot);
+
+    }
+
+    @Nullable
+    private List<Long> validateAndUpdateSecurityGroupsIfNeeded(List<Long> securityGroupIdList, Account owner,
+                                                               boolean isVmWare, Network defaultNetwork,
+                                                               VirtualMachineTemplate template) {
         if (securityGroupIdList != null && isVmWare) {
             throw new InvalidParameterValueException("Security group feature is not supported for VMware hypervisor");
         } else if (!isVmWare && _networkModel.isSecurityGroupSupportedInNetwork(defaultNetwork) && _networkModel.canAddDefaultSecurityGroup()) {
             //add the default securityGroup only if no security group is specified
-            if (securityGroupIdList == null || securityGroupIdList.isEmpty()) {
+            if (CollectionUtils.isEmpty(securityGroupIdList) && !_itMgr.isBlankInstance(template)) {
                 if (securityGroupIdList == null) {
                     securityGroupIdList = new ArrayList<>();
                 }
@@ -3917,11 +3952,7 @@ public UserVm createBasicSecurityGroupVirtualMachine(DataCenter zone, ServiceOff
                 }
             }
         }
-
-        return createVirtualMachine(zone, serviceOffering, template, hostName, displayName, owner, diskOfferingId, diskSize, dataDiskInfoList, networkList, securityGroupIdList, group, httpmethod,
-                userData, userDataId, userDataDetails, sshKeyPairs, hypervisor, caller, requestedIps, defaultIps, displayVm, keyboard, affinityGroupIdList, customParametes, customId, dhcpOptionMap,
-                dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, null, overrideDiskOfferingId, volume, snapshot);
-
+        return securityGroupIdList;
     }
 
     @Override
@@ -3945,7 +3976,9 @@ public UserVm createAdvancedSecurityGroupVirtualMachine(DataCenter zone, Service
         _accountMgr.checkAccess(owner, _diskOfferingDao.findById(diskOfferingId), zone);
 
         // If no network is specified, find system security group enabled network
-        if (networkIdList == null || networkIdList.isEmpty()) {
+        if (_itMgr.isBlankInstance(template)) {
+            logger.debug("Blank instance for {} hypervisor, skipping network allocation in an advanced security group enabled zone", hypervisor);
+        } else if (networkIdList == null || networkIdList.isEmpty()) {
             Network networkWithSecurityGroup = _networkModel.getNetworkWithSGWithFreeIPs(owner, zone.getId());
             if (networkWithSecurityGroup == null) {
                 throw new InvalidParameterValueException("No network with security enabled is found in zone id=" + zone.getUuid());
@@ -4058,7 +4091,9 @@ public UserVm createAdvancedVirtualMachine(DataCenter zone, ServiceOffering serv
         _accountMgr.checkAccess(owner, diskOffering, zone);
 
         List<HypervisorType> vpcSupportedHTypes = _vpcMgr.getSupportedVpcHypervisors();
-        if (networkIdList == null || networkIdList.isEmpty()) {
+        if (_itMgr.isBlankInstance(template)) {
+            logger.debug("Template is a dummy template for hypervisor {}, skipping network allocation in an advanced zone", hypervisor);
+        } else if (networkIdList == null || networkIdList.isEmpty()) {
             NetworkVO defaultNetwork = getDefaultNetwork(zone, owner, false);
             if (defaultNetwork != null) {
                 networkList.add(defaultNetwork);
@@ -4292,7 +4327,7 @@ private UserVm createVirtualMachine(DataCenter zone, ServiceOffering serviceOffe
         if (isIso) {
             if (diskOfferingId == null) {
                 DiskOfferingVO diskOffering = _diskOfferingDao.findById(rootDiskOfferingId);
-                if (diskOffering.isComputeOnly()) {
+                if (diskOffering.isComputeOnly() && !_itMgr.isBlankInstance(template)) {
                     throw new InvalidParameterValueException("Installing from ISO requires a disk offering to be specified for the root disk.");
                 }
             } else {
@@ -4489,7 +4524,8 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
                 }
             }
 
-            if (TemplateType.SYSTEM.equals(template.getTemplateType()) && !CKS_NODE.equals(vmType) && !SHAREDFSVM.equals(vmType)) {
+            if (TemplateType.SYSTEM.equals(template.getTemplateType()) && !CKS_NODE.equals(vmType) &&
+                    !SHAREDFSVM.equals(vmType) && !_itMgr.isBlankInstance(template)) {
                 throw new InvalidParameterValueException(String.format("Unable to use system template %s to deploy a user vm", template));
             }
 
@@ -4502,7 +4538,7 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
                 if (CollectionUtils.isEmpty(snapshotsOnZone)) {
                     throw new InvalidParameterValueException("The snapshot does not exist on zone " + zone.getId());
                 }
-            } else {
+            } else if (!_itMgr.isBlankInstanceDefaultTemplate(template)) {
                 List<VMTemplateZoneVO> listZoneTemplate = _templateZoneDao.listByZoneTemplate(zone.getId(), template.getId());
                 if (listZoneTemplate == null || listZoneTemplate.isEmpty()) {
                     throw new InvalidParameterValueException("The template " + template.getId() + " is not available for use");
@@ -4607,7 +4643,7 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
                 networkIndex++;
             }
 
-            if (securityGroupIdList != null && !securityGroupIdList.isEmpty() && !securityGroupEnabled) {
+            if (CollectionUtils.isNotEmpty(securityGroupIdList) && !securityGroupEnabled) {
                 throw new InvalidParameterValueException("Unable to deploy vm with security groups as SecurityGroup service is not enabled for the vm's network");
             }
 
@@ -4617,7 +4653,11 @@ private UserVm getUncheckedUserVmResource(DataCenter zone, String hostName, Stri
             // by Agent Manager in order to configure default
             // gateway for the vm
             if (defaultNetworkNumber == 0) {
-                throw new InvalidParameterValueException("At least 1 default network has to be specified for the vm");
+                if (_itMgr.isBlankInstance(template)) {
+                    logger.debug("Template is a dummy template for hypervisor {}, vm can be created without a default network", hypervisorType);
+                } else {
+                    throw new InvalidParameterValueException("At least 1 default network has to be specified for the vm");
+                }
             } else if (defaultNetworkNumber > 1) {
                 throw new InvalidParameterValueException("Only 1 default network per vm is supported");
             }
@@ -4772,7 +4812,7 @@ protected long configureCustomRootDiskSize(Map<String, String> customParameters,
             return rootDiskSize;
         } else {
             // For baremetal, size can be 0 (zero)
-            Long templateSize = _templateDao.findById(template.getId()).getSize();
+            Long templateSize = template.getSize();
             if (templateSize != null) {
                 return templateSize;
             }
@@ -4887,6 +4927,9 @@ private UserVmVO commitUserVm(final boolean isImport, final DataCenter zone, fin
                 offering.getLimitCpuUse(), owner.getDomainId(), owner.getId(), userId, offering.getId(), userData, userDataId, userDataDetails, hostName);
         vm.setUuid(uuidName);
         vm.setDynamicallyScalable(dynamicScalingEnabled);
+        if (_itMgr.isBlankInstance(template)) {
+            vm.setUpdateParameters(false);
+        }
 
         Map<String, String> details = template.getDetails();
         if (details != null && !details.isEmpty()) {
@@ -5165,12 +5208,24 @@ private UserVmVO commitUserVm(final DataCenter zone, final VirtualMachineTemplat
                                   Map<Integer, String>> extraDhcpOptionMap, final Map<Long, DiskOffering> dataDiskTemplateToDiskOfferingMap,
                                   Map<String, String> userVmOVFPropertiesMap, final boolean dynamicScalingEnabled, String vmType, final Long rootDiskOfferingId, String sshkeypairs,
                                   List<VmDiskInfo> dataDiskInfoList, Volume volume, Snapshot snapshot) throws InsufficientCapacityException {
+        Long guestOsId = getGuestOsIdIfNeeded(template);
         return commitUserVm(false, zone, null, null, template, hostName, displayName, owner,
                 diskOfferingId, diskSize, userData, userDataId, userDataDetails, isDisplayVm, keyboard,
-                accountId, userId, offering, isIso, null, sshPublicKeys, networkNicMap,
-                id, instanceName, uuidName, hypervisorType, customParameters,
-                extraDhcpOptionMap, dataDiskTemplateToDiskOfferingMap,
-                userVmOVFPropertiesMap, null, dynamicScalingEnabled, vmType, rootDiskOfferingId, sshkeypairs, dataDiskInfoList, volume, snapshot);
+                accountId, userId, offering, isIso, guestOsId, sshPublicKeys, networkNicMap, id, instanceName, uuidName,
+                hypervisorType, customParameters, extraDhcpOptionMap, dataDiskTemplateToDiskOfferingMap,
+                userVmOVFPropertiesMap, null, dynamicScalingEnabled, vmType, rootDiskOfferingId, sshkeypairs,
+                dataDiskInfoList, volume, snapshot);
+    }
+
+    protected Long getGuestOsIdIfNeeded(VirtualMachineTemplate template) {
+        if (!_itMgr.isBlankInstanceDefaultTemplate(template)) {
+            return null;
+        }
+        Object obj = CallContext.current().getContextParameter(ApiConstants.OS_ID);
+        if (!(obj instanceof GuestOS)) {
+            return null;
+        }
+        return ((GuestOS)obj).getId();
     }
 
     public void validateRootDiskResize(final HypervisorType hypervisorType, Long rootDiskSize, VMTemplateVO templateVO, UserVmVO vm, final Map<String, String> customParameters) throws InvalidParameterValueException
@@ -5328,7 +5383,7 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
     @ActionEvent(eventType = EventTypes.EVENT_VM_CREATE, eventDescription = "deploying Vm", async = true)
     public UserVm startVirtualMachine(DeployVMCmd cmd) throws ResourceUnavailableException, InsufficientCapacityException, ConcurrentOperationException, ResourceAllocationException {
         long vmId = cmd.getEntityId();
-        if (!cmd.getStartVm()) {
+        if (!cmd.getStartVm() || cmd.isBlankInstance()) {
             return getUserVm(vmId);
         }
         Long podId = null;
@@ -6402,7 +6457,9 @@ private void verifyServiceOffering(BaseDeployVMCmd cmd, ServiceOffering serviceO
 
     private void verifyTemplate(BaseDeployVMCmd cmd, VirtualMachineTemplate template, Long serviceOfferingId) {
         if (TemplateType.VNF.equals(template.getTemplateType())) {
-            vnfTemplateManager.validateVnfApplianceNics(template, cmd.getNetworkIds(), cmd.getVmNetworkMap());
+            if (!_itMgr.isBlankInstance(template)) {
+                vnfTemplateManager.validateVnfApplianceNics(template, cmd.getNetworkIds(), cmd.getVmNetworkMap());
+            }
         } else if (cmd instanceof DeployVnfApplianceCmd) {
             throw new InvalidParameterValueException("Can't deploy VNF appliance from a non-VNF template");
         }
@@ -6492,6 +6549,16 @@ public UserVm createVirtualMachine(DeployVMCmd cmd) throws InsufficientCapacityE
                 (!(HypervisorType.KVM.equals(template.getHypervisorType()) || HypervisorType.KVM.equals(cmd.getHypervisor())))) {
             throw new InvalidParameterValueException("Deploying a virtual machine with existing volume/snapshot is supported only from KVM hypervisors");
         }
+        boolean blankInstance = cmd.isBlankInstance();
+        if (blankInstance) {
+            CallContext.current().putContextParameter(ApiConstants.BLANK_INSTANCE, true);
+        }
+        if (template == null && HypervisorType.KVM.equals(cmd.getHypervisor()) && blankInstance) {
+            template = getBlankInstanceTemplate();
+            logger.info("Creating launch permission for Dummy template");
+            LaunchPermissionVO launchPermission = new LaunchPermissionVO(template.getId(), owner.getId());
+            launchPermissionDao.persist(launchPermission);
+        }
         // Make sure a valid template ID was specified
         if (template == null) {
             throw new InvalidParameterValueException("Unable to use template " + templateId);
@@ -6586,6 +6653,7 @@ private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Accoun
         String keyboard = cmd.getKeyboard();
         Map<Long, DiskOffering> dataDiskTemplateToDiskOfferingMap = cmd.getDataDiskTemplateToDiskOfferingMap();
         Map<String, String> userVmOVFProperties = cmd.getVmProperties();
+        final String instanceType = cmd.getInstanceType();
         if (zone.getNetworkType() == NetworkType.Basic) {
             if (networkIds != null) {
                 throw new InvalidParameterValueException("Can't specify network Ids in Basic zone");
@@ -6601,7 +6669,7 @@ private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Accoun
                 vm = createAdvancedSecurityGroupVirtualMachine(zone, serviceOffering, template, networkIds, getSecurityGroupIdList(cmd, zone, template, owner), owner, name,
                         displayName, diskOfferingId, size, dataDiskInfoList, group, hypervisor, cmd.getHttpMethod(), userData, userDataId, userDataDetails, sshKeyPairNames, ipToNetworkMap, addrs, displayVm, keyboard,
                         cmd.getAffinityGroupIdList(), cmd.getDetails(), cmd.getCustomId(), cmd.getDhcpOptionsMap(),
-                        dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, overrideDiskOfferingId, null, volume, snapshot);
+                        dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, overrideDiskOfferingId, instanceType, volume, snapshot);
 
             } else {
                 if (cmd.getSecurityGroupIdList() != null && !cmd.getSecurityGroupIdList().isEmpty()) {
@@ -6609,7 +6677,7 @@ private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Accoun
                 }
                 vm = createAdvancedVirtualMachine(zone, serviceOffering, template, networkIds, owner, name, displayName, diskOfferingId, size, dataDiskInfoList, group,
                         hypervisor, cmd.getHttpMethod(), userData, userDataId, userDataDetails, sshKeyPairNames, ipToNetworkMap, addrs, displayVm, keyboard, cmd.getAffinityGroupIdList(), cmd.getDetails(),
-                        cmd.getCustomId(), cmd.getDhcpOptionsMap(), dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, null, overrideDiskOfferingId, volume, snapshot);
+                        cmd.getCustomId(), cmd.getDhcpOptionsMap(), dataDiskTemplateToDiskOfferingMap, userVmOVFProperties, dynamicScalingEnabled, instanceType, overrideDiskOfferingId, volume, snapshot);
                 if (cmd instanceof DeployVnfApplianceCmd) {
                     vnfTemplateManager.createIsolatedNetworkRulesForVnfAppliance(zone, template, owner, vm, (DeployVnfApplianceCmd) cmd);
                 }
@@ -6650,6 +6718,12 @@ private UserVm createVirtualMachine(BaseDeployVMCmd cmd, DataCenter zone, Accoun
         if (isLeaseFeatureEnabled) {
             applyLeaseOnCreateInstance(vm, cmd.getLeaseDuration(), cmd.getLeaseExpiryAction(), svcOffering);
         }
+
+        if (_itMgr.isBlankInstanceDefaultTemplate(template) && cmd instanceof DeployVMCmd && ((DeployVMCmd) cmd).isBlankInstance()) {
+            logger.info("Revoking launch permission for Dummy template");
+            launchPermissionDao.removePermissions(template.getId(), Collections.singletonList(owner.getId()));
+        }
+
         return vm;
     }
 
@@ -8009,7 +8083,10 @@ public UserVm moveVmToUser(final AssignVMCmd cmd) throws ResourceAllocationExcep
         try {
         verifyResourceLimitsForAccountAndStorage(newAccount, vm, offering, volumes, template, reservations);
 
-        Network newNetwork = ensureDestinationNetwork(cmd, vm, newAccount);
+        Network newNetwork = null;
+        if (!cmd.isSkipNetwork()) {
+            newNetwork = ensureDestinationNetwork(cmd, vm, newAccount);
+        }
         try {
             Transaction.execute(new TransactionCallbackNoReturn() {
                 @Override
@@ -8303,6 +8380,10 @@ protected void updateVolumesOwner(final List<VolumeVO> volumes, Account oldAccou
      */
     protected void updateVmNetwork(AssignVMCmd cmd, Account caller, UserVmVO vm, Account newAccount, VirtualMachineTemplate template)
             throws InsufficientCapacityException, ResourceAllocationException {
+        if (cmd.isSkipNetwork()) {
+            logger.trace("Skipping network update for {} as per command parameter.", vm);
+            return;
+        }
 
         logger.trace("Updating network for VM [{}].", vm);
 
@@ -10085,4 +10166,19 @@ private void setVncPasswordForKvmIfAvailable(Map<String, String> customParameter
             vm.setVncPassword(customParameters.get(VmDetailConstants.KVM_VNC_PASSWORD));
         }
     }
+
+    protected VMTemplateVO getBlankInstanceTemplate() {
+        VMTemplateVO template = _templateDao.findByName(VirtualMachineManager.KVM_BLANK_VM_TEMPLATE_NAME);
+        if (template != null) {
+            return template;
+        }
+        template = VMTemplateVO.createSystemIso(_templateDao.getNextInSequence(Long.class, "id"),
+                VirtualMachineManager.KVM_BLANK_VM_TEMPLATE_NAME, VirtualMachineManager.KVM_BLANK_VM_TEMPLATE_NAME, true,
+                "", true, 64, Account.ACCOUNT_ID_SYSTEM, "",
+                "Blank Template for KVM VM", false, 1);
+        template.setState(VirtualMachineTemplate.State.Active);
+        template.setFormat(ImageFormat.QCOW2);
+        template = _templateDao.persist(template);
+        return template;
+    }
 }
diff --git a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
index 1cbb668206d9..c17c0b487f10 100644
--- a/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/backup/BackupManagerImpl.java
@@ -1822,9 +1822,9 @@ public BackupProvider getBackupProvider(final Long zoneId) {
     }
 
     public BackupProvider getBackupProvider(final String name) {
-        if (StringUtils.isEmpty(name)) {
-            throw new CloudRuntimeException("Invalid backup provider name provided");
-        }
+       if (StringUtils.isEmpty(name)) {
+           throw new CloudRuntimeException("Invalid backup provider name provided");
+       }
        if (!backupProvidersMap.containsKey(name)) {
            throw new CloudRuntimeException("Failed to find backup provider by the name: " + name);
        }
@@ -2436,8 +2436,10 @@ public BackupResponse createBackupResponse(Backup backup, Boolean listVmDetails)
             backedUpVolumes = new Gson().toJson(backup.getBackedUpVolumes().toArray(), Backup.VolumeInfo[].class);
         }
         response.setVolumes(backedUpVolumes);
-        response.setBackupOfferingId(offering.getUuid());
-        response.setBackupOffering(offering.getName());
+        if (offering != null) {
+            response.setBackupOfferingId(offering.getUuid());
+            response.setBackupOffering(offering.getName());
+        }
         response.setAccountId(account.getUuid());
         response.setAccount(account.getAccountName());
         response.setDomainId(domain.getUuid());
@@ -2455,6 +2457,13 @@ public BackupResponse createBackupResponse(Backup backup, Boolean listVmDetails)
             response.setVmDetails(vmDetails);
         }
 
+        if (backup.getFromCheckpointId() != null) {
+            response.setFromCheckpointId(backup.getFromCheckpointId());
+        }
+        if (backup.getToCheckpointId() != null) {
+            response.setToCheckpointId(backup.getToCheckpointId());
+        }
+
         response.setObjectName("backup");
         return response;
     }
diff --git a/server/src/main/java/org/apache/cloudstack/backup/KVMBackupExportServiceImpl.java b/server/src/main/java/org/apache/cloudstack/backup/KVMBackupExportServiceImpl.java
new file mode 100644
index 000000000000..ea90fc6b4b53
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/KVMBackupExportServiceImpl.java
@@ -0,0 +1,1036 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+
+package org.apache.cloudstack.backup;
+
+import static org.apache.cloudstack.backup.BackupManager.BackupFrameworkEnabled;
+import static org.apache.cloudstack.backup.BackupManager.BackupProviderPlugin;
+
+import java.time.Instant;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.Date;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+import java.util.UUID;
+import java.util.stream.Collectors;
+
+import javax.inject.Inject;
+
+import com.cloud.utils.fsm.NoTransitionException;
+import com.cloud.utils.fsm.StateMachine2;
+import org.apache.cloudstack.api.command.admin.backup.CreateImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.DeleteVmCheckpointCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeBackupCmd;
+import org.apache.cloudstack.api.command.admin.backup.FinalizeImageTransferCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListImageTransfersCmd;
+import org.apache.cloudstack.api.command.admin.backup.ListVmCheckpointsCmd;
+import org.apache.cloudstack.api.command.admin.backup.StartBackupCmd;
+import org.apache.cloudstack.api.response.CheckpointResponse;
+import org.apache.cloudstack.api.response.ImageTransferResponse;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.ImageTransferDao;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.jobs.AsyncJobExecutionContext;
+import org.apache.cloudstack.framework.jobs.AsyncJobManager;
+import org.apache.cloudstack.framework.jobs.impl.VmWorkJobVO;
+import org.apache.cloudstack.jobs.JobInfo;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.apache.commons.collections.CollectionUtils;
+import org.apache.commons.lang3.StringUtils;
+import org.joda.time.DateTime;
+import org.springframework.stereotype.Component;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.dc.dao.DataCenterDao;
+import com.cloud.exception.AgentUnavailableException;
+import com.cloud.exception.OperationTimedoutException;
+import com.cloud.host.Host;
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
+import com.cloud.storage.ScopeType;
+import com.cloud.storage.StoragePoolHostVO;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.StoragePoolHostDao;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.storage.dao.VolumeDetailsDao;
+import com.cloud.user.Account;
+import com.cloud.user.AccountService;
+import com.cloud.user.User;
+import com.cloud.utils.NumbersUtil;
+import com.cloud.utils.Pair;
+import com.cloud.utils.ReflectionUse;
+import com.cloud.utils.component.ManagerBase;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.VMInstanceDetailVO;
+import com.cloud.vm.VMInstanceVO;
+import com.cloud.vm.VirtualMachine;
+import com.cloud.vm.VirtualMachine.State;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.VmWork;
+import com.cloud.vm.VmWorkConstants;
+import com.cloud.vm.VmWorkJobHandler;
+import com.cloud.vm.VmWorkJobHandlerProxy;
+import com.cloud.vm.VmWorkSerializer;
+import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+
+@Component
+public class KVMBackupExportServiceImpl extends ManagerBase implements KVMBackupExportService, VmWorkJobHandler {
+    public static final String VM_WORK_JOB_HANDLER = KVMBackupExportServiceImpl.class.getSimpleName();
+    private static final long BACKUP_FINALIZE_WAIT_CHECK_INTERVAL = 15 * 1000L;
+    private static Set<String> COMPATIBLE_BACKUP_PROVIDERS = Set.of("veeam", "dummy");
+
+    @Inject
+    private VMInstanceDao vmInstanceDao;
+
+    @Inject
+    private VMInstanceDetailsDao vmInstanceDetailsDao;
+
+    @Inject
+    private BackupDao backupDao;
+
+    @Inject
+    private ImageTransferDao imageTransferDao;
+
+    @Inject
+    private VolumeDao volumeDao;
+
+    @Inject
+    private VolumeDetailsDao volumeDetailsDao;
+
+    @Inject
+    private AgentManager agentManager;
+
+    @Inject
+    private HostDao hostDao;
+
+    @Inject
+    private PrimaryDataStoreDao primaryDataStoreDao;
+
+    @Inject
+    private StoragePoolHostDao storagePoolHostDao;
+
+    @Inject
+    private DataCenterDao dataCenterDao;
+
+    @Inject
+    AccountService accountService;
+
+    @Inject
+    AsyncJobManager asyncJobManager;
+
+    @Inject
+    VirtualMachineManager virtualMachineManager;
+
+    @Inject
+    private VolumeDataFactory volumeDataFactory;
+
+    VmWorkJobHandlerProxy jobHandlerProxy = new VmWorkJobHandlerProxy(this);
+
+    private Boolean isZoneCompatible(Long zoneId) {
+        if (!BackupFrameworkEnabled.valueIn(zoneId)) {
+            return true;
+        }
+        if (COMPATIBLE_BACKUP_PROVIDERS.contains(BackupProviderPlugin.valueIn(zoneId))) {
+            return true;
+        }
+        return false;
+    }
+
+    private void verifyKVMBackupExportServiceSupported(Long zoneId) {
+        if (!isZoneCompatible(zoneId)) {
+            throw new CloudRuntimeException("Veeam-KVM backups are disabled because the CloudStack Zone is configured to use the \"" +
+                    BackupProviderPlugin.valueIn(zoneId) + "\" backup provider. Acceptable \"backup.framework.provider.plugin\" " +
+                    "values are " + COMPATIBLE_BACKUP_PROVIDERS +
+                    ". Please refer to the documentation for more details on backup providers compatibility.");
+        }
+    }
+
+    protected void validateVmVolumesForBackup(VMInstanceVO vm) {
+        List<VolumeVO> volumes = volumeDao.findByInstanceAndNotStates(vm.getId(), Volume.State.Ready);
+        List<String> nonReadyVolumeIds = volumes
+                .stream()
+                .map(VolumeVO::getUuid)
+                .collect(Collectors.toList());
+        if (CollectionUtils.isNotEmpty(nonReadyVolumeIds)) {
+            throw new CloudRuntimeException(String.format("Volumes [%s] of Instance: %s are not in Ready state",
+                    StringUtils.join(nonReadyVolumeIds, ","), vm.getUuid()));
+        }
+    }
+
+    @Override
+    public Backup createBackup(StartBackupCmd cmd) {
+        Long vmId = cmd.getVmId();
+
+        VMInstanceVO vm = vmInstanceDao.findById(vmId);
+        if (vm == null) {
+            throw new CloudRuntimeException("Instance not found: " + vmId);
+        }
+
+        verifyKVMBackupExportServiceSupported(vm.getDataCenterId());
+
+        if (vm.getState() != State.Running && vm.getState() != State.Stopped) {
+            throw new CloudRuntimeException("Instance must be running or stopped to start Backup");
+        }
+
+        Backup existingBackup = backupDao.findByVmId(vmId);
+        if (existingBackup != null && existingBackup.getStatus() == Backup.Status.BackingUp) {
+            throw new CloudRuntimeException("Backup already in progress for Instance: " + vm.getUuid());
+        }
+
+        validateVmVolumesForBackup(vm);
+
+        Pair<Long, Long> clusterAndHostId = virtualMachineManager.findClusterAndHostIdForVm(vm, false);
+        Long hostId = clusterAndHostId.second();
+        if (hostId == null) {
+            throw new CloudRuntimeException("Host cannot be determined for Instance: " + vm.getUuid());
+        }
+
+        BackupVO backup = new BackupVO();
+        backup.setVmId(vmId);
+        String name = cmd.getName();
+        if (StringUtils.isEmpty(name)) {
+            name = vmId + "-" + DateTime.now();
+        }
+        backup.setName(name);
+        final String description = cmd.getDescription();
+        if (StringUtils.isNotEmpty(description)) {
+            backup.setDescription(description);
+        }
+        backup.setAccountId(vm.getAccountId());
+        backup.setDomainId(vm.getDomainId());
+        backup.setZoneId(vm.getDataCenterId());
+        backup.setStatus(Backup.Status.Queued);
+        backup.setBackupOfferingId(0L);
+        backup.setDate(new Date());
+
+        String toCheckpointId = "ckp-" + UUID.randomUUID().toString().substring(0, 8);
+        Map<String, String> vmDetails = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String fromCheckpointId = vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+
+        backup.setToCheckpointId(toCheckpointId);
+        backup.setFromCheckpointId(fromCheckpointId);
+        backup.setType("FULL");
+        backup.setHostId(hostId);
+
+        return backupDao.persist(backup);
+    }
+
+    protected void removeFailedBackup(BackupVO backup) {
+        backup.setStatus(Backup.Status.Error);
+        backupDao.update(backup.getId(), backup);
+        backupDao.remove(backup.getId());
+    }
+
+    protected void queueBackupFinalizeWaitWorkJob(final VMInstanceVO vm, final BackupVO backup) {
+        final CallContext context = CallContext.current();
+        final Account callingAccount = context.getCallingAccount();
+        final long callingUserId = context.getCallingUserId();
+
+        VmWorkJobVO workJob = new VmWorkJobVO(context.getContextId());
+        workJob.setDispatcher(VmWorkConstants.VM_WORK_JOB_DISPATCHER);
+        workJob.setCmd(VmWorkWaitForBackupFinalize.class.getName());
+        workJob.setAccountId(callingAccount.getId());
+        workJob.setUserId(callingUserId);
+        workJob.setStep(VmWorkJobVO.Step.Starting);
+        workJob.setVmType(VirtualMachine.Type.User);
+        workJob.setVmInstanceId(vm.getId());
+        workJob.setRelated(AsyncJobExecutionContext.getOriginJobId());
+
+        VmWorkWaitForBackupFinalize workInfo = new VmWorkWaitForBackupFinalize(
+                callingUserId, callingAccount.getId(), vm.getId(), VM_WORK_JOB_HANDLER, backup.getId());
+        workJob.setCmdInfo(VmWorkSerializer.serialize(workInfo));
+
+        asyncJobManager.submitAsyncJob(workJob, VmWorkConstants.VM_WORK_QUEUE, vm.getId());
+    }
+
+    @Override
+    public Backup startBackup(StartBackupCmd cmd) {
+        BackupVO backup = backupDao.findById(cmd.getEntityId());
+        Long vmId = cmd.getVmId();
+        VMInstanceVO vm = vmInstanceDao.findById(vmId);
+        if (vm == null) {
+            removeFailedBackup(backup);
+            throw new CloudRuntimeException("Instance not found for Backup: " + backup.getUuid());
+        }
+        boolean isVmStopped = vm.getState() == State.Stopped;
+
+        List<VolumeVO> volumes = volumeDao.findByInstance(vmId);
+        Map<String, String> diskPathUuidMap = new HashMap<>();
+        Map<String, byte[]> diskPathPassphraseMap = new HashMap<>();
+        for (Volume vol : volumes) {
+            if (vol.getPoolId() == null) {
+                removeFailedBackup(backup);
+                throw new CloudRuntimeException("Storage Pool cannot be determined for Volume: " + vol.getUuid());
+            }
+            String volumePath = getVolumePathForFileBasedBackend(vol);
+            diskPathUuidMap.put(volumePath, vol.getUuid());
+            if (isVmStopped) {
+                VolumeInfo volumeInfo = volumeDataFactory.getVolume(vol.getId());
+                diskPathPassphraseMap.put(volumePath, volumeInfo.getPassphrase());
+            } else {
+                diskPathPassphraseMap.put(volumePath, null);
+            }
+        }
+        Long hostId = backup.getHostId();
+
+        VMInstanceDetailVO lastCheckpointId = vmInstanceDetailsDao.findDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_ID);
+        if (lastCheckpointId != null) {
+            try {
+                sendDeleteCheckpointCommand(vm, lastCheckpointId.getValue());
+            } catch (CloudRuntimeException e) {
+                logger.warn("Failed to delete last checkpoint {} for VM {}, proceeding with backup start", lastCheckpointId.getValue(), vmId, e);
+            }
+        }
+        if (hostId == null) {
+            removeFailedBackup(backup);
+            throw new CloudRuntimeException("Host cannot be found for Backup: " + backup.getUuid());
+        }
+
+        Host host = hostDao.findById(hostId);
+        Map<String, String> vmDetails = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String activeCkpCreateTimeStr = vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME);
+        Long fromCheckpointCreateTime = activeCkpCreateTimeStr != null ? NumbersUtil.parseLong(activeCkpCreateTimeStr, 0L) : null;
+        StartBackupCommand startCmd = new StartBackupCommand(
+            vm.getInstanceName(),
+            backup.getToCheckpointId(),
+            backup.getFromCheckpointId(),
+            fromCheckpointCreateTime,
+            backup.getUuid(),
+            diskPathUuidMap,
+            diskPathPassphraseMap,
+            isVmStopped
+        );
+
+        StartBackupAnswer answer;
+        try {
+            answer = (StartBackupAnswer) agentManager.send(hostId, startCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            removeFailedBackup(backup);
+            logger.error("Failed to communicate with agent on {} for {} start", host, backup, e);
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+
+        if (!answer.getResult()) {
+            removeFailedBackup(backup);
+            logger.error("Failed to start {} due to: {}", backup, answer.getDetails());
+            throw new CloudRuntimeException("Failed to start Backup: " + answer.getDetails());
+        }
+
+        // Update backup with checkpoint creation time
+        backup.setCheckpointCreateTime(answer.getCheckpointCreateTime());
+        updateBackupState(backup, Backup.Status.ReadyForImageTransfer);
+        queueBackupFinalizeWaitWorkJob(vm, backup);
+        return backup;
+    }
+
+    protected void updateBackupState(BackupVO backup, Backup.Status newStatus) {
+        backup.setStatus(newStatus);
+        backupDao.update(backup.getId(), backup);
+    }
+
+    private void updateVmCheckpoints(Long vmId, BackupVO backup) {
+        Map<String, String> vmDetails = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String oldCheckpointId = vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+        String oldCreateTimeStr = vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME);
+        if (oldCheckpointId != null && oldCreateTimeStr != null) {
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_ID, oldCheckpointId, false);
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_CREATE_TIME, oldCreateTimeStr, false);
+        }
+        String newCheckpointId = backup.getToCheckpointId();
+        Long newCreateTime = backup.getCheckpointCreateTime();
+        if (newCheckpointId != null && newCreateTime != null) {
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_ID, backup.getToCheckpointId(), false);
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME, String.valueOf(newCreateTime), false);
+        } else {
+            logger.error("New checkpoint details are missing for backup {} and vm {}", backup.getId(), vmId);
+        }
+    }
+
+    @Override
+    public Backup finalizeBackup(FinalizeBackupCmd cmd) {
+        Long vmId = cmd.getVmId();
+        Long backupId = cmd.getBackupId();
+
+        // Get backup
+        BackupVO backup = backupDao.findById(backupId);
+        if (backup == null) {
+            throw new CloudRuntimeException("Backup not found: " + backupId);
+        }
+
+        if (!backup.getVmId().equals(vmId)) {
+            throw new CloudRuntimeException("Backup does not belong to VM: " + vmId);
+        }
+
+        VMInstanceVO vm = vmInstanceDao.findById(vmId);
+        if (vm == null) {
+            throw new CloudRuntimeException("VM not found: " + vmId);
+        }
+
+        updateBackupState(backup, Backup.Status.FinalizingImageTransfer);
+
+        List<ImageTransferVO> transfers = imageTransferDao.listByBackupId(backupId);
+        for (ImageTransferVO transfer : transfers) {
+            if (transfer.getPhase() != ImageTransferVO.Phase.finished) {
+                logger.warn("Finalize called for backup {} while Image transfer {} is not finalized, attempting to finalize it", backup.getUuid(), transfer.getUuid());
+                finalizeImageTransfer(transfer.getId());
+            }
+        }
+
+        if (vm.getState() == State.Running) {
+            StopBackupCommand stopCmd = new StopBackupCommand(vm.getInstanceName(), vmId, backupId);
+
+            StopBackupAnswer answer;
+            try {
+                answer = (StopBackupAnswer) agentManager.send(backup.getHostId(), stopCmd);
+            } catch (AgentUnavailableException | OperationTimedoutException e) {
+                removeFailedBackup(backup);
+                throw new CloudRuntimeException("Failed to communicate with agent", e);
+            }
+
+            if (!answer.getResult()) {
+                removeFailedBackup(backup);
+                throw new CloudRuntimeException("Failed to stop backup: " + answer.getDetails());
+            }
+        }
+
+        updateVmCheckpoints(vmId, backup);
+
+        updateBackupState(backup, Backup.Status.BackedUp);
+        backupDao.remove(backup.getId());
+
+        return backup;
+
+    }
+
+    private ImageTransferVO createDownloadImageTransfer(Long backupId, VolumeVO volume, ImageTransfer.Backend backend) {
+        final String direction = ImageTransfer.Direction.download.toString();
+        BackupVO backup = backupDao.findById(backupId);
+        if (backup == null) {
+            throw new CloudRuntimeException("Backup not found: " + backupId);
+        }
+        if (ImageTransfer.Backend.file.equals(backend)) {
+            throw new CloudRuntimeException("File backend is not supported for download");
+        }
+
+        String transferId = UUID.randomUUID().toString();
+
+        String socket = backup.getUuid();
+        VMInstanceVO vm = vmInstanceDao.findById(backup.getVmId());
+        if (vm.getState() == State.Stopped) {
+            Map<String, String> vmDetails = vmInstanceDetailsDao.listDetailsKeyPairs(backup.getVmId());
+            String volumePath = getVolumePathForFileBasedBackend(volume);
+            VolumeInfo volumeInfo = volumeDataFactory.getVolume(volume.getId());
+            startNBDServer(transferId,
+                    direction,
+                    backup.getHostId(),
+                    volume.getUuid(),
+                    volumePath,
+                    vmDetails.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID),
+                    volumeInfo.getPassphrase());
+            socket = transferId;
+        }
+
+        HostVO backupHost = hostDao.findById(backup.getHostId());
+        if (backupHost == null) {
+            throw new CloudRuntimeException("Host not found for backup: " + backupId);
+        }
+        int idleTimeoutSec = ImageTransferIdleTimeoutSeconds.valueIn(backupHost.getDataCenterId());
+        CreateImageTransferCommand transferCmd = new CreateImageTransferCommand(
+                transferId,
+                direction,
+                volume.getUuid(),
+                socket,
+                backup.getFromCheckpointId(),
+                idleTimeoutSec);
+
+        try {
+            CreateImageTransferAnswer answer;
+            answer = (CreateImageTransferAnswer) agentManager.send(backup.getHostId(), transferCmd);
+
+            if (!answer.getResult()) {
+                throw new CloudRuntimeException("Failed to create image transfer: " + answer.getDetails());
+            }
+
+            ImageTransferVO imageTransfer = new ImageTransferVO(
+                    transferId,
+                    backupId,
+                    volume.getId(),
+                    backup.getHostId(),
+                    socket,
+                    ImageTransferVO.Phase.transferring,
+                    ImageTransfer.Direction.download,
+                    backup.getAccountId(),
+                    backup.getDomainId(),
+                    backup.getZoneId()
+            );
+            imageTransfer.setTransferUrl(answer.getTransferUrl());
+            imageTransfer.setSignedTicketId(answer.getImageTransferId());
+            imageTransfer = imageTransferDao.persist(imageTransfer);
+            return imageTransfer;
+
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+    }
+
+    private HostVO getRandomHostFromStoragePool(StoragePoolVO storagePool) {
+        List<HostVO> hosts;
+        switch (storagePool.getScope()) {
+            case CLUSTER:
+                hosts = hostDao.findByClusterId(storagePool.getClusterId());
+                Collections.shuffle(hosts);
+                return hosts.get(0);
+            case ZONE:
+                hosts = hostDao.findByDataCenterId(storagePool.getDataCenterId());
+                Collections.shuffle(hosts);
+                return hosts.get(0);
+            case HOST:
+                List<StoragePoolHostVO> storagePoolHostVOs = storagePoolHostDao.listByPoolId(storagePool.getId());
+                Collections.shuffle(storagePoolHostVOs);
+                return hostDao.findById(storagePoolHostVOs.get(0).getHostId());
+            default:
+                throw new CloudRuntimeException("Unsupported storage pool scope: " + storagePool.getScope());
+        }
+    }
+
+    private void startNBDServer(String transferId, String direction, Long hostId, String exportName, String volumePath, String checkpointId, byte[] passphrase) {
+        StartNBDServerAnswer nbdServerAnswer;
+        if (hostId == null) {
+            throw new CloudRuntimeException("Host cannot be determined for starting NBD server");
+        }
+        HostVO host = hostDao.findById(hostId);
+        if (host == null) {
+            throw new CloudRuntimeException("Host cannot be found for starting NBD server with ID: " + hostId);
+        }
+        StartNBDServerCommand nbdServerCmd = new StartNBDServerCommand(
+                transferId,
+                exportName,
+                volumePath,
+                transferId,
+                direction,
+                checkpointId,
+                passphrase
+        );
+        try {
+            nbdServerAnswer = (StartNBDServerAnswer) agentManager.send(hostId, nbdServerCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+        if (!nbdServerAnswer.getResult()) {
+            throw new CloudRuntimeException("Failed to start the NBD server");
+        }
+    }
+
+    private String getVolumePathPrefix(StoragePoolVO storagePool) {
+        if (ScopeType.HOST.equals(storagePool.getScope())) {
+                return storagePool.getPath();
+        }
+        switch (storagePool.getPoolType()) {
+            case NetworkFilesystem:
+                return String.format("/mnt/%s", storagePool.getUuid());
+            case SharedMountPoint:
+                return storagePool.getPath();
+            default:
+                throw new CloudRuntimeException("Unsupported storage pool type for file based image transfer: " + storagePool.getPoolType());
+        }
+    }
+
+    private String getVolumePathForFileBasedBackend(Volume volume) {
+        StoragePoolVO storagePool = primaryDataStoreDao.findById(volume.getPoolId());
+        String volumePathPrefix = getVolumePathPrefix(storagePool);
+        return volumePathPrefix + "/" + volume.getPath();
+    }
+
+    private ImageTransferVO createUploadImageTransfer(VolumeVO volume, ImageTransfer.Backend backend) {
+        final String direction = ImageTransfer.Direction.upload.toString();
+        String transferId = UUID.randomUUID().toString();
+
+        Long poolId = volume.getPoolId();
+        StoragePoolVO storagePool = poolId == null ? null : primaryDataStoreDao.findById(poolId);
+        if (storagePool == null) {
+            throw new CloudRuntimeException("Storage pool cannot be determined for volume: " + volume.getUuid());
+        }
+
+        Host host = getRandomHostFromStoragePool(storagePool);
+        String volumePath = getVolumePathForFileBasedBackend(volume);
+        int idleTimeoutSec = ImageTransferIdleTimeoutSeconds.valueIn(host.getDataCenterId());
+
+        ImageTransferVO imageTransfer;
+        CreateImageTransferCommand transferCmd;
+        if (backend.equals(ImageTransfer.Backend.file)) {
+            imageTransfer = new ImageTransferVO(
+                    transferId,
+                    volume.getId(),
+                    host.getId(),
+                    volumePath,
+                    ImageTransferVO.Phase.transferring,
+                    ImageTransfer.Direction.upload,
+                    volume.getAccountId(),
+                    volume.getDomainId(),
+                    volume.getDataCenterId());
+
+            transferCmd = new CreateImageTransferCommand(
+                    transferId,
+                    direction,
+                    transferId,
+                    volumePath,
+                    idleTimeoutSec);
+
+        } else {
+            VolumeInfo volumeInfo = volumeDataFactory.getVolume(volume.getId());
+            startNBDServer(transferId, direction, host.getId(), volume.getUuid(), volumePath, null, volumeInfo.getPassphrase());
+            imageTransfer = new ImageTransferVO(
+                    transferId,
+                    null,
+                    volume.getId(),
+                    host.getId(),
+                    transferId,
+                    ImageTransferVO.Phase.transferring,
+                    ImageTransfer.Direction.upload,
+                    volume.getAccountId(),
+                    volume.getDomainId(),
+                    volume.getDataCenterId());
+
+            transferCmd = new CreateImageTransferCommand(
+                    transferId,
+                    direction,
+                    volume.getUuid(),
+                    transferId,
+                    null,
+                    idleTimeoutSec);
+        }
+        CreateImageTransferAnswer transferAnswer;
+        try {
+            transferAnswer = (CreateImageTransferAnswer) agentManager.send(imageTransfer.getHostId(), transferCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+
+        if (!transferAnswer.getResult()) {
+            if (!backend.equals(ImageTransfer.Backend.file)) {
+                stopNBDServer(imageTransfer);
+            }
+            throw new CloudRuntimeException("Failed to create image transfer: " + transferAnswer.getDetails());
+        }
+
+        imageTransfer.setTransferUrl(transferAnswer.getTransferUrl());
+        imageTransfer.setSignedTicketId(transferAnswer.getImageTransferId());
+        imageTransfer = imageTransferDao.persist(imageTransfer);
+
+        try {
+            final StateMachine2<Volume.State, Volume.Event, Volume> stateMachine = Volume.State.getStateMachine();
+            stateMachine.transitTo(volume, Volume.Event.RestoreRequested, null, volumeDao);
+        } catch (NoTransitionException e) {
+            throw new CloudRuntimeException("Failed to transition volume  " + volume.getUuid(), e);
+        }
+
+        return imageTransfer;
+
+    }
+
+    private ImageTransfer.Backend getImageTransferBackend(ImageTransfer.Format format, ImageTransfer.Direction direction) {
+        if (ImageTransfer.Format.cow.equals(format)) {
+            if (ImageTransfer.Direction.download.equals(direction)) {
+                logger.debug("Using NBD backend for download");
+                return ImageTransfer.Backend.nbd;
+            }
+            return ImageTransfer.Backend.file;
+        } else {
+            return ImageTransfer.Backend.nbd;
+        }
+    }
+
+    @Override
+    public ImageTransferResponse createImageTransfer(CreateImageTransferCmd cmd) {
+        ImageTransfer imageTransfer = createImageTransfer(cmd.getVolumeId(), cmd.getBackupId(), cmd.getDirection(), cmd.getFormat());
+        if (imageTransfer instanceof ImageTransferVO) {
+            ImageTransferVO imageTransferVO = (ImageTransferVO) imageTransfer;
+            return toImageTransferResponse(imageTransferVO);
+        }
+        return toImageTransferResponse(imageTransferDao.findById(imageTransfer.getId()));
+    }
+
+    @Override
+    public ImageTransfer createImageTransfer(long volumeId, Long backupId, ImageTransfer.Direction direction, ImageTransfer.Format format) {
+        User callingUser = CallContext.current().getCallingUser();
+        ImageTransfer imageTransfer;
+        VolumeVO volume = volumeDao.findById(volumeId);
+        accountService.checkAccess(callingUser, volume);
+
+        if (volume == null) {
+            throw new CloudRuntimeException("Volume not found with the specified Id");
+        }
+
+        verifyKVMBackupExportServiceSupported(volume.getDataCenterId());
+
+        ImageTransferVO existingTransfer = imageTransferDao.findByVolume(volume.getId());
+        if (existingTransfer != null) {
+            throw new CloudRuntimeException("Image transfer already exists for volume: " + volume.getUuid());
+        }
+
+        ImageTransfer.Backend backend = getImageTransferBackend(format, direction);
+        if (ImageTransfer.Direction.upload.equals(direction)) {
+            imageTransfer = createUploadImageTransfer(volume, backend);
+        } else if (ImageTransfer.Direction.download.equals(direction)) {
+            imageTransfer = createDownloadImageTransfer(backupId, volume, backend);
+        } else {
+            throw new CloudRuntimeException("Invalid direction: " + direction);
+        }
+
+        return imageTransferDao.findById(imageTransfer.getId());
+    }
+
+    @Override
+    public boolean cancelImageTransfer(long imageTransferId) {
+        finalizeImageTransfer(imageTransferId);
+        return true;
+    }
+
+    private void finalizeDownloadImageTransfer(ImageTransferVO imageTransfer) {
+
+        String transferId = imageTransfer.getUuid();
+        FinalizeImageTransferCommand finalizeCmd = new FinalizeImageTransferCommand(transferId);
+
+        BackupVO backup = backupDao.findById(imageTransfer.getBackupId());
+
+        Answer answer;
+        try {
+            answer = agentManager.send(backup.getHostId(), finalizeCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+
+        if (!answer.getResult()) {
+            throw new CloudRuntimeException("Failed to finalize image transfer: " + answer.getDetails());
+        }
+
+        VMInstanceVO vm = vmInstanceDao.findById(backup.getVmId());
+        if (vm.getState() == State.Stopped) {
+            boolean stopNbdServerResult = stopNBDServer(imageTransfer);
+            if (!stopNbdServerResult) {
+                throw new CloudRuntimeException("Failed to stop the nbd server");
+            }
+        }
+    }
+
+    private boolean stopNBDServer(ImageTransferVO imageTransfer) {
+        String transferId = imageTransfer.getUuid();
+        String direction = imageTransfer.getDirection().toString();
+        StopNBDServerCommand stopNbdServerCommand = new StopNBDServerCommand(transferId, direction);
+        Answer answer;
+        try {
+            answer = agentManager.send(imageTransfer.getHostId(), stopNbdServerCommand);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            logger.error("Failed to stop NBD server on image transfer finalization", e);
+            return false;
+        }
+        return answer.getResult();
+    }
+
+    private String finalizeUploadImageTransferWithResult(ImageTransferVO imageTransfer) {
+        String transferId = imageTransfer.getUuid();
+        boolean stopNbdServerResult = stopNBDServer(imageTransfer);
+        if (!stopNbdServerResult) {
+            return "Failed to stop the nbd server";
+        }
+
+        FinalizeImageTransferCommand finalizeCmd = new FinalizeImageTransferCommand(transferId);
+        Answer answer;
+        try {
+            answer = agentManager.send(imageTransfer.getHostId(), finalizeCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            return "Failed to communicate with agent";
+        }
+
+        if (!answer.getResult()) {
+            return "Failed to finalize image transfer: " + answer.getDetails();
+        }
+        return null;
+    }
+
+    private void finalizeUploadImageTransfer(ImageTransferVO imageTransfer) {
+        String failureReason = finalizeUploadImageTransferWithResult(imageTransfer);
+        Volume.Event event = failureReason == null ? Volume.Event.RestoreSucceeded : Volume.Event.RestoreFailed;
+
+        VolumeVO volume = volumeDao.findById(imageTransfer.getVolumeId());
+        try {
+            final StateMachine2<Volume.State, Volume.Event, Volume> stateMachine = Volume.State.getStateMachine();
+            stateMachine.transitTo(volume, event, null, volumeDao);
+        } catch (NoTransitionException e) {
+            throw new CloudRuntimeException("Failed to transition state during upload finalize image transfer for volume " + volume.getUuid(), e);
+        }
+
+        if (failureReason != null) {
+            throw new CloudRuntimeException(failureReason);
+        }
+    }
+
+    @Override
+    public boolean finalizeImageTransfer(FinalizeImageTransferCmd cmd) {
+        return finalizeImageTransfer(cmd.getImageTransferId());
+    }
+
+    @Override
+    public boolean finalizeImageTransfer(final long imageTransferId) {
+        ImageTransferVO imageTransfer = imageTransferDao.findById(imageTransferId);
+        if (imageTransfer == null) {
+            throw new CloudRuntimeException("Image transfer not found: " + imageTransferId);
+        }
+
+        if (imageTransfer.getDirection().equals(ImageTransfer.Direction.download)) {
+            finalizeDownloadImageTransfer(imageTransfer);
+        } else {
+            finalizeUploadImageTransfer(imageTransfer);
+        }
+        imageTransfer.setPhase(ImageTransferVO.Phase.finished);
+        imageTransferDao.update(imageTransfer.getId(), imageTransfer);
+        imageTransferDao.remove(imageTransfer.getId());
+        return true;
+    }
+
+    @Override
+    public List<ImageTransferResponse> listImageTransfers(ListImageTransfersCmd cmd) {
+        Long id = cmd.getId();
+        Long backupId = cmd.getBackupId();
+
+        List<ImageTransferVO> transfers;
+        if (id != null) {
+            transfers = List.of(imageTransferDao.findById(id));
+        } else if (backupId != null) {
+            transfers = imageTransferDao.listByBackupId(backupId);
+        } else {
+            transfers = imageTransferDao.listAll();
+        }
+
+        return transfers.stream().map(this::toImageTransferResponse).collect(Collectors.toList());
+    }
+
+    private CheckpointResponse createCheckpointResponse(String checkpointId, String createTime, boolean isActive) {
+        CheckpointResponse response = new CheckpointResponse();
+        response.setObjectName("checkpoint");
+        response.setId(checkpointId);
+        Long createTimeSeconds = createTime != null ? NumbersUtil.parseLong(createTime, 0L) : 0L;
+        response.setCreated(Date.from(Instant.ofEpochSecond(createTimeSeconds)));
+        response.setIsActive(isActive);
+        return response;
+    }
+
+    @Override
+    public List<CheckpointResponse> listVmCheckpoints(ListVmCheckpointsCmd cmd) {
+        Long vmId = cmd.getVmId();
+        VMInstanceVO vm = vmInstanceDao.findById(vmId);
+        if (vm == null) {
+            throw new CloudRuntimeException("VM not found: " + vmId);
+        }
+        List<CheckpointResponse> responses = new ArrayList<>();
+
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String activeCheckpointId = details.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+        if (activeCheckpointId != null) {
+            responses.add(createCheckpointResponse(activeCheckpointId, details.get(VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME), true));
+        }
+        String lastCheckpointId = details.get(VmDetailConstants.LAST_CHECKPOINT_ID);
+        if (lastCheckpointId != null) {
+            responses.add(createCheckpointResponse(lastCheckpointId, details.get(VmDetailConstants.LAST_CHECKPOINT_CREATE_TIME), false));
+        }
+        return responses;
+    }
+
+    private void sendDeleteCheckpointCommand(VMInstanceVO vm, String checkpointId) {
+        Long hostId = vm.getHostId() != null ? vm.getHostId() : vm.getLastHostId();
+
+        Map<String, String> diskPathUuidMap = new HashMap<>();
+        if (vm.getState() == State.Stopped) {
+            List<VolumeVO> volumes = volumeDao.findByInstance(vm.getId());
+            for (Volume vol : volumes) {
+                diskPathUuidMap.put(getVolumePathForFileBasedBackend(vol), vol.getUuid());
+            }
+        }
+
+        DeleteVmCheckpointCommand deleteCmd = new DeleteVmCheckpointCommand(
+                vm.getInstanceName(),
+                checkpointId,
+                diskPathUuidMap,
+                vm.getState() == State.Stopped);
+
+        Answer answer;
+        try {
+            answer = agentManager.send(hostId, deleteCmd);
+        } catch (AgentUnavailableException | OperationTimedoutException e) {
+            logger.error("Failed to communicate with agent to delete checkpoint for VM {}", vm.getId(), e);
+            throw new CloudRuntimeException("Failed to communicate with agent", e);
+        }
+
+        if (answer == null || !answer.getResult()) {
+            String err = answer != null ? answer.getDetails() : "null answer";
+            throw new CloudRuntimeException("Failed to delete checkpoint: " + err);
+        }
+    }
+
+    @Override
+    public boolean deleteVmCheckpoint(DeleteVmCheckpointCmd cmd) {
+        VMInstanceVO vm = vmInstanceDao.findById(cmd.getVmId());
+        if (vm == null) {
+            throw new CloudRuntimeException("VM not found: " + cmd.getVmId());
+        }
+
+        verifyKVMBackupExportServiceSupported(vm.getDataCenterId());
+
+        if (vm.getState() != State.Running && vm.getState() != State.Stopped) {
+            throw new CloudRuntimeException("VM must be running or stopped to delete checkpoint");
+        }
+
+        long vmId = cmd.getVmId();
+        Map<String, String> details = vmInstanceDetailsDao.listDetailsKeyPairs(vmId);
+        String activeCheckpointId = details.get(VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+        if (activeCheckpointId == null || !activeCheckpointId.equals(cmd.getCheckpointId())) {
+            logger.error("Checkpoint ID {} to delete does not match active checkpoint ID for VM {}", cmd.getCheckpointId(), vmId);
+            return true;
+        }
+
+        sendDeleteCheckpointCommand(vm, activeCheckpointId);
+        revertVmCheckpointDetailsAfterActiveDelete(vmId, details);
+
+        return true;
+    }
+
+    @Override
+    public List<Long> listCompatibleDataCenterIds() {
+        return dataCenterDao.listAllIds().stream()
+                .filter(this::isZoneCompatible)
+                .collect(Collectors.toList());
+    }
+
+    private void revertVmCheckpointDetailsAfterActiveDelete(long vmId, Map<String, String> detailsBeforeDelete) {
+        String lastId = detailsBeforeDelete.get(VmDetailConstants.LAST_CHECKPOINT_ID);
+        String lastTime = detailsBeforeDelete.get(VmDetailConstants.LAST_CHECKPOINT_CREATE_TIME);
+        if (lastId != null) {
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_ID, lastId, false);
+            vmInstanceDetailsDao.addDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME, lastTime, false);
+            vmInstanceDetailsDao.removeDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_ID);
+            vmInstanceDetailsDao.removeDetail(vmId, VmDetailConstants.LAST_CHECKPOINT_CREATE_TIME);
+        } else {
+            vmInstanceDetailsDao.removeDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_ID);
+            vmInstanceDetailsDao.removeDetail(vmId, VmDetailConstants.ACTIVE_CHECKPOINT_CREATE_TIME);
+        }
+    }
+
+    @Override
+    public List<Class<?>> getCommands() {
+        List<Class<?>> cmdList = new ArrayList<>();
+        if (ExposeKVMBackupExportServiceApis.value()) {
+            cmdList.add(StartBackupCmd.class);
+            cmdList.add(FinalizeBackupCmd.class);
+            cmdList.add(CreateImageTransferCmd.class);
+            cmdList.add(FinalizeImageTransferCmd.class);
+            cmdList.add(ListImageTransfersCmd.class);
+            cmdList.add(ListVmCheckpointsCmd.class);
+            cmdList.add(DeleteVmCheckpointCmd.class);
+        }
+        return cmdList;
+    }
+
+    private ImageTransferResponse toImageTransferResponse(ImageTransferVO imageTransferVO) {
+        ImageTransferResponse response = new ImageTransferResponse();
+        response.setId(imageTransferVO.getUuid());
+        Long backupId = imageTransferVO.getBackupId();
+        if (backupId != null) {
+            Backup backup = backupDao.findByIdIncludingRemoved(backupId);
+            response.setBackupId(backup.getUuid());
+        }
+        Long volumeId = imageTransferVO.getVolumeId();
+        Volume volume = volumeDao.findByIdIncludingRemoved(volumeId);
+        response.setDiskId(volume.getUuid());
+        response.setTransferUrl(imageTransferVO.getTransferUrl());
+        response.setPhase(imageTransferVO.getPhase().toString());
+        response.setDirection(imageTransferVO.getDirection().toString());
+        response.setCreated(imageTransferVO.getCreated());
+        return response;
+    }
+
+    @Override
+    public boolean start() {
+        return true;
+    }
+
+    @Override
+    public boolean stop() {
+        return true;
+    }
+
+    @ReflectionUse
+    public Pair<JobInfo.Status, String> orchestrateWaitForBackupFinalize(VmWorkWaitForBackupFinalize work) {
+        return waitForBackupTerminalState(work.getBackupId());
+    }
+
+    @Override
+    public Pair<JobInfo.Status, String> handleVmWorkJob(VmWork work) throws Exception {
+        return jobHandlerProxy.handleVmWorkJob(work);
+    }
+
+    protected Pair<JobInfo.Status, String> waitForBackupTerminalState(final long backupId) {
+        while (true) {
+            final BackupVO backup = backupDao.findByIdIncludingRemoved(backupId);
+            if (backup == null) {
+                RuntimeException ex = new CloudRuntimeException(String.format("Backup %d not found while waiting for finalize", backupId));
+                return new Pair<>(JobInfo.Status.FAILED, asyncJobManager.marshallResultObject(ex));
+            }
+
+            if (backup.getStatus() == Backup.Status.BackedUp) {
+                return new Pair<>(JobInfo.Status.SUCCEEDED, asyncJobManager.marshallResultObject(backup.getId()));
+            }
+
+            if (backup.getStatus() == Backup.Status.Failed || backup.getStatus() == Backup.Status.Error) {
+                RuntimeException ex = new CloudRuntimeException(String.format("Backup %d reached terminal failure state: %s", backupId, backup.getStatus()));
+                return new Pair<>(JobInfo.Status.FAILED, asyncJobManager.marshallResultObject(ex));
+            }
+            logger.debug("{} is not in a terminal state, current state: {}, waiting {}ms to check again",
+                    backup, backup.getStatus(), BACKUP_FINALIZE_WAIT_CHECK_INTERVAL);
+            try {
+                Thread.sleep(BACKUP_FINALIZE_WAIT_CHECK_INTERVAL);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                    RuntimeException ex = new CloudRuntimeException(String.format("Interrupted while waiting for backup %d finalize", backupId), e);
+                    return new Pair<>(JobInfo.Status.FAILED, asyncJobManager.marshallResultObject(ex));
+                }
+            }
+        }
+
+    @Override
+    public String getConfigComponentName() {
+        return KVMBackupExportService.class.getSimpleName();
+    }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey[]{
+                ImageTransferIdleTimeoutSeconds,
+                ExposeKVMBackupExportServiceApis
+        };
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/backup/VmWorkWaitForBackupFinalize.java b/server/src/main/java/org/apache/cloudstack/backup/VmWorkWaitForBackupFinalize.java
new file mode 100644
index 000000000000..ac64b47aa3ea
--- /dev/null
+++ b/server/src/main/java/org/apache/cloudstack/backup/VmWorkWaitForBackupFinalize.java
@@ -0,0 +1,35 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+
+package org.apache.cloudstack.backup;
+
+import com.cloud.vm.VmWork;
+
+public class VmWorkWaitForBackupFinalize extends VmWork {
+    private static final long serialVersionUID = 2209426364298601717L;
+
+    private final long backupId;
+
+    public VmWorkWaitForBackupFinalize(long userId, long accountId, long vmId, String handlerName, long backupId) {
+        super(userId, accountId, vmId, handlerName);
+        this.backupId = backupId;
+    }
+
+    public long getBackupId() {
+        return backupId;
+    }
+}
diff --git a/server/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSServiceImpl.java b/server/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSServiceImpl.java
index 4f0aabd3f379..2548752cb685 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSServiceImpl.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/sharedfs/SharedFSServiceImpl.java
@@ -660,6 +660,39 @@ public void deleteSharedFS(Long sharedFSId) {
         sharedFSDao.remove(sharedFS.getId());
     }
 
+    @Override
+    public SharedFS getSharedFSByUuid(String uuid) {
+        return sharedFSDao.findByUuid(uuid);
+    }
+
+    @Override
+    public SharedFS getSharedFSForVmId(long vmId) {
+        return sharedFSDao.findByVm(vmId);
+    }
+
+    public SharedFS updateSharedFSPostRestore(long sharedFsId, long volumeId) {
+        SharedFSVO sharedFS = sharedFSDao.findById(sharedFsId);
+        if (sharedFS == null) {
+            throw new CloudRuntimeException("Unable to find the Shared FileSystem");
+        }
+        VolumeVO volume = volumeDao.findById(volumeId);
+        if (volume == null) {
+            throw new CloudRuntimeException("Unable to find the Volume");
+        }
+        if (volume.getInstanceId() == null) {
+            throw new CloudRuntimeException("Volume is not attached to any Instance");
+        }
+        if (sharedFS.getAccountId() != volume.getAccountId() || sharedFS.getDomainId() != volume.getDomainId()) {
+            throw new CloudRuntimeException("Shared FileSystem and the Volume do not belong to the same account");
+        }
+        sharedFS.setVolumeId(volume.getId());
+        sharedFS.setVmId(volume.getInstanceId());
+        if (!sharedFSDao.update(sharedFS.getId(), sharedFS)) {
+            throw new CloudRuntimeException("Failed to update Shared FileSystem with the restored Volume information");
+        }
+        return sharedFS;
+    }
+
     @Override
     public String getConfigComponentName() {
         return SharedFSService.class.getSimpleName();
diff --git a/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml b/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
index 37d32c0f3905..48fe5bb415df 100644
--- a/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
+++ b/server/src/main/resources/META-INF/cloudstack/core/spring-server-core-managers-context.xml
@@ -347,6 +347,8 @@
 
     <bean id="backupRepositoryService" class="org.apache.cloudstack.backup.BackupRepositoryServiceImpl" />
 
+    <bean id="kvmBackupExportService" class="org.apache.cloudstack.backup.KVMBackupExportServiceImpl" />
+
     <bean id="storageLayer" class="com.cloud.storage.JavaStorageLayer" />
 
     <bean id="nfsMountManager" class="org.apache.cloudstack.storage.NfsMountManagerImpl" >
diff --git a/server/src/test/java/com/cloud/api/query/dao/StoragePoolJoinDaoImplTest.java b/server/src/test/java/com/cloud/api/query/dao/StoragePoolJoinDaoImplTest.java
new file mode 100644
index 000000000000..64da9abff1ef
--- /dev/null
+++ b/server/src/test/java/com/cloud/api/query/dao/StoragePoolJoinDaoImplTest.java
@@ -0,0 +1,121 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package com.cloud.api.query.dao;
+
+import static org.junit.Assert.assertSame;
+import static org.mockito.AdditionalMatchers.aryEq;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.doReturn;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.List;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+
+import com.cloud.api.query.vo.StoragePoolJoinVO;
+import com.cloud.hypervisor.Hypervisor;
+import com.cloud.storage.Storage;
+import com.cloud.utils.db.Filter;
+import com.cloud.utils.db.SearchBuilder;
+import com.cloud.utils.db.SearchCriteria;
+
+@RunWith(MockitoJUnitRunner.class)
+public class StoragePoolJoinDaoImplTest {
+
+    @Spy
+    @InjectMocks
+    private StoragePoolJoinDaoImpl storagePoolJoinDao = new StoragePoolJoinDaoImpl();
+
+    @Mock
+    private SearchCriteria<StoragePoolJoinVO> searchCriteria;
+
+    @Before
+    @SuppressWarnings("unchecked")
+    public void setUp() {
+        StoragePoolJoinVO storagePoolJoinVO = mock(StoragePoolJoinVO.class);
+        SearchBuilder<StoragePoolJoinVO> searchBuilder = mock(SearchBuilder.class);
+        when(searchBuilder.entity()).thenReturn(storagePoolJoinVO);
+        when(searchBuilder.create()).thenReturn(searchCriteria);
+        doReturn(searchBuilder).when(storagePoolJoinDao).createSearchBuilder();
+    }
+
+    @Test
+    public void listAvailableByZoneHypervisorAndTypeReturnsMatchingPoolsWhenTypesAreProvided() {
+        long zoneId = 42L;
+        Hypervisor.HypervisorType hypervisorType = Hypervisor.HypervisorType.KVM;
+        List<Storage.StoragePoolType> types = Arrays.asList(Storage.StoragePoolType.NetworkFilesystem, Storage.StoragePoolType.Filesystem);
+        Filter filter = mock(Filter.class);
+        List<StoragePoolJoinVO> expectedPools = Collections.singletonList(mock(StoragePoolJoinVO.class));
+
+        doReturn(expectedPools).when(storagePoolJoinDao).listBy(searchCriteria, filter);
+
+        List<StoragePoolJoinVO> result = storagePoolJoinDao.listAvailableByZoneHypervisorAndType(zoneId, hypervisorType, types, filter);
+
+        assertSame(expectedPools, result);
+        verify(searchCriteria).setParameters("zoneId", zoneId);
+        verify(searchCriteria).setParameters(eq("hypervisors"), aryEq(new Object[]{Hypervisor.HypervisorType.Any, hypervisorType}));
+        verify(searchCriteria).setParameters(eq("types"), aryEq(types.toArray()));
+        verify(storagePoolJoinDao).listBy(searchCriteria, filter);
+    }
+
+    @Test
+    public void listAvailableByZoneHypervisorAndTypeSkipsTypeFilterWhenTypesAreNull() {
+        long zoneId = 7L;
+        Hypervisor.HypervisorType hypervisorType = Hypervisor.HypervisorType.VMware;
+        Filter filter = mock(Filter.class);
+        List<StoragePoolJoinVO> expectedPools = Collections.emptyList();
+
+        doReturn(expectedPools).when(storagePoolJoinDao).listBy(searchCriteria, filter);
+
+        List<StoragePoolJoinVO> result = storagePoolJoinDao.listAvailableByZoneHypervisorAndType(zoneId, hypervisorType, null, filter);
+
+        assertSame(expectedPools, result);
+        verify(searchCriteria).setParameters("zoneId", zoneId);
+        verify(searchCriteria).setParameters(eq("hypervisors"), aryEq(new Object[]{Hypervisor.HypervisorType.Any, hypervisorType}));
+        verify(searchCriteria, never()).setParameters(eq("types"), any(Object[].class));
+        verify(storagePoolJoinDao).listBy(searchCriteria, filter);
+    }
+
+    @Test
+    public void listAvailableByZoneHypervisorAndTypeSkipsTypeFilterForEmptyTypesAndPassesNullFilter() {
+        long zoneId = 9L;
+        Hypervisor.HypervisorType hypervisorType = Hypervisor.HypervisorType.XenServer;
+        List<StoragePoolJoinVO> expectedPools = Collections.singletonList(mock(StoragePoolJoinVO.class));
+
+        doReturn(expectedPools).when(storagePoolJoinDao).listBy(searchCriteria, null);
+
+        List<StoragePoolJoinVO> result = storagePoolJoinDao.listAvailableByZoneHypervisorAndType(zoneId, hypervisorType, Collections.emptyList(), null);
+
+        assertSame(expectedPools, result);
+        verify(searchCriteria).setParameters("zoneId", zoneId);
+        verify(searchCriteria).setParameters(eq("hypervisors"), aryEq(new Object[]{Hypervisor.HypervisorType.Any, hypervisorType}));
+        verify(searchCriteria, never()).setParameters(eq("types"), any(Object[].class));
+        verify(storagePoolJoinDao).listBy(searchCriteria, null);
+    }
+}
diff --git a/server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java b/server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java
index 286d4d04fa66..dd45324db410 100644
--- a/server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java
+++ b/server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java
@@ -872,6 +872,7 @@ public void testResetConfigurations() {
         Mockito.when(cmd.getAccountId()).thenReturn(null);
         Mockito.when(cmd.getDomainId()).thenReturn(null);
         Mockito.when(cmd.getImageStoreId()).thenReturn(null);
+        Mockito.when(cmd.getManagementServerId()).thenReturn(null);
 
         ConfigurationVO cfg = new ConfigurationVO("Advanced", "DEFAULT", "test", "pool.storage.capacity.disablethreshold", null, "description");
         cfg.setScope(10);
diff --git a/server/src/test/java/com/cloud/server/ManagementServerImplTest.java b/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
index 924bf1135a67..e69f927b41e0 100644
--- a/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
+++ b/server/src/test/java/com/cloud/server/ManagementServerImplTest.java
@@ -788,6 +788,7 @@ public void testSearchForConfigurations() {
         Mockito.when(cmd.getAccountId()).thenReturn(null);
         Mockito.when(cmd.getDomainId()).thenReturn(null);
         Mockito.when(cmd.getImageStoreId()).thenReturn(null);
+        Mockito.when(cmd.getManagementServerId()).thenReturn(null);
 
         SearchCriteria<ConfigurationVO> sc = Mockito.mock(SearchCriteria.class);
         Mockito.when(configDao.createSearchCriteria()).thenReturn(sc);
diff --git a/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java b/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java
index 77e321ab8591..11d7c70694eb 100644
--- a/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java
+++ b/server/src/test/java/com/cloud/storage/VolumeApiServiceImplTest.java
@@ -40,15 +40,6 @@
 import java.util.UUID;
 import java.util.concurrent.ExecutionException;
 
-import com.cloud.event.EventTypes;
-import com.cloud.event.UsageEventUtils;
-import com.cloud.host.HostVO;
-import com.cloud.resourcelimit.CheckedReservation;
-import com.cloud.service.ServiceOfferingVO;
-import com.cloud.service.dao.ServiceOfferingDao;
-import com.cloud.vm.snapshot.VMSnapshot;
-import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
-import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
 import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.acl.SecurityChecker.AccessType;
 import org.apache.cloudstack.api.command.user.volume.CheckAndRepairVolumeCmd;
@@ -102,22 +93,30 @@
 import com.cloud.configuration.ConfigurationManager;
 import com.cloud.configuration.Resource.ResourceType;
 import com.cloud.dc.ClusterVO;
+import com.cloud.dc.DataCenter;
 import com.cloud.dc.DataCenterVO;
 import com.cloud.dc.HostPodVO;
 import com.cloud.dc.dao.ClusterDao;
 import com.cloud.dc.dao.DataCenterDao;
 import com.cloud.dc.dao.HostPodDao;
+import com.cloud.event.EventTypes;
+import com.cloud.event.UsageEventUtils;
 import com.cloud.exception.InvalidParameterValueException;
 import com.cloud.exception.PermissionDeniedException;
 import com.cloud.exception.ResourceAllocationException;
+import com.cloud.host.HostVO;
 import com.cloud.host.dao.HostDao;
 import com.cloud.hypervisor.Hypervisor.HypervisorType;
+import com.cloud.offering.DiskOffering;
 import com.cloud.org.Grouping;
 import com.cloud.projects.Project;
 import com.cloud.projects.ProjectManager;
+import com.cloud.resourcelimit.CheckedReservation;
 import com.cloud.serializer.GsonHelper;
 import com.cloud.server.ManagementService;
 import com.cloud.server.TaggedResourceService;
+import com.cloud.service.ServiceOfferingVO;
+import com.cloud.service.dao.ServiceOfferingDao;
 import com.cloud.storage.Storage.ProvisioningType;
 import com.cloud.storage.Volume.Type;
 import com.cloud.storage.dao.DiskOfferingDao;
@@ -145,8 +144,11 @@
 import com.cloud.vm.VirtualMachineManager;
 import com.cloud.vm.dao.UserVmDao;
 import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.snapshot.VMSnapshot;
+import com.cloud.vm.snapshot.VMSnapshotDetailsVO;
 import com.cloud.vm.snapshot.VMSnapshotVO;
 import com.cloud.vm.snapshot.dao.VMSnapshotDao;
+import com.cloud.vm.snapshot.dao.VMSnapshotDetailsDao;
 
 @RunWith(MockitoJUnitRunner.class)
 public class VolumeApiServiceImplTest {
@@ -467,6 +469,111 @@ public void setup() throws InterruptedException, ExecutionException {
         when(_jobMgr.submitAsyncJob(any(AsyncJobVO.class), any(String.class), any(Long.class))).thenReturn(1L);
     }
 
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadReturnsDefaultOfferingWhenAccessibleAndEncryptionNotRequired() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Active);
+        Mockito.when(defaultOffering.getId()).thenReturn(11L);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, false);
+
+        Assert.assertEquals(Long.valueOf(11L), result);
+        Mockito.verify(_diskOfferingDao, Mockito.never()).listCustomDiskOfferings();
+    }
+
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadReturnsDefaultOfferingWhenEncryptedOnlyAndDefaultOfferingIsEncrypted() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Active);
+        Mockito.when(defaultOffering.getId()).thenReturn(12L);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+        Mockito.when(_diskOfferingDao.findById(12L)).thenReturn(defaultOffering);
+        Mockito.when(defaultOffering.getEncrypt()).thenReturn(true);
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, true);
+
+        Assert.assertEquals(Long.valueOf(12L), result);
+        Mockito.verify(_diskOfferingDao, Mockito.never()).listCustomDiskOfferings();
+    }
+
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadFallsBackToEncryptedCustomOfferingWhenDefaultOfferingNotEncrypted() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO nonEncryptedOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO encryptedOffering = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Active);
+        Mockito.when(defaultOffering.getId()).thenReturn(13L);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+        Mockito.when(_diskOfferingDao.findById(13L)).thenReturn(defaultOffering);
+        Mockito.when(defaultOffering.getEncrypt()).thenReturn(false);
+
+        Mockito.when(nonEncryptedOffering.getEncrypt()).thenReturn(false);
+        Mockito.when(encryptedOffering.getEncrypt()).thenReturn(true);
+        Mockito.when(encryptedOffering.getId()).thenReturn(23L);
+        Mockito.when(_diskOfferingDao.listCustomDiskOfferings()).thenReturn(List.of(nonEncryptedOffering, encryptedOffering));
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, true);
+
+        Assert.assertEquals(Long.valueOf(23L), result);
+        Mockito.verify(_configMgr).checkDiskOfferingAccess(owner, encryptedOffering, zone);
+        Mockito.verify(_configMgr, Mockito.never()).checkDiskOfferingAccess(owner, nonEncryptedOffering, zone);
+    }
+
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadFallsBackWhenDefaultOfferingIsNotAccessible() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO deniedOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO allowedOffering = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Active);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+        Mockito.doThrow(new PermissionDeniedException("default denied")).when(_configMgr).checkDiskOfferingAccess(owner, defaultOffering, zone);
+
+        Mockito.when(allowedOffering.getId()).thenReturn(24L);
+        Mockito.when(_diskOfferingDao.listCustomDiskOfferings()).thenReturn(List.of(deniedOffering, allowedOffering));
+        Mockito.doThrow(new PermissionDeniedException("denied")).when(_configMgr).checkDiskOfferingAccess(owner, deniedOffering, zone);
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, false);
+
+        Assert.assertEquals(Long.valueOf(24L), result);
+        Mockito.verify(_configMgr).checkDiskOfferingAccess(owner, deniedOffering, zone);
+        Mockito.verify(_configMgr).checkDiskOfferingAccess(owner, allowedOffering, zone);
+    }
+
+    @Test
+    public void getCustomDiskOfferingIdForVolumeUploadReturnsNullWhenNoAccessibleEligibleCustomOfferingExists() {
+        Account owner = Mockito.mock(Account.class);
+        DataCenter zone = Mockito.mock(DataCenter.class);
+        DiskOfferingVO defaultOffering = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO firstEncrypted = Mockito.mock(DiskOfferingVO.class);
+        DiskOfferingVO secondEncrypted = Mockito.mock(DiskOfferingVO.class);
+
+        Mockito.when(defaultOffering.getState()).thenReturn(DiskOffering.State.Inactive);
+        Mockito.when(_diskOfferingDao.findByUniqueName(anyString())).thenReturn(defaultOffering);
+
+        Mockito.when(firstEncrypted.getEncrypt()).thenReturn(true);
+        Mockito.when(secondEncrypted.getEncrypt()).thenReturn(true);
+        Mockito.when(_diskOfferingDao.listCustomDiskOfferings()).thenReturn(List.of(firstEncrypted, secondEncrypted));
+        Mockito.doThrow(new PermissionDeniedException("denied")).when(_configMgr).checkDiskOfferingAccess(owner, firstEncrypted, zone);
+        Mockito.doThrow(new PermissionDeniedException("denied")).when(_configMgr).checkDiskOfferingAccess(owner, secondEncrypted, zone);
+
+        Long result = volumeApiServiceImpl.getCustomDiskOfferingIdForVolumeUpload(owner, zone, true);
+
+        Assert.assertNull(result);
+    }
+
     /**
      * TESTS FOR DETACH ROOT VOLUME, COUNT=4
      */
@@ -601,26 +708,22 @@ public void testTakeSnapshotF2() throws ResourceAllocationException {
 
     @Test
     public void testNullGetVolumeNameFromCmd() {
-        when(createVol.getVolumeName()).thenReturn(null);
-        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(createVol));
+        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(null));
     }
 
     @Test
     public void testEmptyGetVolumeNameFromCmd() {
-        when(createVol.getVolumeName()).thenReturn("");
-        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(createVol));
+        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(""));
     }
 
     @Test
     public void testBlankGetVolumeNameFromCmd() {
-        when(createVol.getVolumeName()).thenReturn("   ");
-        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand(createVol));
+        Assert.assertNotNull(volumeApiServiceImpl.getVolumeNameFromCommand("   "));
     }
 
     @Test
     public void testNonEmptyGetVolumeNameFromCmd() {
-        when(createVol.getVolumeName()).thenReturn("abc");
-        Assert.assertSame(volumeApiServiceImpl.getVolumeNameFromCommand(createVol), "abc");
+        Assert.assertSame(volumeApiServiceImpl.getVolumeNameFromCommand("abc"), "abc");
     }
 
     @Test
@@ -2193,7 +2296,7 @@ public void testCreateVolumeOnSecondaryForAttachIfNeeded_NoSuitablePool_ThrowsEx
     }
 
     @Test
-    public void testCreateVolumeOnSecondaryForAttachIfNeeded_NoSuitablePool_ReturnSameVolumeInfo() {
+    public void testCreateVolumeOnSecondaryForAttachIfNeeded_NoSuitablePool_ReturnsSameVolumeInfo() {
         VolumeInfo volumeToAttach = Mockito.mock(VolumeInfo.class);
         Mockito.when(volumeToAttach.getState()).thenReturn(Volume.State.Allocated);
         UserVmVO vm = Mockito.mock(UserVmVO.class);
diff --git a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
index 93a06ef2097f..75779cc4c96b 100644
--- a/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
+++ b/server/src/test/java/com/cloud/vm/UserVmManagerImplTest.java
@@ -85,20 +85,19 @@
 import org.apache.cloudstack.backup.dao.BackupScheduleDao;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.engine.orchestration.service.NetworkOrchestrationService;
-import org.apache.cloudstack.resourcelimit.Reserver;
 import org.apache.cloudstack.engine.subsystem.api.storage.PrimaryDataStore;
 import org.apache.cloudstack.engine.subsystem.api.storage.Scope;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
 import org.apache.cloudstack.framework.config.ConfigKey;
 import org.apache.cloudstack.framework.jobs.impl.AsyncJobVO;
+import org.apache.cloudstack.resourcelimit.Reserver;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.storage.template.VnfTemplateManager;
 import org.apache.cloudstack.userdata.UserDataManager;
 import org.apache.cloudstack.vm.UnmanagedVMsManager;
 import org.apache.cloudstack.vm.lease.VMLeaseManager;
-
 import org.junit.After;
 import org.junit.Assert;
 import org.junit.Before;
@@ -851,9 +850,7 @@ public void configureCustomRootDiskSizeTestEmptyParametersAndOfferingRootSize()
 
     private void prepareAndRunConfigureCustomRootDiskSizeTest(Map<String, String> customParameters, long expectedRootDiskSize, int timesVerifyIfHypervisorSupports, Long offeringRootDiskSize) {
         VMTemplateVO template = Mockito.mock(VMTemplateVO.class);
-        Mockito.when(template.getId()).thenReturn(1L);
         Mockito.when(template.getSize()).thenReturn(99L * GiB_TO_BYTES);
-        Mockito.when(templateDao.findById(Mockito.anyLong())).thenReturn(template);
 
         DiskOfferingVO diskfferingVo = Mockito.mock(DiskOfferingVO.class);
 
diff --git a/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java b/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
index 8a0bec56df7b..ea822e7eec8b 100644
--- a/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
+++ b/server/src/test/java/com/cloud/vpc/dao/MockNetworkDaoImpl.java
@@ -16,6 +16,11 @@
 // under the License.
 package com.cloud.vpc.dao;
 
+import java.util.ArrayList;
+import java.util.List;
+import java.util.Map;
+import java.util.Set;
+
 import com.cloud.network.Network;
 import com.cloud.network.Network.GuestType;
 import com.cloud.network.Networks.TrafficType;
@@ -23,14 +28,10 @@
 import com.cloud.network.dao.NetworkDao;
 import com.cloud.network.dao.NetworkVO;
 import com.cloud.utils.db.DB;
+import com.cloud.utils.db.Filter;
 import com.cloud.utils.db.GenericDaoBase;
 import com.cloud.utils.db.SearchBuilder;
 
-import java.util.ArrayList;
-import java.util.List;
-import java.util.Map;
-import java.util.Set;
-
 @DB()
 public class MockNetworkDaoImpl extends GenericDaoBase<NetworkVO, Long> implements NetworkDao {
 
@@ -160,11 +161,22 @@ public boolean update(final Long networkId, final NetworkVO network, final Map<S
         return false;
     }
 
+    @Override
+    public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType, Filter filter) {
+        return null;
+    }
+
     @Override
     public List<NetworkVO> listByZoneAndTrafficType(final long zoneId, final TrafficType trafficType) {
         return null;
     }
 
+    @Override
+    public List<NetworkVO> listByZonesTrafficTypeAndOwners(List<Long> zoneIds, final TrafficType trafficType, List<Long> accountIds,
+                                                           List<Long> domainIds, Filter filter) {
+        return null;
+    }
+
     @Override
     public void setCheckForGc(final long networkId) {
     }
diff --git a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
index 27dd630e470f..d1817047499e 100644
--- a/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
+++ b/server/src/test/java/org/apache/cloudstack/backup/BackupManagerTest.java
@@ -42,22 +42,6 @@
 import java.util.TimeZone;
 import java.util.UUID;
 
-import org.junit.After;
-import org.junit.Assert;
-import org.junit.Before;
-import org.junit.Test;
-import org.junit.runner.RunWith;
-import org.mockito.ArgumentCaptor;
-import org.mockito.InjectMocks;
-import org.mockito.Mock;
-import org.mockito.MockedStatic;
-import org.mockito.Mockito;
-import org.mockito.MockitoAnnotations;
-import org.mockito.Spy;
-import org.mockito.junit.MockitoJUnitRunner;
-import org.mockito.stubbing.Answer;
-import org.springframework.test.util.ReflectionTestUtils;
-
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.command.admin.backup.CloneBackupOfferingCmd;
@@ -71,8 +55,8 @@
 import org.apache.cloudstack.api.response.BackupResponse;
 import org.apache.cloudstack.backup.dao.BackupDao;
 import org.apache.cloudstack.backup.dao.BackupDetailsDao;
-import org.apache.cloudstack.backup.dao.BackupOfferingDetailsDao;
 import org.apache.cloudstack.backup.dao.BackupOfferingDao;
+import org.apache.cloudstack.backup.dao.BackupOfferingDetailsDao;
 import org.apache.cloudstack.backup.dao.BackupScheduleDao;
 import org.apache.cloudstack.context.CallContext;
 import org.apache.cloudstack.framework.config.ConfigKey;
@@ -83,6 +67,21 @@
 import org.apache.cloudstack.reservation.dao.ReservationDao;
 import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.junit.After;
+import org.junit.Assert;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.mockito.Spy;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.mockito.stubbing.Answer;
+import org.springframework.test.util.ReflectionTestUtils;
 
 import com.cloud.alert.AlertManager;
 import com.cloud.api.query.dao.UserVmJoinDao;
@@ -274,6 +273,7 @@ public class BackupManagerTest {
     private String[] datastoresPossibleValues = {"e9804933-8609-4de3-bccc-6278072a496c", "datastore-name"};
     private AutoCloseable closeable;
     private ConfigDepotImpl configDepotImpl;
+    private ConfigKey backupFrameworkConfigKey = BackupManager.BackupFrameworkEnabled;
     private boolean updatedConfigKeyDepot = false;
     private MockedStatic<DbUtil> dbUtilMockedStatic;
     private final List<String> mockedGlobalLocks = new ArrayList<>();
@@ -341,7 +341,10 @@ public void tearDown() throws Exception {
         dbUtilMockedStatic.close();
         closeable.close();
         if (updatedConfigKeyDepot) {
-            ReflectionTestUtils.setField(BackupManager.BackupFrameworkEnabled, "s_depot", configDepotImpl);
+            ConfigKey configKey = BackupManager.BackupFrameworkEnabled;
+            ReflectionTestUtils.setField(configKey, "s_depot", configDepotImpl);
+            ReflectionTestUtils.setField(configKey, "_value", null);
+            updatedConfigKeyDepot = false;
         }
         CallContext.unregister();
     }
@@ -350,6 +353,7 @@ private void overrideBackupFrameworkConfigValue() {
         ConfigKey configKey = BackupManager.BackupFrameworkEnabled;
         this.configDepotImpl = (ConfigDepotImpl) ReflectionTestUtils.getField(configKey, "s_depot");
         ConfigDepotImpl configDepot = Mockito.mock(ConfigDepotImpl.class);
+        ReflectionTestUtils.setField(configKey, "_value", null);
         Mockito.when(configDepot.getConfigStringValue(Mockito.eq(BackupManager.BackupFrameworkEnabled.key()),
                 Mockito.eq(ConfigKey.Scope.Global), Mockito.isNull())).thenReturn("true");
         Mockito.when(configDepot.getConfigStringValue(Mockito.eq(BackupManager.BackupFrameworkEnabled.key()),
diff --git a/server/src/test/java/org/apache/cloudstack/backup/KVMBackupExportServiceImplTest.java b/server/src/test/java/org/apache/cloudstack/backup/KVMBackupExportServiceImplTest.java
new file mode 100644
index 000000000000..507658318509
--- /dev/null
+++ b/server/src/test/java/org/apache/cloudstack/backup/KVMBackupExportServiceImplTest.java
@@ -0,0 +1,467 @@
+// Licensed to the Apache Software Foundation (ASF) under one
+// or more contributor license agreements.  See the NOTICE file
+// distributed with this work for additional information
+// regarding copyright ownership.  The ASF licenses this file
+// to you under the Apache License, Version 2.0 (the
+// "License"); you may not use this file except in compliance
+// with the License.  You may obtain a copy of the License at
+//
+//   http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing,
+// software distributed under the License is distributed on an
+// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+// KIND, either express or implied.  See the License for the
+// specific language governing permissions and limitations
+// under the License.
+package org.apache.cloudstack.backup;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.ArgumentMatchers.isNull;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.mockStatic;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import java.util.Collections;
+import java.util.HashMap;
+import java.util.List;
+import java.util.Map;
+
+import org.apache.cloudstack.api.command.admin.backup.StartBackupCmd;
+import org.apache.cloudstack.context.CallContext;
+import org.apache.cloudstack.backup.dao.BackupDao;
+import org.apache.cloudstack.backup.dao.ImageTransferDao;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeDataFactory;
+import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.storage.datastore.db.PrimaryDataStoreDao;
+import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.InjectMocks;
+import org.mockito.Mock;
+import org.mockito.MockedStatic;
+import org.mockito.junit.MockitoJUnitRunner;
+import org.springframework.test.util.ReflectionTestUtils;
+
+import com.cloud.agent.AgentManager;
+import com.cloud.agent.api.Answer;
+import com.cloud.agent.api.Command;
+import com.cloud.host.HostVO;
+import com.cloud.host.dao.HostDao;
+import com.cloud.storage.ScopeType;
+import com.cloud.storage.Storage;
+import com.cloud.storage.Volume;
+import com.cloud.storage.VolumeVO;
+import com.cloud.storage.dao.VolumeDao;
+import com.cloud.user.AccountService;
+import com.cloud.user.User;
+import com.cloud.utils.Pair;
+import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.vm.VMInstanceVO;
+import com.cloud.vm.VirtualMachine.State;
+import com.cloud.vm.VirtualMachineManager;
+import com.cloud.vm.VmDetailConstants;
+import com.cloud.vm.dao.VMInstanceDao;
+import com.cloud.vm.dao.VMInstanceDetailsDao;
+
+@RunWith(MockitoJUnitRunner.class)
+public class KVMBackupExportServiceImplTest {
+
+    @InjectMocks
+    KVMBackupExportServiceImpl service;
+
+    @Mock
+    VolumeDao volumeDao;
+
+    @Mock
+    VMInstanceDao vmInstanceDao;
+
+    @Mock
+    VMInstanceDetailsDao vmInstanceDetailsDao;
+
+    @Mock
+    BackupDao backupDao;
+
+    @Mock
+    ImageTransferDao imageTransferDao;
+
+    @Mock
+    AgentManager agentManager;
+
+    @Mock
+    HostDao hostDao;
+
+    @Mock
+    PrimaryDataStoreDao primaryDataStoreDao;
+
+    @Mock
+    AccountService accountService;
+
+    @Mock
+    VirtualMachineManager virtualMachineManager;
+
+    @Mock
+    BackupVO backup;
+
+    @Mock
+    VolumeVO volume;
+
+    @Mock
+    HostVO hostVO;
+
+    @Mock
+    VolumeDataFactory volumeDataFactory;
+
+    @Mock
+    CallContext callContext;
+
+    @Mock
+    User user;
+
+    VMInstanceVO vm;
+
+    @Before
+    public void setUp() {
+        vm = mock(VMInstanceVO.class);
+        when(vm.getId()).thenReturn(1L);
+        when(vm.getUuid()).thenReturn("vm-uuid");
+    }
+
+    @Test
+    public void validateVmVolumesForBackup_noNonReadyVolumes_doesNotThrow() {
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(Collections.emptyList());
+
+        service.validateVmVolumesForBackup(vm);
+    }
+
+    @Test
+    public void validateVmVolumesForBackup_oneVolumeNotReady_throwsWithVolumeAndInstanceId() {
+        VolumeVO vol = mock(VolumeVO.class);
+        when(vol.getUuid()).thenReturn("vol-not-ready");
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(List.of(vol));
+
+        CloudRuntimeException ex = assertThrows(CloudRuntimeException.class,
+                () -> service.validateVmVolumesForBackup(vm));
+
+        assert ex.getMessage().contains("vol-not-ready");
+        assert ex.getMessage().contains("vm-uuid");
+    }
+
+    @Test
+    public void validateVmVolumesForBackup_multipleVolumesNotReady_throwsWithAllVolumeIds() {
+        VolumeVO vol1 = mock(VolumeVO.class);
+        VolumeVO vol2 = mock(VolumeVO.class);
+        when(vol1.getUuid()).thenReturn("vol-a");
+        when(vol2.getUuid()).thenReturn("vol-b");
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(List.of(vol1, vol2));
+
+        CloudRuntimeException ex = assertThrows(CloudRuntimeException.class,
+                () -> service.validateVmVolumesForBackup(vm));
+
+        assert ex.getMessage().contains("vol-a");
+        assert ex.getMessage().contains("vol-b");
+        assert ex.getMessage().contains("vm-uuid");
+    }
+
+    private StartBackupCmd mockCmd(Long vmId, String name, String description) {
+        StartBackupCmd cmd = mock(StartBackupCmd.class);
+        when(cmd.getVmId()).thenReturn(vmId);
+        when(cmd.getName()).thenReturn(name);
+        when(cmd.getDescription()).thenReturn(description);
+        return cmd;
+    }
+
+    private void stubVmRunningWithHost(Long vmId, VMInstanceVO vmInstance, Long hostId) {
+        when(vmInstanceDao.findById(vmId)).thenReturn(vmInstance);
+        when(vmInstance.getState()).thenReturn(State.Running);
+        when(vmInstance.getDataCenterId()).thenReturn(10L);
+        when(vmInstance.getAccountId()).thenReturn(100L);
+        when(vmInstance.getDomainId()).thenReturn(200L);
+        when(backupDao.findByVmId(vmId)).thenReturn(null);
+        when(volumeDao.findByInstanceAndNotStates(vmId, Volume.State.Ready)).thenReturn(Collections.emptyList());
+        when(virtualMachineManager.findClusterAndHostIdForVm(vmInstance, false))
+                .thenReturn(new Pair<>(5L, hostId));
+        when(vmInstanceDetailsDao.listDetailsKeyPairs(vmId)).thenReturn(new HashMap<>());
+    }
+
+    @Test
+    public void createBackup_instanceNotFound_throws() {
+        when(vmInstanceDao.findById(99L)).thenReturn(null);
+
+        assertThrows(CloudRuntimeException.class,
+                () -> service.createBackup(mockCmd(99L, "backup", null)));
+    }
+
+    @Test
+    public void createBackup_instanceNotRunningOrStopped_throws() {
+        when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Migrating);
+        when(vm.getDataCenterId()).thenReturn(10L);
+
+        assertThrows(CloudRuntimeException.class,
+                () -> service.createBackup(mockCmd(1L, "backup", null)));
+    }
+
+    @Test
+    public void createBackup_backupAlreadyInProgress_throws() {
+        when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Running);
+        when(vm.getDataCenterId()).thenReturn(10L);
+        BackupVO existing = mock(BackupVO.class);
+        when(existing.getStatus()).thenReturn(Backup.Status.BackingUp);
+        when(backupDao.findByVmId(1L)).thenReturn(existing);
+
+        assertThrows(CloudRuntimeException.class,
+                () -> service.createBackup(mockCmd(1L, "backup", null)));
+    }
+
+    @Test
+    public void createBackup_hostCannotBeDetermined_throws() {
+        stubVmRunningWithHost(1L, vm, null);
+
+        assertThrows(CloudRuntimeException.class,
+                () -> service.createBackup(mockCmd(1L, "backup", null)));
+    }
+
+    @Test
+    public void createBackup_happyPath_persistsBackupWithQueuedStatus() {
+        stubVmRunningWithHost(1L, vm, 42L);
+        BackupVO persisted = mock(BackupVO.class);
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(persisted);
+
+        Backup result = service.createBackup(mockCmd(1L, "my-backup", "desc"));
+
+        assertNotNull(result);
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        verify(backupDao).persist(captor.capture());
+        assertEquals(Backup.Status.Queued, captor.getValue().getStatus());
+        assertEquals("my-backup", captor.getValue().getName());
+        assertEquals("desc", captor.getValue().getDescription());
+        assertEquals(Long.valueOf(42L), captor.getValue().getHostId());
+        assertEquals(Long.valueOf(1L), captor.getValue().getVmId());
+    }
+
+    @Test
+    public void createBackup_noNameProvided_generatesNameFromVmId() {
+        stubVmRunningWithHost(1L, vm, 42L);
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(mock(BackupVO.class));
+
+        service.createBackup(mockCmd(1L, null, null));
+
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        verify(backupDao).persist(captor.capture());
+        assertNotNull(captor.getValue().getName());
+        assert captor.getValue().getName().startsWith("1-");
+    }
+
+    @Test
+    public void createBackup_existingBackupNotInProgress_proceedsNormally() {
+        when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Stopped);
+        when(vm.getDataCenterId()).thenReturn(10L);
+        when(vm.getAccountId()).thenReturn(100L);
+        when(vm.getDomainId()).thenReturn(200L);
+        BackupVO existing = mock(BackupVO.class);
+        when(existing.getStatus()).thenReturn(Backup.Status.BackedUp);
+        when(backupDao.findByVmId(1L)).thenReturn(existing);
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(Collections.emptyList());
+        when(virtualMachineManager.findClusterAndHostIdForVm(vm, false)).thenReturn(new Pair<>(5L, 42L));
+        when(vmInstanceDetailsDao.listDetailsKeyPairs(1L)).thenReturn(new HashMap<>());
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(mock(BackupVO.class));
+
+        Backup result = service.createBackup(mockCmd(1L, "backup", null));
+
+        assertNotNull(result);
+    }
+
+    @Test
+    public void createBackup_withActiveCheckpoint_setsFromCheckpointId() {
+        when(vmInstanceDao.findById(1L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Running);
+        when(vm.getDataCenterId()).thenReturn(10L);
+        when(vm.getAccountId()).thenReturn(100L);
+        when(vm.getDomainId()).thenReturn(200L);
+        when(backupDao.findByVmId(1L)).thenReturn(null);
+        when(volumeDao.findByInstanceAndNotStates(1L, Volume.State.Ready)).thenReturn(Collections.emptyList());
+        when(virtualMachineManager.findClusterAndHostIdForVm(vm, false)).thenReturn(new Pair<>(5L, 42L));
+        Map<String, String> details = new HashMap<>();
+        details.put("active.checkpoint.id", "ckp-abc123");
+        when(vmInstanceDetailsDao.listDetailsKeyPairs(1L)).thenReturn(details);
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(mock(BackupVO.class));
+
+        service.createBackup(mockCmd(1L, "backup", null));
+
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        verify(backupDao).persist(captor.capture());
+        assertEquals("ckp-abc123", captor.getValue().getFromCheckpointId());
+    }
+
+    @Test
+    public void createBackup_noActiveCheckpoint_fromCheckpointIdIsNull() {
+        stubVmRunningWithHost(1L, vm, 42L);
+        when(backupDao.persist(any(BackupVO.class))).thenReturn(mock(BackupVO.class));
+
+        service.createBackup(mockCmd(1L, "backup", null));
+
+        ArgumentCaptor<BackupVO> captor = ArgumentCaptor.forClass(BackupVO.class);
+        verify(backupDao).persist(captor.capture());
+        assert captor.getValue().getFromCheckpointId() == null;
+        assertNotNull(captor.getValue().getToCheckpointId());
+        assert captor.getValue().getToCheckpointId().startsWith("ckp-");
+    }
+
+    @Test
+    public void removeFailedBackup_setsErrorStatusAndRemovesRecord() {
+        BackupVO backup = mock(BackupVO.class);
+        when(backup.getId()).thenReturn(10L);
+
+        service.removeFailedBackup(backup);
+
+        verify(backup).setStatus(Backup.Status.Error);
+        verify(backupDao).update(10L, backup);
+        verify(backupDao).remove(10L);
+    }
+
+    @Test
+    public void finalizeImageTransfer_downloadStoppedVm_stopNbdFails_throwsAndDoesNotUpdate() throws Exception {
+        ImageTransferVO transfer = new ImageTransferVO("tx-download-fail", 11L, 21L, 31L, "sock",
+                ImageTransferVO.Phase.transferring, ImageTransfer.Direction.download, 1L, 1L, 1L);
+        ReflectionTestUtils.setField(transfer, "id", 501L);
+        when(imageTransferDao.findById(501L)).thenReturn(transfer);
+        when(backupDao.findById(11L)).thenReturn(backup);
+        when(backup.getHostId()).thenReturn(31L);
+        when(backup.getVmId()).thenReturn(41L);
+        when(vmInstanceDao.findById(41L)).thenReturn(vm);
+        when(vm.getState()).thenReturn(State.Stopped);
+        when(agentManager.send(eq(31L), any(Command.class))).thenReturn(
+                new Answer(null, true, null),
+                new Answer(null, false, "stop failed")
+        );
+
+        CloudRuntimeException ex = assertThrows(CloudRuntimeException.class,
+                () -> service.finalizeImageTransfer(501L));
+
+        assert ex.getMessage().contains("Failed to stop the nbd server");
+        verify(imageTransferDao, never()).update(eq(501L), any(ImageTransferVO.class));
+        verify(imageTransferDao, never()).remove(501L);
+    }
+
+    @Test
+    public void createImageTransfer_uploadFileBackend_success() throws Exception {
+        ReflectionTestUtils.setField(BackupManager.BackupFrameworkEnabled, "_value", Boolean.FALSE);
+        try (MockedStatic<CallContext> mocked = mockStatic(CallContext.class)) {
+            mocked.when(CallContext::current).thenReturn(callContext);
+            when(callContext.getCallingUser()).thenReturn(user);
+
+            when(volumeDao.findById(601L)).thenReturn(volume);
+            when(volume.getId()).thenReturn(601L);
+            when(volume.getState()).thenReturn(Volume.State.Ready);
+            when(volume.getDataCenterId()).thenReturn(1L);
+            when(volume.getPoolId()).thenReturn(701L);
+            when(volume.getPath()).thenReturn("vol-601.qcow2");
+            when(volume.getAccountId()).thenReturn(11L);
+            when(volume.getDomainId()).thenReturn(12L);
+            when(imageTransferDao.findByVolume(601L)).thenReturn(null);
+
+            StoragePoolVO pool = new StoragePoolVO();
+            pool.setId(701L);
+            pool.setScope(ScopeType.ZONE);
+            pool.setDataCenterId(1L);
+            pool.setPoolType(Storage.StoragePoolType.NetworkFilesystem);
+            pool.setUuid("pool-701");
+            pool.setPath("/primary");
+            when(primaryDataStoreDao.findById(701L)).thenReturn(pool);
+
+            when(hostDao.findByDataCenterId(1L)).thenReturn(List.of(hostVO));
+            when(hostVO.getId()).thenReturn(801L);
+            when(hostVO.getDataCenterId()).thenReturn(1L);
+            when(agentManager.send(eq(801L), any(Command.class)))
+                    .thenReturn(new CreateImageTransferAnswer(null, true, null, "ticket-1", "https://transfer/file"));
+
+            final ImageTransferVO[] persisted = new ImageTransferVO[1];
+            when(imageTransferDao.persist(any(ImageTransferVO.class))).thenAnswer(i -> {
+                persisted[0] = i.getArgument(0);
+                ReflectionTestUtils.setField(persisted[0], "id", 901L);
+                return persisted[0];
+            });
+            when(imageTransferDao.findById(901L)).thenAnswer(i -> persisted[0]);
+
+            ImageTransfer created = service.createImageTransfer(601L, null, ImageTransfer.Direction.upload, ImageTransfer.Format.cow);
+
+            assertNotNull(created);
+            assertEquals(901L, created.getId());
+            assertEquals(ImageTransfer.Direction.upload, created.getDirection());
+            verify(volumeDao).updateState(eq(Volume.State.Ready), eq(Volume.Event.RestoreRequested), eq(Volume.State.Restoring), eq(volume), isNull());
+            verify(agentManager, times(1)).send(eq(801L), any(Command.class));
+        }
+    }
+
+    @Test
+    public void createImageTransfer_downloadStoppedVm_startsNbdAndCreatesTransfer() throws Exception {
+        ReflectionTestUtils.setField(BackupManager.BackupFrameworkEnabled, "_value", Boolean.FALSE);
+        try (MockedStatic<CallContext> mocked = mockStatic(CallContext.class)) {
+            mocked.when(CallContext::current).thenReturn(callContext);
+            when(callContext.getCallingUser()).thenReturn(user);
+
+            when(volumeDao.findById(602L)).thenReturn(volume);
+            when(volume.getId()).thenReturn(602L);
+            when(volume.getUuid()).thenReturn("vol-602");
+            when(volume.getDataCenterId()).thenReturn(1L);
+            when(volume.getPoolId()).thenReturn(702L);
+            when(volume.getPath()).thenReturn("vol-602.raw");
+            when(imageTransferDao.findByVolume(602L)).thenReturn(null);
+
+            StoragePoolVO pool = new StoragePoolVO();
+            pool.setId(702L);
+            pool.setScope(ScopeType.ZONE);
+            pool.setDataCenterId(1L);
+            pool.setPoolType(Storage.StoragePoolType.NetworkFilesystem);
+            pool.setUuid("pool-702");
+            when(primaryDataStoreDao.findById(702L)).thenReturn(pool);
+
+            when(backupDao.findById(612L)).thenReturn(backup);
+            when(backup.getVmId()).thenReturn(55L);
+            when(backup.getHostId()).thenReturn(802L);
+            when(backup.getUuid()).thenReturn("backup-612");
+            when(backup.getFromCheckpointId()).thenReturn("ckp-prev");
+            when(backup.getAccountId()).thenReturn(11L);
+            when(backup.getDomainId()).thenReturn(12L);
+            when(backup.getZoneId()).thenReturn(1L);
+            when(vmInstanceDao.findById(55L)).thenReturn(vm);
+            when(vm.getState()).thenReturn(State.Stopped);
+            when(vmInstanceDetailsDao.listDetailsKeyPairs(55L)).thenReturn(Map.of(VmDetailConstants.ACTIVE_CHECKPOINT_ID, "ckp-active"));
+            when(hostDao.findById(802L)).thenReturn(hostVO);
+            when(hostVO.getDataCenterId()).thenReturn(1L);
+            when(volumeDataFactory.getVolume(602L)).thenReturn(mock(VolumeInfo.class));
+
+            when(agentManager.send(eq(802L), any(Command.class))).thenReturn(
+                    new StartNBDServerAnswer(null, true, null),
+                    new CreateImageTransferAnswer(null, true, null, "ticket-2", "https://transfer/nbd")
+            );
+
+            final ImageTransferVO[] persisted = new ImageTransferVO[1];
+            when(imageTransferDao.persist(any(ImageTransferVO.class))).thenAnswer(i -> {
+                persisted[0] = i.getArgument(0);
+                ReflectionTestUtils.setField(persisted[0], "id", 902L);
+                return persisted[0];
+            });
+            when(imageTransferDao.findById(902L)).thenAnswer(i -> persisted[0]);
+
+            ImageTransfer created = service.createImageTransfer(602L, 612L, ImageTransfer.Direction.download, ImageTransfer.Format.raw);
+
+            assertNotNull(created);
+            assertEquals(902L, created.getId());
+            assertEquals(ImageTransfer.Direction.download, created.getDirection());
+            verify(agentManager, times(2)).send(eq(802L), any(Command.class));
+        }
+    }
+}
diff --git a/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java b/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
index 3a5ea8b0252b..3c3f1f5747b8 100644
--- a/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
+++ b/services/secondary-storage/server/src/main/java/org/apache/cloudstack/storage/resource/NfsSecondaryStorageResource.java
@@ -55,7 +55,6 @@
 
 import javax.naming.ConfigurationException;
 
-import com.cloud.agent.api.ConvertSnapshotCommand;
 import org.apache.cloudstack.framework.security.keystore.KeystoreManager;
 import org.apache.cloudstack.storage.NfsMountManagerImpl.PathParser;
 import org.apache.cloudstack.storage.command.CopyCmdAnswer;
@@ -98,8 +97,8 @@
 import org.apache.http.client.methods.HttpGet;
 import org.apache.http.client.utils.URLEncodedUtils;
 import org.apache.http.impl.client.DefaultHttpClient;
-import org.apache.logging.log4j.Logger;
 import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
 import org.joda.time.DateTime;
 import org.joda.time.format.ISODateTimeFormat;
 
@@ -109,6 +108,7 @@
 import com.cloud.agent.api.CheckHealthCommand;
 import com.cloud.agent.api.Command;
 import com.cloud.agent.api.ComputeChecksumCommand;
+import com.cloud.agent.api.ConvertSnapshotCommand;
 import com.cloud.agent.api.DeleteSnapshotsDirCommand;
 import com.cloud.agent.api.GetStorageStatsAnswer;
 import com.cloud.agent.api.GetStorageStatsCommand;
diff --git a/tools/apidoc/gen_toc.py b/tools/apidoc/gen_toc.py
index 292f52d809bf..ead8f0620ba6 100644
--- a/tools/apidoc/gen_toc.py
+++ b/tools/apidoc/gen_toc.py
@@ -223,6 +223,10 @@
     'Management': 'Management',
     'Backup' : 'Backup and Recovery',
     'Restore' : 'Backup and Recovery',
+    'startBackup' : 'Backup and Recovery',
+    'finalizeBackup' : 'Backup and Recovery',
+    'ImageTransfer' : 'Backup and Recovery',
+    'VmCheckpoint' : 'Backup and Recovery',
     'UnmanagedInstance': 'Virtual Machine',
     'KubernetesSupportedVersion': 'Kubernetes Service',
     'KubernetesCluster': 'Kubernetes Service',
diff --git a/ui/src/components/view/InfoCard.vue b/ui/src/components/view/InfoCard.vue
index 996e30ead3b5..3094bf58dbcc 100644
--- a/ui/src/components/view/InfoCard.vue
+++ b/ui/src/components/view/InfoCard.vue
@@ -609,7 +609,8 @@
               <div class="resource-detail-item__details">
                 <resource-icon v-if="images.template || images.guestoscategory" :image="images.template || images.guestoscategory" size="1x" style="margin-right: 5px"/>
                 <SaveOutlined v-else />
-                <router-link :to="{ path: (resource.templateformat === 'ISO' ? '/iso/' : '/template/') + resource.templateid }">{{ resource.templatedisplaytext || resource.templatename || resource.templateid }} </router-link>
+                <router-link v-if="validLinks.template" :to="{ path: (resource.templateformat === 'ISO' ? '/iso/' : '/template/') + resource.templateid }">{{ resource.templatedisplaytext || resource.templatename || resource.templateid }} </router-link>
+                <span v-else>{{ resource.templatedisplaytext || resource.templatename || resource.templateid }}</span>
               </div>
             </div>
             <div class="resource-detail-item" v-if="resource.isoid">
@@ -617,7 +618,8 @@
               <div class="resource-detail-item__details">
                 <resource-icon v-if="images.iso || (resource.isoid === resource.templateid && images.guestoscategory)" :image="images.iso || images.guestoscategory" size="1x" style="margin-right: 5px"/>
                 <UsbOutlined v-else />
-                  <router-link :to="{ path: '/iso/' + resource.isoid }">{{ resource.isodisplaytext || resource.isoname || resource.isoid }} </router-link>
+                <router-link v-if="validLinks.iso" :to="{ path: '/iso/' + resource.isoid }">{{ resource.isodisplaytext || resource.isoname || resource.isoid }} </router-link>
+                <span v-else>{{ resource.isodisplaytext || resource.isoname || resource.isoid }}</span>
               </div>
             </div>
             <div class="resource-detail-item" v-if="resource.serviceofferingname && resource.serviceofferingid">
@@ -980,7 +982,7 @@
 <script>
 import { getAPI, postAPI } from '@/api'
 import { createPathBasedOnVmType } from '@/utils/plugins'
-import { validateLinks } from '@/utils/links'
+import { validateLinksAsync } from '@/utils/links'
 import Console from '@/components/widgets/Console'
 import OsLogo from '@/components/widgets/OsLogo'
 import Status from '@/components/widgets/Status'
@@ -1068,12 +1070,12 @@ export default {
     },
     resource: {
       deep: true,
-      handler (newData, oldData) {
+      async handler (newData, oldData) {
         if (newData === oldData) return
         this.newResource = newData
         this.showKeys = false
         this.setData()
-        this.validLinks = validateLinks(this.$router, this.isStatic, this.resource)
+        this.validLinks = await validateLinksAsync(this.$router, this.isStatic, this.resource)
 
         if ('apikey' in this.resource) {
           this.getUserKeys()
diff --git a/ui/src/components/view/SettingsTab.vue b/ui/src/components/view/SettingsTab.vue
index 0e0ee33f2800..0bb8a1569cca 100644
--- a/ui/src/components/view/SettingsTab.vue
+++ b/ui/src/components/view/SettingsTab.vue
@@ -106,6 +106,9 @@ export default {
       case 'imagestore':
         this.scopeKey = 'imagestoreuuid'
         break
+      case 'managementserver':
+        this.scopeKey = 'managementserverid'
+        break
       default:
         this.scopeKey = ''
     }
diff --git a/ui/src/config/section/infra/managementServers.js b/ui/src/config/section/infra/managementServers.js
index d2d11d5b25d0..4bf54943fd85 100644
--- a/ui/src/config/section/infra/managementServers.js
+++ b/ui/src/config/section/infra/managementServers.js
@@ -39,6 +39,10 @@ export default {
       name: 'details',
       component: shallowRef(defineAsyncComponent(() => import('@/components/view/DetailsTab.vue')))
     },
+    {
+      name: 'settings',
+      component: shallowRef(defineAsyncComponent(() => import('@/components/view/SettingsTab.vue')))
+    },
     {
       name: 'management.server.peers',
       component: shallowRef(defineAsyncComponent(() => import('@/views/infra/ManagementServerPeerTab.vue')))
diff --git a/ui/src/utils/links.js b/ui/src/utils/links.js
index fa650cdd7b8b..9beafc4a9869 100644
--- a/ui/src/utils/links.js
+++ b/ui/src/utils/links.js
@@ -15,6 +15,27 @@
 // specific language governing permissions and limitations
 // under the License.
 
+import { getAPI } from '@/api'
+
+async function isValidObject (apiName, id, params) {
+  try {
+    const allParams = { ...params, listAll: true, id }
+    const json = await getAPI(apiName, allParams)
+    const responseName = Object.keys(json).find(key => key.endsWith('response')) || apiName.toLowerCase() + 'response'
+    const response = json?.[responseName]
+    if (!response) {
+      return false
+    }
+    const objectName = Object.keys(response).find(key => key !== 'count')
+    if (!objectName || !Array.isArray(response[objectName])) {
+      return false
+    }
+    return response[objectName].some(item => item.id === id)
+  } catch (e) {
+    return false
+  }
+}
+
 export function validateLinks (router, isStatic, resource) {
   const validLinks = {
     volume: false
@@ -34,3 +55,54 @@ export function validateLinks (router, isStatic, resource) {
 
   return validLinks
 }
+
+export async function validateLinksAsync (router, isStatic, resource) {
+  const validLinks = {
+    volume: false,
+    template: false,
+    iso: false
+  }
+  const pendingChecks = []
+
+  if (isStatic) {
+    return validLinks
+  }
+
+  if (resource.volumeid && router.resolve('/volume/' + resource.volumeid).matched[0].redirect !== '/exception/404') {
+    if (resource.volumestate) {
+      validLinks.volume = resource.volumestate !== 'Expunged'
+    } else {
+      validLinks.volume = true
+    }
+  }
+
+  if (resource.templateid) {
+    const templatePath = (resource.templateformat === 'ISO' ? '/iso/' : '/template/') + resource.templateid
+    if (router.resolve(templatePath).matched[0].redirect !== '/exception/404') {
+      pendingChecks.push(
+        isValidObject('listTemplates', resource.templateid, { templatefilter: 'executable' }).then(result => {
+          validLinks.template = result
+        })
+      )
+    }
+  }
+
+  if (resource.isoid) {
+    const isoPath = '/iso/' + resource.isoid
+    if (router.resolve(isoPath).matched[0].redirect !== '/exception/404') {
+      pendingChecks.push(
+        isValidObject('listIsos', resource.isoid, { isofilter: 'executable' }).then(result => {
+          validLinks.iso = result
+        })
+      )
+    }
+  }
+
+  if (pendingChecks.length) {
+    await Promise.all(pendingChecks).catch(error => {
+      console.error('Error validating links:', error)
+    })
+  }
+
+  return validLinks
+}
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/server/ServerPropertiesUtil.java b/utils/src/main/java/org/apache/cloudstack/utils/server/ServerPropertiesUtil.java
index 14d24dbb6410..52642cf03707 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/server/ServerPropertiesUtil.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/server/ServerPropertiesUtil.java
@@ -30,8 +30,11 @@
 
 public class ServerPropertiesUtil {
     private static final Logger logger = LoggerFactory.getLogger(ServerPropertiesUtil.class);
+
     protected static final String PROPERTIES_FILE = "server.properties";
     protected static final AtomicReference<Properties> propertiesRef = new AtomicReference<>();
+    protected static final String KEYSTORE_FILE = "https.keystore";
+    protected static final String KEYSTORE_PASSWORD = "https.keystore.password";
 
     public static String getProperty(String name) {
         Properties props = propertiesRef.get();
@@ -55,4 +58,12 @@ public static String getProperty(String name) {
         }
         return tempProps.getProperty(name);
     }
+
+    public static String getKeystoreFile() {
+        return getProperty(KEYSTORE_FILE);
+    }
+
+    public static String getKeystorePassword() {
+        return getProperty(KEYSTORE_PASSWORD);
+    }
 }

From 6bc83a3c46f4b51ddf24483ee1fe3ccf65d2791a Mon Sep 17 00:00:00 2001
From: Wei Zhou <weizhou@apache.org>
Date: Mon, 8 Jun 2026 11:20:20 +0200
Subject: [PATCH 59/64] .github: Upgrade codecov/codecov-action to version
 7.0.0 (#13370)

---
 .github/workflows/ci.yml               | 2 +-
 .github/workflows/main-sonar-check.yml | 2 +-
 .github/workflows/sonar-check.yml      | 2 +-
 .github/workflows/ui.yml               | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e9d03bf1209b..0815b4558476 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -348,7 +348,7 @@ jobs:
           echo -e "Simulator CI Test Results: (only failures listed)\n"
           python3 ./tools/marvin/xunit-reader.py integration-test-results/
 
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: jacoco-coverage.xml
           fail_ci_if_error: true
diff --git a/.github/workflows/main-sonar-check.yml b/.github/workflows/main-sonar-check.yml
index ad58d07a9894..3d510fa5dc34 100644
--- a/.github/workflows/main-sonar-check.yml
+++ b/.github/workflows/main-sonar-check.yml
@@ -55,7 +55,7 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
         run: mvn -B -P quality org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack -Dsonar.branch.name=${{ github.ref_name }}
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./client/target/site/jacoco-aggregate/jacoco.xml
           fail_ci_if_error: true
diff --git a/.github/workflows/sonar-check.yml b/.github/workflows/sonar-check.yml
index 49a49d009580..e614d1864824 100644
--- a/.github/workflows/sonar-check.yml
+++ b/.github/workflows/sonar-check.yml
@@ -57,7 +57,7 @@ jobs:
           HEADREF: ${{ github.event.pull_request.head.ref }}
         run: |
           mvn -B -P quality org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=apache_cloudstack -Dsonar.pullrequest.key="$PR_ID" -Dsonar.pullrequest.branch="$HEADREF" -Dsonar.pullrequest.github.repository=apache/cloudstack -Dsonar.pullrequest.provider=GitHub -Dsonar.pullrequest.github.summary_comment=true
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         with:
           files: ./client/target/site/jacoco-aggregate/jacoco.xml
           fail_ci_if_error: true
diff --git a/.github/workflows/ui.yml b/.github/workflows/ui.yml
index ff27809db8f6..0a6cd5f3ea5f 100644
--- a/.github/workflows/ui.yml
+++ b/.github/workflows/ui.yml
@@ -59,7 +59,7 @@ jobs:
           npm run lint
           npm run test:unit
 
-      - uses: codecov/codecov-action@e79a6962e0d4c0c17b229090214935d2e33f8354 # v6.0.1
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # v7.0.0
         if: github.repository == 'apache/cloudstack'
         with:
           working-directory: ui

From a7f9756d6267869b96a9209af58c0335835a773d Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Wed, 10 Jun 2026 11:39:39 +0530
Subject: [PATCH 60/64] Remove realhostip references from the code (#12856)

* Remove realhostip references from the code

* remove unused code
---
 .pre-commit-config.yaml                       |   2 +-
 .../META-INF/db/schema-42210to42300.sql       |   6 ++++++
 scripts/util/keystore-cert-import             |  19 +++++++++---------
 .../cloud/server/ConfigurationServerImpl.java |   3 ---
 .../storage/download/DownloadMonitorImpl.java |   5 -----
 .../storage/upload/UploadMonitorImpl.java     |  13 +++++-------
 .../java/com/cloud/keystore/KeystoreTest.java |  12 +++++------
 services/console-proxy/server/pom.xml         |   2 +-
 services/secondary-storage/server/pom.xml     |   2 +-
 .../certs/{realhostip.crt => systemvm.crt}    |   0
 .../certs/{realhostip.csr => systemvm.csr}    |   0
 .../certs/{realhostip.key => systemvm.key}    |   0
 ...{realhostip.keystore => systemvm.keystore} | Bin
 systemvm/agent/scripts/_run.sh                |   2 +-
 systemvm/agent/scripts/config_ssl.sh          |   6 +++---
 .../debian/opt/cloud/bin/setup/bootstrap.sh   |   2 +-
 systemvm/patch-sysvms.sh                      |  18 ++++++++---------
 systemvm/pom.xml                              |   2 +-
 .../utils/imagestore/ImageStoreUtilTest.java  |   4 ++--
 19 files changed, 47 insertions(+), 51 deletions(-)
 rename systemvm/agent/certs/{realhostip.crt => systemvm.crt} (100%)
 rename systemvm/agent/certs/{realhostip.csr => systemvm.csr} (100%)
 rename systemvm/agent/certs/{realhostip.key => systemvm.key} (100%)
 rename systemvm/agent/certs/{realhostip.keystore => systemvm.keystore} (100%)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 755ae125edf0..91537e25267e 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -151,7 +151,7 @@ repos:
           ^server/src/test/resources/certs/rsa_self_signed\.key$|
           ^services/console-proxy/rdpconsole/src/test/doc/rdp-key\.pem$|
           ^systemvm/agent/certs/localhost\.key$|
-          ^systemvm/agent/certs/realhostip\.key$|
+          ^systemvm/agent/certs/systemvm\.key$|
           ^test/integration/smoke/test_ssl_offloading\.py$
       - id: end-of-file-fixer
         exclude: \.vhd$|\.svg$
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
index 478125335e70..d999cbcd5093 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
@@ -150,6 +150,12 @@ FROM `cloud`.`configuration` `cfg`
 WHERE NOT EXISTS (SELECT 1 FROM `cloud`.`configuration` WHERE `name` = 'kvm.cpu.dynamic.scaling.capacity')
   AND `cfg`.`name` = 'vm.serviceoffering.cpu.cores.max';
 
+-- Remove stale realhostip.com default values; domain has been dead since ~2015.
+UPDATE `cloud`.`configuration`
+    SET value = NULL
+    WHERE name IN ('consoleproxy.url.domain', 'secstorage.ssl.cert.domain')
+      AND value IN ('realhostip.com', '*.realhostip.com');
+
 -- Add management_server_details table to allow ManagementServer scope configs
 CREATE TABLE IF NOT EXISTS `management_server_details` (
                                                            `id` bigint unsigned NOT NULL AUTO_INCREMENT COMMENT 'id',
diff --git a/scripts/util/keystore-cert-import b/scripts/util/keystore-cert-import
index cf355e098454..447dcd71745f 100755
--- a/scripts/util/keystore-cert-import
+++ b/scripts/util/keystore-cert-import
@@ -137,18 +137,19 @@ if [ -f "$SYSTEM_FILE" ]; then
     chmod 644 /usr/local/share/ca-certificates/cloudstack/ca.crt
     update-ca-certificates > /dev/null 2>&1 || true
 
-    # Import CA cert(s) into realhostip.keystore so the SSVM JVM
-    # (which overrides the truststore via -Djavax.net.ssl.trustStore in _run.sh)
-    # can trust servers signed by the CloudStack CA
-    REALHOSTIP_KS_FILE="$(dirname "$(dirname "$PROPS_FILE")")/certs/realhostip.keystore"
-    REALHOSTIP_PASS="vmops.com"
-    if [ -f "$REALHOSTIP_KS_FILE" ]; then
+    # Also import CA cert(s) into systemvm.keystore. KS_FILE (cloud.jks) above
+    # is the agent's mTLS keystore; the SSVM JVM, however, reads its truststore
+    # from systemvm.keystore (see -Djavax.net.ssl.trustStore in _run.sh), so the
+    # CA must be added here too for the SSVM to trust CloudStack-CA-signed servers.
+    SYSTEMVM_KS_FILE="$(dirname "$(dirname "$PROPS_FILE")")/certs/systemvm.keystore"
+    SYSTEMVM_PASS="vmops.com"
+    if [ -f "$SYSTEMVM_KS_FILE" ]; then
         awk 'BEGIN{n=0} /-----BEGIN CERTIFICATE-----/{n++} n>0{print > "cloudca." n }' "$CACERT_FILE"
         for caChain in $(ls cloudca.* 2>/dev/null); do
-            keytool -delete -noprompt -alias "$caChain" -keystore "$REALHOSTIP_KS_FILE" \
-                -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1 || true
+            keytool -delete -noprompt -alias "$caChain" -keystore "$SYSTEMVM_KS_FILE" \
+                -storepass "$SYSTEMVM_PASS" > /dev/null 2>&1 || true
             keytool -import -noprompt -trustcacerts -alias "$caChain" -file "$caChain" \
-                -keystore "$REALHOSTIP_KS_FILE" -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1
+                -keystore "$SYSTEMVM_KS_FILE" -storepass "$SYSTEMVM_PASS" > /dev/null 2>&1
         done
         rm -f cloudca.*
     fi
diff --git a/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java b/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
index 8f10dd84b54d..def564dfdc68 100644
--- a/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
@@ -222,9 +222,6 @@ public void persistDefaultValues() throws InternalErrorException {
             _configDao.update(Config.SecStorageEncryptCopy.key(), Config.SecStorageEncryptCopy.getCategory(), "false");
             logger.debug("ConfigurationServer made secondary storage copy encrypt set to false.");
 
-            _configDao.update("secstorage.secure.copy.cert", "realhostip");
-            logger.debug("ConfigurationServer made secondary storage copy use realhostip.");
-
             _configDao.update("user.password.encoders.exclude", "MD5,LDAP,PLAINTEXT");
             logger.debug("Configuration server excluded insecure encoders");
 
diff --git a/server/src/main/java/com/cloud/storage/download/DownloadMonitorImpl.java b/server/src/main/java/com/cloud/storage/download/DownloadMonitorImpl.java
index 67d5b091a032..5258f4337550 100644
--- a/server/src/main/java/com/cloud/storage/download/DownloadMonitorImpl.java
+++ b/server/src/main/java/com/cloud/storage/download/DownloadMonitorImpl.java
@@ -87,11 +87,6 @@ public boolean configure(String name, Map<String, Object> params) {
         final Map<String, String> configs = _configDao.getConfiguration("management-server", params);
         _proxy = configs.get(Config.SecStorageProxy.key());
 
-        String cert = configs.get("secstorage.ssl.cert.domain");
-        if (!"realhostip.com".equalsIgnoreCase(cert)) {
-            logger.warn("Only realhostip.com ssl cert is supported, ignoring self-signed and other certs");
-        }
-
         _copyAuthPasswd = configs.get("secstorage.copy.password");
 
         DownloadListener dl = new DownloadListener(this);
diff --git a/server/src/main/java/com/cloud/storage/upload/UploadMonitorImpl.java b/server/src/main/java/com/cloud/storage/upload/UploadMonitorImpl.java
index 7962d9dced9c..a32790c135d2 100644
--- a/server/src/main/java/com/cloud/storage/upload/UploadMonitorImpl.java
+++ b/server/src/main/java/com/cloud/storage/upload/UploadMonitorImpl.java
@@ -231,8 +231,8 @@ public UploadVO createEntityDownloadURL(VMTemplateVO template, TemplateDataStore
             UploadVO upload = extractURLList.get(0);
             String uploadUrl = extractURLList.get(0).getUploadUrl();
             String[] token = uploadUrl.split("/");
-            // example: uploadUrl = https://10-11-101-112.realhostip.com/userdata/2fdd9a70-9c4a-4a04-b1d5-1e41c221a1f9.iso
-            // then token[2] = 10-11-101-112.realhostip.com, token[4] = 2fdd9a70-9c4a-4a04-b1d5-1e41c221a1f9.iso
+            // example: uploadUrl = https://10-11-101-112.example.com/userdata/2fdd9a70-9c4a-4a04-b1d5-1e41c221a1f9.iso
+            // then token[2] = 10-11-101-112.example.com, token[4] = 2fdd9a70-9c4a-4a04-b1d5-1e41c221a1f9.iso
             String hostname = ep.getPublicAddr().replace(".", "-") + ".";
             if ((token != null) && (token.length == 5) && (token[2].equals(hostname + _ssvmUrlDomain))) // ssvm publicip and domain suffix not changed
                 return extractURLList.get(0);
@@ -365,7 +365,9 @@ private String generateCopyUrl(String ipAddress, String uuid) {
             if (_ssvmUrlDomain != null && _ssvmUrlDomain.length() > 0) {
                 hostname = hostname + "." + _ssvmUrlDomain;
             } else {
-                hostname = hostname + ".realhostip.com";
+                logger.warn("SSL copy is enabled but secstorage.ssl.cert.domain is not configured; "
+                    + "using IP address directly. Configure a wildcard SSL certificate domain for proper HTTPS support.");
+                hostname = ipAddress;
             }
         }
         return scheme + "://" + hostname + "/userdata/" + uuid;
@@ -376,11 +378,6 @@ public boolean configure(String name, Map<String, Object> params) throws Configu
         final Map<String, String> configs = _configDao.getConfiguration("management-server", params);
         _sslCopy = Boolean.parseBoolean(configs.get("secstorage.encrypt.copy"));
 
-        String cert = configs.get("secstorage.secure.copy.cert");
-        if ("realhostip.com".equalsIgnoreCase(cert)) {
-            logger.warn("Only realhostip.com ssl cert is supported, ignoring self-signed and other certs");
-        }
-
         _ssvmUrlDomain = configs.get("secstorage.ssl.cert.domain");
 
         _agentMgr.registerForHostEvents(new UploadListener(this), true, false, false);
diff --git a/server/src/test/java/com/cloud/keystore/KeystoreTest.java b/server/src/test/java/com/cloud/keystore/KeystoreTest.java
index 970892dc325e..2b991d4a4f7c 100644
--- a/server/src/test/java/com/cloud/keystore/KeystoreTest.java
+++ b/server/src/test/java/com/cloud/keystore/KeystoreTest.java
@@ -75,20 +75,20 @@ public void testKeystoreSave() throws Exception {
             ComponentLocator locator = ComponentLocator.getCurrentLocator();
 
             KeystoreDao ksDao = locator.getDao(KeystoreDao.class);
-            ksDao.save("CPVMCertificate", "CPVMCertificate", "KeyForCertificate", "realhostip.com");
+            ksDao.save("CPVMCertificate", "CPVMCertificate", "KeyForCertificate", "example.com");
             ksVo = ksDao.findByName("CPVMCertificate");
             assertTrue(ksVo != null);
             assertTrue(ksVo.getCertificate().equals("CPVMCertificate"));
             assertTrue(ksVo.getKey().equals("KeyForCertificate"));
-            assertTrue(ksVo.getDomainSuffix().equals("realhostip.com"));
+            assertTrue(ksVo.getDomainSuffix().equals("example.com"));
 
-            ksDao.save("CPVMCertificate", "CPVMCertificate Again", "KeyForCertificate Again", "again.realhostip.com");
+            ksDao.save("CPVMCertificate", "CPVMCertificate Again", "KeyForCertificate Again", "again.example.com");
 
             ksVo = ksDao.findByName("CPVMCertificate");
             assertTrue(ksVo != null);
             assertTrue(ksVo.getCertificate().equals("CPVMCertificate Again"));
             assertTrue(ksVo.getKey().equals("KeyForCertificate Again"));
-            assertTrue(ksVo.getDomainSuffix().equals("again.realhostip.com"));
+            assertTrue(ksVo.getDomainSuffix().equals("again.example.com"));
 
             ksDao.expunge(ksVo.getId());
         }
@@ -112,9 +112,9 @@ public void testKeystoreManager() throws Exception {
             assertTrue(ksMgr.configure("TaskManager", new HashMap<String, Object>()));
             assertTrue(ksMgr.start());
 
-            ksMgr.saveCertificate("CPVMCertificate", certContent, keyContent, "realhostip.com");
+            ksMgr.saveCertificate("CPVMCertificate", certContent, keyContent, "example.com");
 
-            byte[] ksBits = ksMgr.getKeystoreBits("CPVMCertificate", "realhostip", "vmops.com");
+            byte[] ksBits = ksMgr.getKeystoreBits("CPVMCertificate", "example", "vmops.com");
             assertTrue(ksBits != null);
 
             try {
diff --git a/services/console-proxy/server/pom.xml b/services/console-proxy/server/pom.xml
index 3f5b9db68c2e..6e18a13bc57b 100644
--- a/services/console-proxy/server/pom.xml
+++ b/services/console-proxy/server/pom.xml
@@ -80,7 +80,7 @@
             <resource>
                 <directory>certs</directory>
                 <excludes>
-                    <exclude>realhostip.csr</exclude>
+                    <exclude>systemvm.csr</exclude>
                 </excludes>
             </resource>
         </resources>
diff --git a/services/secondary-storage/server/pom.xml b/services/secondary-storage/server/pom.xml
index e6aec8a42f70..ca26bf2bbbe9 100644
--- a/services/secondary-storage/server/pom.xml
+++ b/services/secondary-storage/server/pom.xml
@@ -107,7 +107,7 @@
                     <systemProperties>
                         <systemProperty>
                             <key>javax.net.ssl.trustStore</key>
-                            <value>certs/realhostip.keystore</value>
+                            <value>certs/systemvm.keystore</value>
                             <key>log.home</key>
                             <value>${PWD}/</value>
                         </systemProperty>
diff --git a/systemvm/agent/certs/realhostip.crt b/systemvm/agent/certs/systemvm.crt
similarity index 100%
rename from systemvm/agent/certs/realhostip.crt
rename to systemvm/agent/certs/systemvm.crt
diff --git a/systemvm/agent/certs/realhostip.csr b/systemvm/agent/certs/systemvm.csr
similarity index 100%
rename from systemvm/agent/certs/realhostip.csr
rename to systemvm/agent/certs/systemvm.csr
diff --git a/systemvm/agent/certs/realhostip.key b/systemvm/agent/certs/systemvm.key
similarity index 100%
rename from systemvm/agent/certs/realhostip.key
rename to systemvm/agent/certs/systemvm.key
diff --git a/systemvm/agent/certs/realhostip.keystore b/systemvm/agent/certs/systemvm.keystore
similarity index 100%
rename from systemvm/agent/certs/realhostip.keystore
rename to systemvm/agent/certs/systemvm.keystore
diff --git a/systemvm/agent/scripts/_run.sh b/systemvm/agent/scripts/_run.sh
index 11158ecf5bd1..bb024f71c08b 100755
--- a/systemvm/agent/scripts/_run.sh
+++ b/systemvm/agent/scripts/_run.sh
@@ -60,4 +60,4 @@ if [ "$(uname -m | grep '64')" == "" ]; then
   fi
 fi
 
-java -Djavax.net.ssl.trustStore=./certs/realhostip.keystore -Djdk.tls.ephemeralDHKeySize=2048 -Dlog.home=$LOGHOME -mx${maxmem}m -cp $CP com.cloud.agent.AgentShell $keyvalues $@
+java -Djavax.net.ssl.trustStore=./certs/systemvm.keystore -Djdk.tls.ephemeralDHKeySize=2048 -Dlog.home=$LOGHOME -mx${maxmem}m -cp $CP com.cloud.agent.AgentShell $keyvalues $@
diff --git a/systemvm/agent/scripts/config_ssl.sh b/systemvm/agent/scripts/config_ssl.sh
index e9340b099f62..3968b2617f21 100755
--- a/systemvm/agent/scripts/config_ssl.sh
+++ b/systemvm/agent/scripts/config_ssl.sh
@@ -52,13 +52,13 @@ cflag=
 cpkflag=
 cpcflag=
 cccflag=
-customPrivKey=$(dirname $0)/certs/realhostip.key
-customPrivCert=$(dirname $0)/certs/realhostip.crt
+customPrivKey=$(dirname $0)/certs/systemvm.key
+customPrivCert=$(dirname $0)/certs/systemvm.crt
 customCertChain=
 customCACert=
 publicIp=
 hostName=
-keyStore=$(dirname $0)/certs/realhostip.keystore
+keyStore=$(dirname $0)/certs/systemvm.keystore
 defaultJavaKeyStoreFile=/etc/ssl/certs/java/cacerts
 defaultJavaKeyStorePass="changeit"
 aliasName="CPVMCertificate"
diff --git a/systemvm/debian/opt/cloud/bin/setup/bootstrap.sh b/systemvm/debian/opt/cloud/bin/setup/bootstrap.sh
index f7c071c8cc0e..c601f6ad2210 100755
--- a/systemvm/debian/opt/cloud/bin/setup/bootstrap.sh
+++ b/systemvm/debian/opt/cloud/bin/setup/bootstrap.sh
@@ -65,7 +65,7 @@ patch_systemvm() {
   fi
   rm -fr $backupfolder
   # Import global cacerts into 'cloud' service's keystore
-  keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts -destkeystore /usr/local/cloud/systemvm/certs/realhostip.keystore -srcstorepass changeit -deststorepass vmops.com -noprompt || true
+  keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts -destkeystore /usr/local/cloud/systemvm/certs/systemvm.keystore -srcstorepass changeit -deststorepass vmops.com -noprompt || true
   return 0
 }
 
diff --git a/systemvm/patch-sysvms.sh b/systemvm/patch-sysvms.sh
index 8d96de9ba3b8..e8fa06018ed4 100755
--- a/systemvm/patch-sysvms.sh
+++ b/systemvm/patch-sysvms.sh
@@ -126,25 +126,25 @@ patch_systemvm() {
 
   if [ "$TYPE" = "consoleproxy" ] || [ "$TYPE" = "secstorage" ]; then
     # Import global cacerts into 'cloud' service's keystore
-    REALHOSTIP_KS_FILE="/usr/local/cloud/systemvm/certs/realhostip.keystore"
-    REALHOSTIP_PASS="vmops.com"
+    SYSTEMVM_KS_FILE="/usr/local/cloud/systemvm/certs/systemvm.keystore"
+    SYSTEMVM_PASS="vmops.com"
 
     keytool -importkeystore -srckeystore /etc/ssl/certs/java/cacerts \
-        -destkeystore "$REALHOSTIP_KS_FILE" -srcstorepass changeit -deststorepass \
-        "$REALHOSTIP_PASS" -noprompt 2>/dev/null || true
+        -destkeystore "$SYSTEMVM_KS_FILE" -srcstorepass changeit -deststorepass \
+        "$SYSTEMVM_PASS" -noprompt 2>/dev/null || true
 
-    # Import CA cert(s) into realhostip.keystore so the SSVM JVM
+    # Import CA cert(s) into systemvm.keystore so the SSVM JVM
     # (which overrides the truststore via -Djavax.net.ssl.trustStore in _run.sh)
     # can trust servers signed by the CloudStack CA
     CACERT_FILE="/usr/local/share/ca-certificates/cloudstack/ca.crt"
 
-    if [ -f "$CACERT_FILE" ] && [ -f "$REALHOSTIP_KS_FILE" ]; then
+    if [ -f "$CACERT_FILE" ] && [ -f "$SYSTEMVM_KS_FILE" ]; then
         awk 'BEGIN{n=0} /-----BEGIN CERTIFICATE-----/{n++} n>0{print > "cloudca." n }' "$CACERT_FILE"
         for caChain in $(ls cloudca.* 2>/dev/null); do
-            keytool -delete -noprompt -alias "$caChain" -keystore "$REALHOSTIP_KS_FILE" \
-                -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1 || true
+            keytool -delete -noprompt -alias "$caChain" -keystore "$SYSTEMVM_KS_FILE" \
+                -storepass "$SYSTEMVM_PASS" > /dev/null 2>&1 || true
             keytool -import -noprompt -trustcacerts -alias "$caChain" -file "$caChain" \
-                -keystore "$REALHOSTIP_KS_FILE" -storepass "$REALHOSTIP_PASS" > /dev/null 2>&1
+                -keystore "$SYSTEMVM_KS_FILE" -storepass "$SYSTEMVM_PASS" > /dev/null 2>&1
         done
         rm -f cloudca.*
     fi
diff --git a/systemvm/pom.xml b/systemvm/pom.xml
index 9bffc45cf4eb..ca9176ee85f9 100644
--- a/systemvm/pom.xml
+++ b/systemvm/pom.xml
@@ -205,7 +205,7 @@
                             <systemProperties>
                                 <systemProperty>
                                     <key>javax.net.ssl.trustStore</key>
-                                    <value>certs/realhostip.keystore</value>
+                                    <value>certs/systemvm.keystore</value>
                                     <key>log.home</key>
                                     <value>${PWD}/</value>
                                 </systemProperty>
diff --git a/utils/src/test/java/org/apache/cloudstack/utils/imagestore/ImageStoreUtilTest.java b/utils/src/test/java/org/apache/cloudstack/utils/imagestore/ImageStoreUtilTest.java
index b7df14dc85d0..e50eefd466bf 100644
--- a/utils/src/test/java/org/apache/cloudstack/utils/imagestore/ImageStoreUtilTest.java
+++ b/utils/src/test/java/org/apache/cloudstack/utils/imagestore/ImageStoreUtilTest.java
@@ -27,7 +27,7 @@ public class ImageStoreUtilTest {
 
     @Test
     public void testgenerateHttpsPostUploadUrl() throws MalformedURLException {
-        String ssvmdomain = "*.realhostip.com";
+        String ssvmdomain = "*.example.com";
         String ipAddress = "10.147.28.14";
         String uuid = UUID.randomUUID().toString();
         String protocol = "https";
@@ -47,7 +47,7 @@ public void testgenerateHttpsPostUploadUrl() throws MalformedURLException {
 
     @Test
     public void testgenerateHttpPostUploadUrl() throws MalformedURLException {
-        String ssvmdomain = "*.realhostip.com";
+        String ssvmdomain = "*.example.com";
         String ipAddress = "10.147.28.14";
         String uuid = UUID.randomUUID().toString();
         String protocol = "http";

From b0601e5478624f8d6c42c70125449d9b1a9401ba Mon Sep 17 00:00:00 2001
From: Vishesh <8760112+vishesh92@users.noreply.github.com>
Date: Thu, 11 Jun 2026 11:59:31 +0530
Subject: [PATCH 61/64] Fix issue triage github action (#13312)

---
 .../.github_workflows_shared_noop-reminder.md |  5 ++
 .../.github_workflows_shared_reporting.md     | 73 -------------------
 .github/workflows/issue-triage-agent.lock.yml | 29 ++++----
 .github/workflows/issue-triage-agent.md       |  3 +-
 4 files changed, 21 insertions(+), 89 deletions(-)
 create mode 100644 .github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_noop-reminder.md
 delete mode 100644 .github/aw/imports/github/gh-aw/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github_workflows_shared_reporting.md

diff --git a/.github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_noop-reminder.md b/.github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_noop-reminder.md
new file mode 100644
index 000000000000..77cca08c1bec
--- /dev/null
+++ b/.github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_noop-reminder.md
@@ -0,0 +1,5 @@
+**Important**: If no action is needed after completing your analysis, you **MUST** call the `noop` safe-output tool with a brief explanation. Failing to call any safe-output tool is the most common cause of safe-output workflow failures.
+
+```json
+{"noop": {"message": "No action needed: [brief explanation of what was analyzed and why]"}}
+```
diff --git a/.github/aw/imports/github/gh-aw/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github_workflows_shared_reporting.md b/.github/aw/imports/github/gh-aw/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github_workflows_shared_reporting.md
deleted file mode 100644
index bc08afb42be9..000000000000
--- a/.github/aw/imports/github/gh-aw/94662b1dee8ce96c876ba9f33b3ab8be32de82a4/.github_workflows_shared_reporting.md
+++ /dev/null
@@ -1,73 +0,0 @@
----
-# Report formatting guidelines
----
-
-## Report Structure Guidelines
-
-### 1. Header Levels
-**Use h3 (###) or lower for all headers in your issue report to maintain proper document hierarchy.**
-
-When creating GitHub issues or discussions:
-- Use `###` (h3) for main sections (e.g., "### Test Summary")
-- Use `####` (h4) for subsections (e.g., "#### Device-Specific Results")
-- Never use `##` (h2) or `#` (h1) in reports - these are reserved for titles
-
-### 2. Progressive Disclosure
-**Wrap detailed test results in `<details><summary><b>Section Name</b></summary>` tags to improve readability and reduce scrolling.**
-
-Use collapsible sections for:
-- Verbose details (full test logs, raw data)
-- Secondary information (minor warnings, extra context)
-- Per-item breakdowns when there are many items
-
-Always keep critical information visible (summary, critical issues, key metrics).
-
-### 3. Report Structure Pattern
-
-1. **Overview**: 1-2 paragraphs summarizing key findings
-2. **Critical Information**: Show immediately (summary stats, critical issues)
-3. **Details**: Use `<details><summary><b>Section Name</b></summary>` for expanded content
-4. **Context**: Add helpful metadata (workflow run, date, trigger)
-
-### Design Principles (Airbnb-Inspired)
-
-Reports should:
-- **Build trust through clarity**: Most important info immediately visible
-- **Exceed expectations**: Add helpful context like trends, comparisons
-- **Create delight**: Use progressive disclosure to reduce overwhelm
-- **Maintain consistency**: Follow patterns across all reports
-
-### Example Report Structure
-
-```markdown
-### Summary
-- Key metric 1: value
-- Key metric 2: value
-- Status: ✅/⚠️/❌
-
-### Critical Issues
-[Always visible - these are important]
-
-<details>
-<summary><b>View Detailed Results</b></summary>
-
-[Comprehensive details, logs, traces]
-
-</details>
-
-<details>
-<summary><b>View All Warnings</b></summary>
-
-[Minor issues and potential problems]
-
-</details>
-
-### Recommendations
-[Actionable next steps - keep visible]
-```
-
-## Workflow Run References
-
-- Format run IDs as links: `[§12345](https://github.com/owner/repo/actions/runs/12345)`
-- Include up to 3 most relevant run URLs at end under `**References:**`
-- Do NOT add footer attribution (system adds automatically)
diff --git a/.github/workflows/issue-triage-agent.lock.yml b/.github/workflows/issue-triage-agent.lock.yml
index 3acf91dcc1ef..94abbb0908cc 100644
--- a/.github/workflows/issue-triage-agent.lock.yml
+++ b/.github/workflows/issue-triage-agent.lock.yml
@@ -1,4 +1,4 @@
-# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"3cfe810a6f1f402ae902098f1dc14b99a4281a5986d58b76e96eec1a2fde7646","compiler_version":"v0.76.1","strict":true,"agent_id":"copilot"}
+# gh-aw-metadata: {"schema_version":"v3","frontmatter_hash":"d4b8988df7c60cd416200769cc6bc7f1aab5bb3128df0b9a83a35e061b4da111","compiler_version":"v0.76.1","strict":true,"agent_id":"copilot"}
 # gh-aw-manifest: {"version":1,"secrets":["COPILOT_GITHUB_TOKEN","GH_AW_GITHUB_MCP_SERVER_TOKEN","GH_AW_GITHUB_TOKEN","GITHUB_TOKEN"],"actions":[{"repo":"actions/checkout","sha":"de0fac2e4500dabe0009e67214ff5f5447ce83dd","version":"v6.0.2"},{"repo":"actions/download-artifact","sha":"3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c","version":"v8.0.1"},{"repo":"actions/github-script","sha":"3a2844b7e9c422d3c10d287c895573f7108da1b3","version":"v9.0.0"},{"repo":"actions/setup-node","sha":"48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e","version":"v6.4.0"},{"repo":"actions/upload-artifact","sha":"043fb46d1a93c77aae656e7c1c64a875d1fc6a0a","version":"v7.0.1"},{"repo":"github/gh-aw-actions/setup","sha":"46d564922b082d0db93244972e8005ea6904ee5f","version":"v0.76.1"}],"containers":[{"image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55","digest":"sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731","pinned_image":"ghcr.io/github/gh-aw-firewall/agent:0.25.55@sha256:138c363411decc9a61a5af9b95e8d64c76648b00add0ba06fc7ba786f0e72731"},{"image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55","digest":"sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3","pinned_image":"ghcr.io/github/gh-aw-firewall/api-proxy:0.25.55@sha256:4142b873b678cd3279b98dcbe464857d56ea2f2348719b00379cdf35dd843ff3"},{"image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55","digest":"sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca","pinned_image":"ghcr.io/github/gh-aw-firewall/squid:0.25.55@sha256:74084b704d8d3664a363655986664d70bd9cdb4830532d0b35cd784d867aabca"},{"image":"ghcr.io/github/gh-aw-mcpg:v0.3.19","digest":"sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f","pinned_image":"ghcr.io/github/gh-aw-mcpg:v0.3.19@sha256:a6c890d7c24d7190c9ef97b9c954cc4cffaae6b01c371ced1f959f1370b1f68f"},{"image":"ghcr.io/github/github-mcp-server:v1.0.4","digest":"sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4","pinned_image":"ghcr.io/github/github-mcp-server:v1.0.4@sha256:e3816a476a977cfb836e7d221510011436c654d11861db66ecfd826601aba6a4"},{"image":"node:lts-alpine","digest":"sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14","pinned_image":"node:lts-alpine@sha256:2bdb65ed1dab192432bc31c95f94155ca5ad7fc1392fb7eb7526ab682fa5bf14"}]}
 #    ___                   _   _
 #   / _ \                 | | (_)
@@ -27,6 +27,7 @@
 #
 # Resolved workflow manifest:
 #   Imports:
+#     - github/gh-aw/.github/workflows/shared/noop-reminder.md@359795d49ada21681ab616bd4cbcb144a7387115
 #     - github/gh-aw/.github/workflows/shared/reporting.md@359795d49ada21681ab616bd4cbcb144a7387115
 #
 # Secrets used:
@@ -197,20 +198,20 @@ jobs:
         run: |
           bash "${RUNNER_TEMP}/gh-aw/actions/create_prompt_first.sh"
           {
-          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          cat << 'GH_AW_PROMPT_e560c36b9148ef78_EOF'
           <system>
-          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          GH_AW_PROMPT_e560c36b9148ef78_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/xpia.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/temp_folder_prompt.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/markdown.md"
           cat "${RUNNER_TEMP}/gh-aw/prompts/safe_outputs_prompt.md"
-          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          cat << 'GH_AW_PROMPT_e560c36b9148ef78_EOF'
           <safe-output-tools>
           Tools: add_comment, add_labels, missing_tool, missing_data, noop
           </safe-output-tools>
-          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          GH_AW_PROMPT_e560c36b9148ef78_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/mcp_cli_tools_prompt.md"
-          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          cat << 'GH_AW_PROMPT_e560c36b9148ef78_EOF'
           <github-context>
           The following GitHub context information is available for this workflow:
           {{#if github.actor}}
@@ -239,14 +240,14 @@ jobs:
           {{/if}}
           </github-context>
 
-          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          GH_AW_PROMPT_e560c36b9148ef78_EOF
           cat "${RUNNER_TEMP}/gh-aw/prompts/github_mcp_tools_with_safeoutputs_prompt.md"
-          cat << 'GH_AW_PROMPT_9a8f42497f411c95_EOF'
+          cat << 'GH_AW_PROMPT_e560c36b9148ef78_EOF'
           </system>
           {{#runtime-import .github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_reporting.md}}
-          {{#runtime-import .github/workflows/shared/noop-reminder.md}}
+          {{#runtime-import .github/aw/imports/github/gh-aw/359795d49ada21681ab616bd4cbcb144a7387115/.github_workflows_shared_noop-reminder.md}}
           {{#runtime-import .github/workflows/issue-triage-agent.md}}
-          GH_AW_PROMPT_9a8f42497f411c95_EOF
+          GH_AW_PROMPT_e560c36b9148ef78_EOF
           } > "$GH_AW_PROMPT"
       - name: Interpolate variables and render templates
         uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
@@ -435,9 +436,9 @@ jobs:
           mkdir -p "${RUNNER_TEMP}/gh-aw/safeoutputs"
           mkdir -p /tmp/gh-aw/safeoutputs
           mkdir -p /tmp/gh-aw/mcp-logs/safeoutputs
-          cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_40bb017992a44aa9_EOF'
+          cat > "${RUNNER_TEMP}/gh-aw/safeoutputs/config.json" << 'GH_AW_SAFE_OUTPUTS_CONFIG_c8eaf0ada4607ff7_EOF'
           {"add_comment":{"max":1},"add_labels":{"allowed":["bug","feature","enhancement","documentation","question","help-wanted","good-first-issue"]},"create_report_incomplete_issue":{},"missing_data":{},"missing_tool":{},"noop":{"max":1,"report-as-issue":"true"},"report_incomplete":{}}
-          GH_AW_SAFE_OUTPUTS_CONFIG_40bb017992a44aa9_EOF
+          GH_AW_SAFE_OUTPUTS_CONFIG_c8eaf0ada4607ff7_EOF
       - name: Generate Safe Outputs Tools
         env:
           GH_AW_TOOLS_META_JSON: |
@@ -653,7 +654,7 @@ jobs:
 
           mkdir -p /home/runner/.copilot
           GH_AW_NODE=$(which node 2>/dev/null || command -v node 2>/dev/null || echo node)
-          cat << GH_AW_MCP_CONFIG_8874a73d1c6a94b7_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
+          cat << GH_AW_MCP_CONFIG_88b8311e90d25032_EOF | "$GH_AW_NODE" "${RUNNER_TEMP}/gh-aw/actions/start_mcp_gateway.cjs"
           {
             "mcpServers": {
               "github": {
@@ -694,7 +695,7 @@ jobs:
               "payloadDir": "${MCP_GATEWAY_PAYLOAD_DIR}"
             }
           }
-          GH_AW_MCP_CONFIG_8874a73d1c6a94b7_EOF
+          GH_AW_MCP_CONFIG_88b8311e90d25032_EOF
       - name: Mount MCP servers as CLIs
         id: mount-mcp-clis
         continue-on-error: true
diff --git a/.github/workflows/issue-triage-agent.md b/.github/workflows/issue-triage-agent.md
index 26c43644618c..2d382f9117c4 100644
--- a/.github/workflows/issue-triage-agent.md
+++ b/.github/workflows/issue-triage-agent.md
@@ -6,6 +6,7 @@ permissions:
   issues: read
 imports:
 - github/gh-aw/.github/workflows/shared/reporting.md@359795d49ada21681ab616bd4cbcb144a7387115
+- github/gh-aw/.github/workflows/shared/noop-reminder.md@359795d49ada21681ab616bd4cbcb144a7387115
 safe-outputs:
   add-comment: {}
   add-labels:
@@ -88,5 +89,3 @@ This provides both per-issue context and batch visibility.
 - `question`: Used for issues that are asking for clarification or have questions about the project.
 - `help-wanted`: Indicates that the issue is a good candidate for external contributions and help
 - `good-first-issue`: Marks issues that are suitable for newcomers to the project, often with simpler scope.
-
-{{#runtime-import shared/noop-reminder.md}}

From 2fd83e13b1879ba5df18204d595c563fc2b10c33 Mon Sep 17 00:00:00 2001
From: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
Date: Fri, 12 Jun 2026 08:16:10 -0300
Subject: [PATCH 62/64] Introduce Quota resource statement API (#13236)

---
 .../apache/cloudstack/api/ApiConstants.java   |   4 +
 .../META-INF/db/schema-42210to42300.sql       |   6 +
 .../cloudstack/quota/QuotaManagerImpl.java    |  91 +++++--
 .../cloudstack/quota/constant/QuotaTypes.java |  90 ++++---
 .../quota/dao/QuotaUsageJoinDao.java          |   2 +-
 .../quota/dao/QuotaUsageJoinDaoImpl.java      |   8 +-
 .../quota/QuotaManagerImplTest.java           |  73 +++++-
 .../command/QuotaResourceStatementCmd.java    | 118 +++++++++
 .../api/command/QuotaStatementCmd.java        |  15 +-
 .../QuotaResourceStatementItemResponse.java   |  82 ++++++
 .../QuotaResourceStatementResponse.java       |  66 +++++
 .../api/response/QuotaResponseBuilder.java    |   3 +
 .../response/QuotaResponseBuilderImpl.java    | 241 ++++++++++++++----
 .../api/response/QuotaStatementResponse.java  |   4 +-
 .../apache/cloudstack/quota/QuotaService.java |   2 +-
 .../cloudstack/quota/QuotaServiceImpl.java    |  10 +-
 .../QuotaResponseBuilderImplTest.java         | 182 ++++++++-----
 .../quota/QuotaServiceImplTest.java           |   6 +-
 18 files changed, 805 insertions(+), 198 deletions(-)
 create mode 100644 plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaResourceStatementCmd.java
 create mode 100644 plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementItemResponse.java
 create mode 100644 plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementResponse.java

diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index ee10db031ba7..c5671d22d07b 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -602,6 +602,8 @@ public class ApiConstants {
     public static final String SUITABLE_FOR_VM = "suitableforvirtualmachine";
     public static final String SUPPORTS_STORAGE_SNAPSHOT = "supportsstoragesnapshot";
     public static final String TARGET_IQN = "targetiqn";
+    public static final String TARIFF_ID = "tariffid";
+    public static final String TARIFF_NAME = "tariffname";
     public static final String TASKS_FILTER = "tasksfilter";
     public static final String TEMPLATE_FILTER = "templatefilter";
     public static final String TEMPLATE_ID = "templateid";
@@ -663,6 +665,7 @@ public class ApiConstants {
     public static final String VIRTUAL_MACHINE_STATE = "vmstate";
     public static final String VIRTUAL_MACHINES = "virtualmachines";
     public static final String USAGE_ID = "usageid";
+    public static final String USAGE_NAME = "usagename";
     public static final String USAGE_TYPE = "usagetype";
     public static final String INCLUDE_TAGS = "includetags";
 
@@ -879,6 +882,7 @@ public class ApiConstants {
     public static final String IS_SOURCE_NAT = "issourcenat";
     public static final String IS_STATIC_NAT = "isstaticnat";
     public static final String ITERATIONS = "iterations";
+    public static final String ITEMS = "items";
     public static final String SORT_BY = "sortby";
     public static final String CHANGE_CIDR = "changecidr";
     public static final String PURPOSE = "purpose";
diff --git a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
index d999cbcd5093..2d25b3355d8e 100644
--- a/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
+++ b/engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
@@ -202,3 +202,9 @@ CREATE TABLE IF NOT EXISTS `cloud`.`image_transfer`(
     CONSTRAINT `fk_image_transfer__host_id` FOREIGN KEY (`host_id`) REFERENCES `host`(`id`) ON DELETE CASCADE,
     INDEX `i_image_transfer__backup_id`(`backup_id`)
     ) ENGINE=InnoDB DEFAULT CHARSET=utf8;
+
+--- Quota resource statement
+INSERT INTO cloud.role_permissions (uuid, role_id, rule, permission, sort_order)
+SELECT uuid(), role_id, 'quotaResourceStatement', permission, sort_order
+FROM cloud.role_permissions rp
+WHERE rule = 'quotaStatement' AND NOT EXISTS(SELECT 1 FROM cloud.role_permissions rp_ WHERE rp.role_id = rp_.role_id AND rp_.rule = 'quotaResourceStatement');
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
index 58f51eae9fcd..20bc0b015bb1 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
@@ -23,6 +23,7 @@
 import java.util.Comparator;
 import java.util.Date;
 import java.util.HashMap;
+import java.util.LinkedHashMap;
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
@@ -32,6 +33,9 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.utils.db.Transaction;
+import com.cloud.utils.db.TransactionCallback;
+import com.cloud.utils.db.TransactionLegacy;
 import org.apache.cloudstack.framework.config.dao.ConfigurationDao;
 import org.apache.cloudstack.quota.activationrule.presetvariables.Configuration;
 import org.apache.cloudstack.quota.activationrule.presetvariables.GenericPresetVariable;
@@ -43,9 +47,11 @@
 import org.apache.cloudstack.quota.dao.QuotaAccountDao;
 import org.apache.cloudstack.quota.dao.QuotaBalanceDao;
 import org.apache.cloudstack.quota.dao.QuotaTariffDao;
+import org.apache.cloudstack.quota.dao.QuotaTariffUsageDao;
 import org.apache.cloudstack.quota.dao.QuotaUsageDao;
 import org.apache.cloudstack.quota.vo.QuotaAccountVO;
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
+import org.apache.cloudstack.quota.vo.QuotaTariffUsageVO;
 import org.apache.cloudstack.quota.vo.QuotaTariffVO;
 import org.apache.cloudstack.quota.vo.QuotaUsageVO;
 import org.apache.cloudstack.usage.UsageUnitTypes;
@@ -86,7 +92,8 @@ public class QuotaManagerImpl extends ManagerBase implements QuotaManager {
     private QuotaBalanceDao _quotaBalanceDao;
     @Inject
     private ConfigurationDao _configDao;
-
+    @Inject
+    private QuotaTariffUsageDao quotaTariffUsageDao;
     @Inject
     protected PresetVariableHelper presetVariableHelper;
 
@@ -311,14 +318,14 @@ protected List<QuotaUsageVO> createQuotaUsagesAccordingToQuotaTariffs(AccountVO
         String accountToString = account.reflectionToString();
         logger.info("Calculating quota usage of [{}] usage records for account [{}].", usageRecords.size(), accountToString);
 
-        List<Pair<UsageVO, QuotaUsageVO>> pairsUsageAndQuotaUsage = new ArrayList<>();
+        Map<UsageVO, Pair<QuotaUsageVO, List<QuotaTariffUsageVO>>> mapUsageAndQuotaUsage = new LinkedHashMap<>();
 
         try (JsInterpreter jsInterpreter = new JsInterpreter(QuotaConfig.QuotaActivationRuleTimeout.value())) {
             for (UsageVO usageRecord : usageRecords) {
                 int usageType = usageRecord.getUsageType();
 
                 if (!shouldCalculateUsageRecord(account, usageRecord)) {
-                    pairsUsageAndQuotaUsage.add(new Pair<>(usageRecord, null));
+                    mapUsageAndQuotaUsage.put(usageRecord, null);
                     continue;
                 }
 
@@ -326,18 +333,31 @@ protected List<QuotaUsageVO> createQuotaUsagesAccordingToQuotaTariffs(AccountVO
                 List<QuotaTariffVO> quotaTariffs = pairQuotaTariffsPerUsageTypeAndHasActivationRule.first();
                 boolean hasAnyQuotaTariffWithActivationRule = pairQuotaTariffsPerUsageTypeAndHasActivationRule.second();
 
-                BigDecimal aggregatedQuotaTariffsValue = aggregateQuotaTariffsValues(usageRecord, quotaTariffs, hasAnyQuotaTariffWithActivationRule, jsInterpreter, accountToString);
+                Map<QuotaTariffVO, BigDecimal> aggregatedQuotaTariffsAndValues = aggregateQuotaTariffsValues(usageRecord,
+                        quotaTariffs, hasAnyQuotaTariffWithActivationRule, jsInterpreter, accountToString);
+                BigDecimal aggregatedQuotaTariffsValue = aggregatedQuotaTariffsAndValues.values().stream().reduce(BigDecimal.ZERO, BigDecimal::add);
+                logger.debug("The aggregation of the quota tariffs of account [{}] resulted in [{}] for the usage record [{}].",
+                        account, aggregatedQuotaTariffsValue, usageRecord);
 
                 QuotaUsageVO quotaUsage = createQuotaUsageAccordingToUsageUnit(usageRecord, aggregatedQuotaTariffsValue, accountToString);
+                if (quotaUsage == null) {
+                    mapUsageAndQuotaUsage.put(usageRecord, null);
+                    continue;
+                }
 
-                pairsUsageAndQuotaUsage.add(new Pair<>(usageRecord, quotaUsage));
+                List<QuotaTariffUsageVO> quotaTariffUsages = new ArrayList<>();
+                for (Map.Entry<QuotaTariffVO, BigDecimal> entry : aggregatedQuotaTariffsAndValues.entrySet()) {
+                    QuotaTariffUsageVO quotaTariffUsage = createQuotaTariffUsage(usageRecord, entry.getKey(), entry.getValue());
+                    quotaTariffUsages.add(quotaTariffUsage);
+                }
+                mapUsageAndQuotaUsage.put(usageRecord, new Pair<>(quotaUsage, quotaTariffUsages));
             }
         } catch (Exception e) {
             logger.error(String.format("Failed to calculate the quota usage for account [%s] due to [%s].", accountToString, e.getMessage()), e);
             return new ArrayList<>();
         }
 
-        return persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(pairsUsageAndQuotaUsage);
+        return Transaction.execute(TransactionLegacy.USAGE_DB, (TransactionCallback<List<QuotaUsageVO>>) status -> persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(mapUsageAndQuotaUsage));
     }
 
     protected boolean shouldCalculateUsageRecord(AccountVO accountVO, UsageVO usageRecord) {
@@ -349,31 +369,41 @@ protected boolean shouldCalculateUsageRecord(AccountVO accountVO, UsageVO usageR
         return true;
     }
 
-    protected List<QuotaUsageVO> persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(List<Pair<UsageVO, QuotaUsageVO>> pairsUsageAndQuotaUsage) {
+    protected List<QuotaUsageVO> persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(Map<UsageVO, Pair<QuotaUsageVO, List<QuotaTariffUsageVO>>> mapUsageAndQuotaTariffUsage) {
         List<QuotaUsageVO> quotaUsages = new ArrayList<>();
 
-        for (Pair<UsageVO, QuotaUsageVO> pairUsageAndQuotaUsage : pairsUsageAndQuotaUsage) {
-            UsageVO usageVo = pairUsageAndQuotaUsage.first();
+        for (Map.Entry<UsageVO, Pair<QuotaUsageVO, List<QuotaTariffUsageVO>>> usageAndTariffUsage : mapUsageAndQuotaTariffUsage.entrySet()) {
+            UsageVO usageVo = usageAndTariffUsage.getKey();
             usageVo.setQuotaCalculated(1);
             _usageDao.persistUsage(usageVo);
 
-            QuotaUsageVO quotaUsageVo = pairUsageAndQuotaUsage.second();
-            if (quotaUsageVo != null) {
-                _quotaUsageDao.persistQuotaUsage(quotaUsageVo);
-                quotaUsages.add(quotaUsageVo);
+            Pair<QuotaUsageVO, List<QuotaTariffUsageVO>> pairUsageAndTariffUsages = usageAndTariffUsage.getValue();
+            if (pairUsageAndTariffUsages != null) {
+                QuotaUsageVO quotaUsage = pairUsageAndTariffUsages.first();
+                _quotaUsageDao.persistQuotaUsage(quotaUsage);
+                quotaUsages.add(quotaUsage);
+
+                persistQuotaTariffUsages(pairUsageAndTariffUsages.second(), quotaUsage.getId());
             }
         }
 
         return quotaUsages;
     }
 
-    protected BigDecimal aggregateQuotaTariffsValues(UsageVO usageRecord, List<QuotaTariffVO> quotaTariffs, boolean hasAnyQuotaTariffWithActivationRule,
-            JsInterpreter jsInterpreter, String accountToString) {
+    protected void persistQuotaTariffUsages(List<QuotaTariffUsageVO> quotaTariffUsages, Long quotaUsageId) {
+        for (QuotaTariffUsageVO quotaTariffUsage : quotaTariffUsages) {
+            quotaTariffUsage.setQuotaUsageId(quotaUsageId);
+            quotaTariffUsageDao.persistQuotaTariffUsage(quotaTariffUsage);
+        }
+    }
+
+    protected Map<QuotaTariffVO, BigDecimal> aggregateQuotaTariffsValues(UsageVO usageRecord, List<QuotaTariffVO> quotaTariffs, boolean hasAnyQuotaTariffWithActivationRule,
+                                                                         JsInterpreter jsInterpreter, String accountToString) {
         String usageRecordToString = usageRecord.toString(usageAggregationTimeZone);
         logger.debug("Validating usage record [{}] for account [{}] against [{}] quota tariffs.", usageRecordToString, accountToString, quotaTariffs.size());
 
         PresetVariables presetVariables = getPresetVariables(hasAnyQuotaTariffWithActivationRule, usageRecord);
-        BigDecimal aggregatedQuotaTariffsValue = BigDecimal.ZERO;
+        Map<QuotaTariffVO, BigDecimal> aggregatedQuotaTariffsAndValues = new HashMap<>();
 
         quotaTariffs.sort(Comparator.comparing(QuotaTariffVO::getPosition));
 
@@ -382,10 +412,9 @@ protected BigDecimal aggregateQuotaTariffsValues(UsageVO usageRecord, List<Quota
 
         for (QuotaTariffVO quotaTariff : quotaTariffs) {
             if (isQuotaTariffInPeriodToBeApplied(usageRecord, quotaTariff, accountToString)) {
-
                 BigDecimal tariffValue = getQuotaTariffValueToBeApplied(quotaTariff, jsInterpreter, presetVariables, lastTariffs);
 
-                aggregatedQuotaTariffsValue = aggregatedQuotaTariffsValue.add(tariffValue);
+                aggregatedQuotaTariffsAndValues.put(quotaTariff, tariffValue);
 
                 Tariff tariffPresetVariable = new Tariff();
                 tariffPresetVariable.setId(quotaTariff.getUuid());
@@ -394,10 +423,10 @@ protected BigDecimal aggregateQuotaTariffsValues(UsageVO usageRecord, List<Quota
             }
         }
 
-        logger.debug(String.format("The aggregation of the quota tariffs resulted in the value [%s] for the usage record [%s]. We will use this value to calculate the final"
-                + " usage value.", aggregatedQuotaTariffsValue, usageRecordToString));
+        logger.debug("The aggregation of the quota tariffs resulted in [{}] quota tariffs for the usage record [{}]. The values of the quota tariffs will be used"
+                + " to calculate the final usage value.", aggregatedQuotaTariffsAndValues.size(), usageRecordToString);
 
-        return aggregatedQuotaTariffsValue;
+        return aggregatedQuotaTariffsAndValues;
     }
 
     protected PresetVariables getPresetVariables(boolean hasAnyQuotaTariffWithActivationRule, UsageVO usageRecord) {
@@ -408,6 +437,26 @@ protected PresetVariables getPresetVariables(boolean hasAnyQuotaTariffWithActiva
         return null;
     }
 
+    protected QuotaTariffUsageVO createQuotaTariffUsage(UsageVO usageRecord, QuotaTariffVO quotaTariff, BigDecimal quotaTariffValue) {
+        BigDecimal quotaUsageValue = BigDecimal.ZERO;
+
+        if (!quotaTariffValue.equals(BigDecimal.ZERO)) {
+            String quotaUnit = QuotaTypes.getQuotaType(usageRecord.getUsageType()).getQuotaUnit();
+            logger.trace("Calculating the value of the quota tariff [{}] according to its value [{}] and its quota unit [{}].", quotaTariff, quotaTariffValue, quotaUnit);
+            quotaUsageValue = getUsageValueAccordingToUsageUnitType(usageRecord, quotaTariffValue, quotaUnit);
+            logger.debug("The calculation of the value of the quota tariff [{}] according to its value [{}] and its usage unit [{}] resulted in the value [{}].",
+                    quotaTariff, quotaTariffValue, quotaUnit, quotaUsageValue);
+        } else {
+            logger.debug("Quota tariff [{}] has no value to be calculated; therefore, it will be marked as value zero.", quotaTariff);
+        }
+
+        QuotaTariffUsageVO quotaTariffUsage = new QuotaTariffUsageVO();
+        quotaTariffUsage.setTariffId(quotaTariff.getId());
+        quotaTariffUsage.setQuotaUsed(quotaUsageValue);
+
+        return quotaTariffUsage;
+    }
+
     /**
      * Returns the quota tariff value according to the result of the activation rule.<br/>
      * <ul>
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/constant/QuotaTypes.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/constant/QuotaTypes.java
index 0da0d6e53f77..7b725d57c6ef 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/constant/QuotaTypes.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/constant/QuotaTypes.java
@@ -20,11 +20,23 @@
 import java.util.HashMap;
 import java.util.Map;
 
-import com.cloud.utils.exception.CloudRuntimeException;
+import com.cloud.network.IpAddress;
+import com.cloud.network.Network;
+import com.cloud.network.VpnUser;
+import com.cloud.network.rules.LoadBalancer;
+import com.cloud.network.rules.PortForwardingRule;
+import com.cloud.network.security.SecurityGroup;
+import com.cloud.network.vpc.Vpc;
+import com.cloud.offering.NetworkOffering;
+import com.cloud.storage.Snapshot;
+import com.cloud.storage.Volume;
+import com.cloud.template.VirtualMachineTemplate;
+import com.cloud.vm.VirtualMachine;
+import org.apache.cloudstack.backup.BackupOffering;
+import org.apache.cloudstack.storage.object.Bucket;
 import org.apache.cloudstack.usage.UsageTypes;
 import org.apache.cloudstack.usage.UsageUnitTypes;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
-import org.apache.commons.lang3.StringUtils;
 
 public class QuotaTypes extends UsageTypes {
     private final Integer quotaType;
@@ -32,44 +44,46 @@ public class QuotaTypes extends UsageTypes {
     private final String quotaUnit;
     private final String description;
     private final String discriminator;
+    private final Class<?> clazz;
     private final static Map<Integer, QuotaTypes> quotaTypeMap;
 
     static {
         final HashMap<Integer, QuotaTypes> quotaTypeList = new HashMap<Integer, QuotaTypes>();
-        quotaTypeList.put(RUNNING_VM, new QuotaTypes(RUNNING_VM, "RUNNING_VM", UsageUnitTypes.COMPUTE_MONTH.toString(), "Running Vm Usage"));
-        quotaTypeList.put(ALLOCATED_VM, new QuotaTypes(ALLOCATED_VM, "ALLOCATED_VM", UsageUnitTypes.COMPUTE_MONTH.toString(), "Allocated Vm Usage"));
-        quotaTypeList.put(IP_ADDRESS, new QuotaTypes(IP_ADDRESS, "IP_ADDRESS", UsageUnitTypes.IP_MONTH.toString(), "IP Address Usage"));
-        quotaTypeList.put(NETWORK_BYTES_SENT, new QuotaTypes(NETWORK_BYTES_SENT, "NETWORK_BYTES_SENT", UsageUnitTypes.GB.toString(), "Network Usage (Bytes Sent)"));
-        quotaTypeList.put(NETWORK_BYTES_RECEIVED, new QuotaTypes(NETWORK_BYTES_RECEIVED, "NETWORK_BYTES_RECEIVED", UsageUnitTypes.GB.toString(), "Network Usage (Bytes Received)"));
-        quotaTypeList.put(VOLUME, new QuotaTypes(VOLUME, "VOLUME", UsageUnitTypes.GB_MONTH.toString(), "Volume Usage"));
-        quotaTypeList.put(TEMPLATE, new QuotaTypes(TEMPLATE, "TEMPLATE", UsageUnitTypes.GB_MONTH.toString(), "Template Usage"));
-        quotaTypeList.put(ISO, new QuotaTypes(ISO, "ISO", UsageUnitTypes.GB_MONTH.toString(), "ISO Usage"));
-        quotaTypeList.put(SNAPSHOT, new QuotaTypes(SNAPSHOT, "SNAPSHOT", UsageUnitTypes.GB_MONTH.toString(), "Snapshot Usage"));
-        quotaTypeList.put(SECURITY_GROUP, new QuotaTypes(SECURITY_GROUP, "SECURITY_GROUP", UsageUnitTypes.POLICY_MONTH.toString(), "Security Group Usage"));
-        quotaTypeList.put(LOAD_BALANCER_POLICY, new QuotaTypes(LOAD_BALANCER_POLICY, "LOAD_BALANCER_POLICY", UsageUnitTypes.POLICY_MONTH.toString(), "Load Balancer Usage"));
-        quotaTypeList.put(PORT_FORWARDING_RULE, new QuotaTypes(PORT_FORWARDING_RULE, "PORT_FORWARDING_RULE", UsageUnitTypes.POLICY_MONTH.toString(), "Port Forwarding Usage"));
-        quotaTypeList.put(NETWORK_OFFERING, new QuotaTypes(NETWORK_OFFERING, "NETWORK_OFFERING", UsageUnitTypes.POLICY_MONTH.toString(), "Network Offering Usage"));
-        quotaTypeList.put(VPN_USERS, new QuotaTypes(VPN_USERS, "VPN_USERS", UsageUnitTypes.POLICY_MONTH.toString(), "VPN users usage"));
-        quotaTypeList.put(VM_DISK_IO_READ, new QuotaTypes(VM_DISK_IO_READ, "VM_DISK_IO_READ", UsageUnitTypes.IOPS.toString(), "VM Disk usage(I/O Read)"));
-        quotaTypeList.put(VM_DISK_IO_WRITE, new QuotaTypes(VM_DISK_IO_WRITE, "VM_DISK_IO_WRITE", UsageUnitTypes.IOPS.toString(), "VM Disk usage(I/O Write)"));
-        quotaTypeList.put(VM_DISK_BYTES_READ, new QuotaTypes(VM_DISK_BYTES_READ, "VM_DISK_BYTES_READ", UsageUnitTypes.BYTES.toString(), "VM Disk usage(Bytes Read)"));
-        quotaTypeList.put(VM_DISK_BYTES_WRITE, new QuotaTypes(VM_DISK_BYTES_WRITE, "VM_DISK_BYTES_WRITE", UsageUnitTypes.BYTES.toString(), "VM Disk usage(Bytes Write)"));
-        quotaTypeList.put(VM_SNAPSHOT, new QuotaTypes(VM_SNAPSHOT, "VM_SNAPSHOT", UsageUnitTypes.GB_MONTH.toString(), "VM Snapshot storage usage"));
-        quotaTypeList.put(VOLUME_SECONDARY, new QuotaTypes(VOLUME_SECONDARY, "VOLUME_SECONDARY", UsageUnitTypes.GB_MONTH.toString(), "Volume secondary storage usage"));
-        quotaTypeList.put(VM_SNAPSHOT_ON_PRIMARY, new QuotaTypes(VM_SNAPSHOT_ON_PRIMARY, "VM_SNAPSHOT_ON_PRIMARY", UsageUnitTypes.GB_MONTH.toString(), "VM Snapshot primary storage usage"));
-        quotaTypeList.put(BACKUP, new QuotaTypes(BACKUP, "BACKUP", UsageUnitTypes.GB_MONTH.toString(), "Backup storage usage"));
-        quotaTypeList.put(BUCKET, new QuotaTypes(BUCKET, "BUCKET", UsageUnitTypes.GB_MONTH.toString(), "Object Store bucket usage"));
-        quotaTypeList.put(NETWORK, new QuotaTypes(NETWORK, "NETWORK", UsageUnitTypes.COMPUTE_MONTH.toString(), "Network usage"));
-        quotaTypeList.put(VPC, new QuotaTypes(VPC, "VPC", UsageUnitTypes.COMPUTE_MONTH.toString(), "VPC usage"));
+        quotaTypeList.put(RUNNING_VM, new QuotaTypes(RUNNING_VM, "RUNNING_VM", UsageUnitTypes.COMPUTE_MONTH.toString(), "Running Vm Usage", VirtualMachine.class));
+        quotaTypeList.put(ALLOCATED_VM, new QuotaTypes(ALLOCATED_VM, "ALLOCATED_VM", UsageUnitTypes.COMPUTE_MONTH.toString(), "Allocated Vm Usage", VirtualMachine.class));
+        quotaTypeList.put(IP_ADDRESS, new QuotaTypes(IP_ADDRESS, "IP_ADDRESS", UsageUnitTypes.IP_MONTH.toString(), "IP Address Usage", IpAddress.class));
+        quotaTypeList.put(NETWORK_BYTES_SENT, new QuotaTypes(NETWORK_BYTES_SENT, "NETWORK_BYTES_SENT", UsageUnitTypes.GB.toString(), "Network Usage (Bytes Sent)", Network.class));
+        quotaTypeList.put(NETWORK_BYTES_RECEIVED, new QuotaTypes(NETWORK_BYTES_RECEIVED, "NETWORK_BYTES_RECEIVED", UsageUnitTypes.GB.toString(), "Network Usage (Bytes Received)", Network.class));
+        quotaTypeList.put(VOLUME, new QuotaTypes(VOLUME, "VOLUME", UsageUnitTypes.GB_MONTH.toString(), "Volume Usage", Volume.class));
+        quotaTypeList.put(TEMPLATE, new QuotaTypes(TEMPLATE, "TEMPLATE", UsageUnitTypes.GB_MONTH.toString(), "Template Usage", VirtualMachineTemplate.class));
+        quotaTypeList.put(ISO, new QuotaTypes(ISO, "ISO", UsageUnitTypes.GB_MONTH.toString(), "ISO Usage", VirtualMachineTemplate.class));
+        quotaTypeList.put(SNAPSHOT, new QuotaTypes(SNAPSHOT, "SNAPSHOT", UsageUnitTypes.GB_MONTH.toString(), "Snapshot Usage", Snapshot.class));
+        quotaTypeList.put(SECURITY_GROUP, new QuotaTypes(SECURITY_GROUP, "SECURITY_GROUP", UsageUnitTypes.POLICY_MONTH.toString(), "Security Group Usage",  SecurityGroup.class));
+        quotaTypeList.put(LOAD_BALANCER_POLICY, new QuotaTypes(LOAD_BALANCER_POLICY, "LOAD_BALANCER_POLICY", UsageUnitTypes.POLICY_MONTH.toString(), "Load Balancer Usage", LoadBalancer.class));
+        quotaTypeList.put(PORT_FORWARDING_RULE, new QuotaTypes(PORT_FORWARDING_RULE, "PORT_FORWARDING_RULE", UsageUnitTypes.POLICY_MONTH.toString(), "Port Forwarding Usage", PortForwardingRule.class));
+        quotaTypeList.put(NETWORK_OFFERING, new QuotaTypes(NETWORK_OFFERING, "NETWORK_OFFERING", UsageUnitTypes.POLICY_MONTH.toString(), "Network Offering Usage", NetworkOffering.class));
+        quotaTypeList.put(VPN_USERS, new QuotaTypes(VPN_USERS, "VPN_USERS", UsageUnitTypes.POLICY_MONTH.toString(), "VPN users usage", VpnUser.class));
+        quotaTypeList.put(VM_DISK_IO_READ, new QuotaTypes(VM_DISK_IO_READ, "VM_DISK_IO_READ", UsageUnitTypes.IOPS.toString(), "VM Disk usage(I/O Read)", Volume.class));
+        quotaTypeList.put(VM_DISK_IO_WRITE, new QuotaTypes(VM_DISK_IO_WRITE, "VM_DISK_IO_WRITE", UsageUnitTypes.IOPS.toString(), "VM Disk usage(I/O Write)", Volume.class));
+        quotaTypeList.put(VM_DISK_BYTES_READ, new QuotaTypes(VM_DISK_BYTES_READ, "VM_DISK_BYTES_READ", UsageUnitTypes.BYTES.toString(), "VM Disk usage(Bytes Read)", Volume.class));
+        quotaTypeList.put(VM_DISK_BYTES_WRITE, new QuotaTypes(VM_DISK_BYTES_WRITE, "VM_DISK_BYTES_WRITE", UsageUnitTypes.BYTES.toString(), "VM Disk usage(Bytes Write)", Volume.class));
+        quotaTypeList.put(VM_SNAPSHOT, new QuotaTypes(VM_SNAPSHOT, "VM_SNAPSHOT", UsageUnitTypes.GB_MONTH.toString(), "VM Snapshot storage usage", Snapshot.class));
+        quotaTypeList.put(VOLUME_SECONDARY, new QuotaTypes(VOLUME_SECONDARY, "VOLUME_SECONDARY", UsageUnitTypes.GB_MONTH.toString(), "Volume secondary storage usage", Volume.class));
+        quotaTypeList.put(VM_SNAPSHOT_ON_PRIMARY, new QuotaTypes(VM_SNAPSHOT_ON_PRIMARY, "VM_SNAPSHOT_ON_PRIMARY", UsageUnitTypes.GB_MONTH.toString(), "VM Snapshot primary storage usage", Snapshot.class));
+        quotaTypeList.put(BACKUP, new QuotaTypes(BACKUP, "BACKUP", UsageUnitTypes.GB_MONTH.toString(), "Backup storage usage", BackupOffering.class));
+        quotaTypeList.put(BUCKET, new QuotaTypes(BUCKET, "BUCKET", UsageUnitTypes.GB_MONTH.toString(), "Object Store bucket usage", Bucket.class));
+        quotaTypeList.put(NETWORK, new QuotaTypes(NETWORK, "NETWORK", UsageUnitTypes.COMPUTE_MONTH.toString(), "Network usage", Network.class));
+        quotaTypeList.put(VPC, new QuotaTypes(VPC, "VPC", UsageUnitTypes.COMPUTE_MONTH.toString(), "VPC usage", Vpc.class));
         quotaTypeMap = Collections.unmodifiableMap(quotaTypeList);
     }
 
-    private QuotaTypes(Integer quotaType, String name, String unit, String description) {
+    private QuotaTypes(Integer quotaType, String name, String unit, String description, Class<?> clazz) {
         this.quotaType = quotaType;
         this.description = description;
         this.quotaName = name;
         this.quotaUnit = unit;
         this.discriminator = "None";
+        this.clazz = clazz;
     }
 
     public static Map<Integer, QuotaTypes> listQuotaTypes() {
@@ -104,22 +118,20 @@ static public String getDescription(int quotaType) {
         return null;
     }
 
+    public Class<?> getClazz() {
+        return clazz;
+    }
+
     static public QuotaTypes getQuotaType(int quotaType) {
         return quotaTypeMap.get(quotaType);
     }
 
-    static public QuotaTypes getQuotaTypeByName(String name) {
-        if (StringUtils.isBlank(name)) {
-            throw new CloudRuntimeException("Could not retrieve Quota type by name because the value passed as parameter is null, empty, or blank.");
-        }
-
-        for (QuotaTypes type : quotaTypeMap.values()) {
-            if (type.getQuotaName().equals(name)) {
-                return type;
-            }
+    static public Class<?> getClazz(int quotaType) {
+        QuotaTypes t = quotaTypeMap.get(quotaType);
+        if (t != null) {
+            return t.getClazz();
         }
-
-        throw new CloudRuntimeException(String.format("Could not find Quota type with name [%s].", name));
+        return null;
     }
 
     @Override
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDao.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDao.java
index 126fa11413f7..ead70ae35012 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDao.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDao.java
@@ -26,6 +26,6 @@
 
 public interface QuotaUsageJoinDao extends GenericDao<QuotaUsageJoinVO, Long> {
 
-    List<QuotaUsageJoinVO> findQuotaUsage(Long accountId, Long domainId, Integer usageType, Long resourceId, Long networkId, Long offeringId, Date startDate, Date endDate, Long tariffId);
+    List<QuotaUsageJoinVO> findQuotaUsage(Long accountId, List<Long> domainIds, Integer usageType, Long resourceId, Long networkId, Long offeringId, Date startDate, Date endDate, Long tariffId);
 
 }
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDaoImpl.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDaoImpl.java
index b98ea2b3a5d2..e69b1a05ba4d 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDaoImpl.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/dao/QuotaUsageJoinDaoImpl.java
@@ -61,7 +61,7 @@ public void init() {
 
     private void prepareQuotaUsageSearchBuilder(SearchBuilder<QuotaUsageJoinVO> searchBuilder) {
         searchBuilder.and("accountId", searchBuilder.entity().getAccountId(), SearchCriteria.Op.EQ);
-        searchBuilder.and("domainId", searchBuilder.entity().getDomainId(), SearchCriteria.Op.EQ);
+        searchBuilder.and("domainIds", searchBuilder.entity().getDomainId(), SearchCriteria.Op.IN);
         searchBuilder.and("usageType", searchBuilder.entity().getUsageType(), SearchCriteria.Op.EQ);
         searchBuilder.and("resourceId", searchBuilder.entity().getResourceId(), SearchCriteria.Op.EQ);
         searchBuilder.and("networkId", searchBuilder.entity().getNetworkId(), SearchCriteria.Op.EQ);
@@ -71,11 +71,13 @@ private void prepareQuotaUsageSearchBuilder(SearchBuilder<QuotaUsageJoinVO> sear
     }
 
     @Override
-    public List<QuotaUsageJoinVO> findQuotaUsage(Long accountId, Long domainId, Integer usageType, Long resourceId, Long networkId, Long offeringId, Date startDate, Date endDate, Long tariffId) {
+    public List<QuotaUsageJoinVO> findQuotaUsage(Long accountId, List<Long> domainIds, Integer usageType, Long resourceId, Long networkId, Long offeringId, Date startDate, Date endDate, Long tariffId) {
         SearchCriteria<QuotaUsageJoinVO> sc = tariffId == null ? searchQuotaUsages.create() : searchQuotaUsagesJoinTariffUsages.create();
 
         sc.setParametersIfNotNull("accountId", accountId);
-        sc.setParametersIfNotNull("domainId", domainId);
+        if (domainIds != null) {
+            sc.setParameters("domainIds", domainIds.toArray());
+        }
         sc.setParametersIfNotNull("usageType", usageType);
         sc.setParametersIfNotNull("resourceId", resourceId);
         sc.setParametersIfNotNull("networkId", networkId);
diff --git a/framework/quota/src/test/java/org/apache/cloudstack/quota/QuotaManagerImplTest.java b/framework/quota/src/test/java/org/apache/cloudstack/quota/QuotaManagerImplTest.java
index a33faa054de4..1e08e7d7fc00 100644
--- a/framework/quota/src/test/java/org/apache/cloudstack/quota/QuotaManagerImplTest.java
+++ b/framework/quota/src/test/java/org/apache/cloudstack/quota/QuotaManagerImplTest.java
@@ -22,6 +22,7 @@
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Date;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
 
@@ -33,7 +34,9 @@
 import org.apache.cloudstack.quota.activationrule.presetvariables.Value;
 import org.apache.cloudstack.quota.constant.QuotaTypes;
 import org.apache.cloudstack.quota.dao.QuotaTariffDao;
+import org.apache.cloudstack.quota.dao.QuotaTariffUsageDao;
 import org.apache.cloudstack.quota.dao.QuotaUsageDao;
+import org.apache.cloudstack.quota.vo.QuotaTariffUsageVO;
 import org.apache.cloudstack.quota.vo.QuotaTariffVO;
 import org.apache.cloudstack.quota.vo.QuotaUsageVO;
 import org.apache.cloudstack.usage.UsageUnitTypes;
@@ -89,6 +92,9 @@ public class QuotaManagerImplTest {
     @Mock
     PresetVariables presetVariablesMock;
 
+    @Mock
+    QuotaTariffUsageDao quotaTariffUsageDaoMock;
+
     SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd HH:mm:ss");
 
     @Test
@@ -484,47 +490,49 @@ public void getPresetVariablesTestHasTariffsWithActivationRuleReturnPresetVariab
     }
 
     @Test
-    public void aggregateQuotaTariffsValuesTestTariffsWereNotInPeriodToBeAppliedReturnZero() {
+    public void aggregateQuotaTariffsValuesTestTariffsWereNotInPeriodToBeAppliedReturnEmptyMap() {
         List<QuotaTariffVO> tariffs = createTariffList();
 
         Mockito.doReturn(false).when(quotaManagerImplSpy).isQuotaTariffInPeriodToBeApplied(Mockito.any(), Mockito.any(), Mockito.anyString());
-        BigDecimal result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, tariffs, false, jsInterpreterMock, "");
+        Map<QuotaTariffVO, BigDecimal> result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, tariffs, false, jsInterpreterMock, "");
 
-        Assert.assertEquals(BigDecimal.ZERO, result);
+        Assert.assertTrue(result.isEmpty());
     }
 
     @Test
-    public void aggregateQuotaTariffsValuesTestTariffsIsEmptyReturnZero() {
-        BigDecimal result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, new ArrayList<>(), false, jsInterpreterMock, "");
+    public void aggregateQuotaTariffsValuesTestTariffsIsEmptyReturnEmptyMap() {
+        Map<QuotaTariffVO, BigDecimal> result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, new ArrayList<>(), false, jsInterpreterMock, "");
 
-        Assert.assertEquals(BigDecimal.ZERO, result);
+        Assert.assertTrue(result.isEmpty());
     }
 
     @Test
-    public void aggregateQuotaTariffsValuesTestTariffsAreInPeriodToBeAppliedReturnAggregation() {
+    public void aggregateQuotaTariffsValuesTestTariffsAreInPeriodToBeAppliedReturnTariffsWithTheirValues() {
         List<QuotaTariffVO> tariffs = createTariffList();
 
         Mockito.doReturn(true, false, true).when(quotaManagerImplSpy).isQuotaTariffInPeriodToBeApplied(Mockito.any(), Mockito.any(), Mockito.anyString());
         Mockito.doReturn(BigDecimal.TEN).when(quotaManagerImplSpy).getQuotaTariffValueToBeApplied(Mockito.any(), Mockito.any(), Mockito.any(), Mockito.any());
-        BigDecimal result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, tariffs, false, jsInterpreterMock, "");
+        Map<QuotaTariffVO, BigDecimal> result = quotaManagerImplSpy.aggregateQuotaTariffsValues(usageVoMock, tariffs, false, jsInterpreterMock, "");
 
-        Assert.assertEquals(BigDecimal.TEN.multiply(new BigDecimal(2)), result);
+        Assert.assertEquals(2, result.size());
+        Assert.assertTrue(result.values().stream().allMatch(value -> value.equals(BigDecimal.TEN)));
     }
 
     @Test
     public void persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsagesTestReturnOnlyPersistedQuotaUsageVo() {
-        List<Pair<UsageVO, QuotaUsageVO>> listPair = new ArrayList<>();
+        Map<UsageVO, Pair<QuotaUsageVO, List<QuotaTariffUsageVO>>> mapUsageQuotaUsage = new LinkedHashMap<>();
         QuotaUsageVO quotaUsageVoMock1 = Mockito.mock(QuotaUsageVO.class);
         QuotaUsageVO quotaUsageVoMock2 = Mockito.mock(QuotaUsageVO.class);
 
-        listPair.add(new Pair<>(new UsageVO(), quotaUsageVoMock1));
-        listPair.add(new Pair<>(new UsageVO(), null));
-        listPair.add(new Pair<>(new UsageVO(), quotaUsageVoMock2));
+        mapUsageQuotaUsage.put(new UsageVO(), new Pair<>(quotaUsageVoMock1, new ArrayList<>()));
+        mapUsageQuotaUsage.put(new UsageVO(), null);
+        mapUsageQuotaUsage.put(new UsageVO(), new Pair<>(quotaUsageVoMock2, new ArrayList<>()));
 
         Mockito.doReturn(null).when(usageDaoMock).persistUsage(Mockito.any());
         Mockito.doReturn(null).when(quotaUsageDaoMock).persistQuotaUsage(Mockito.any());
+        Mockito.doNothing().when(quotaManagerImplSpy).persistQuotaTariffUsages(Mockito.any(), Mockito.any());
 
-        List<QuotaUsageVO> result = quotaManagerImplSpy.persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(listPair);
+        List<QuotaUsageVO> result = quotaManagerImplSpy.persistUsagesAndQuotaUsagesAndRetrievePersistedQuotaUsages(mapUsageQuotaUsage);
 
         Assert.assertEquals(2, result.size());
         Assert.assertEquals(quotaUsageVoMock1, result.get(0));
@@ -551,4 +559,41 @@ private static List<Tariff> createLastAppliedTariffsPresetVariableList(int numbe
         return lastTariffs;
     }
 
+    @Test
+    public void createQuotaTariffUsageTestTariffValueIsNotZeroReturnDetailedVo() {
+        Mockito.doReturn(1).when(usageVoMock).getUsageType();
+        Mockito.doReturn(BigDecimal.TEN).when(quotaManagerImplSpy).getUsageValueAccordingToUsageUnitType(Mockito.any(), Mockito.any(), Mockito.any());
+        Mockito.doReturn(1L).when(quotaTariffVoMock).getId();
+
+        QuotaTariffUsageVO result = quotaManagerImplSpy.createQuotaTariffUsage(usageVoMock, quotaTariffVoMock, BigDecimal.TEN);
+
+        Assert.assertEquals(1L, result.getTariffId().longValue());
+        Assert.assertEquals(BigDecimal.TEN, result.getQuotaUsed());
+    }
+
+    @Test
+    public void persistQuotaTariffUsagesTestZeroQuotaTariffUsagesZeroPersisted() {
+        List<QuotaTariffUsageVO> quotaTariffUsages = new ArrayList<>();
+
+        quotaManagerImplSpy.persistQuotaTariffUsages(quotaTariffUsages, 1L);
+
+        Mockito.verify(quotaTariffUsageDaoMock, Mockito.never()).persistQuotaTariffUsage(Mockito.any());
+    }
+
+    @Test
+    public void persistQuotaTariffUsagesTestTwoQuotaUsageDetailsTwoPersisted() {
+        List<QuotaTariffUsageVO> quotaUsageDetails = new ArrayList<>();
+        QuotaTariffUsageVO quotaUsageDetailVoMock1 = Mockito.mock(QuotaTariffUsageVO.class);
+        QuotaTariffUsageVO quotaUsageDetailVoMock2 = Mockito.mock(QuotaTariffUsageVO.class);
+
+        quotaUsageDetails.add(quotaUsageDetailVoMock1);
+        quotaUsageDetails.add(quotaUsageDetailVoMock2);
+
+        Mockito.doNothing().when(quotaTariffUsageDaoMock).persistQuotaTariffUsage(Mockito.any());
+
+        quotaManagerImplSpy.persistQuotaTariffUsages(quotaUsageDetails, 1L);
+
+        Mockito.verify(quotaTariffUsageDaoMock, Mockito.times(2)).persistQuotaTariffUsage(Mockito.any());
+    }
+
 }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaResourceStatementCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaResourceStatementCmd.java
new file mode 100644
index 000000000000..00dcb8fa5752
--- /dev/null
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaResourceStatementCmd.java
@@ -0,0 +1,118 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//with the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.api.command;
+
+import org.apache.cloudstack.api.APICommand;
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseCmd;
+import org.apache.cloudstack.api.Parameter;
+import org.apache.cloudstack.api.response.AccountResponse;
+import org.apache.cloudstack.api.response.DomainResponse;
+import org.apache.cloudstack.api.response.ProjectResponse;
+import org.apache.cloudstack.api.response.QuotaResponseBuilder;
+import org.apache.cloudstack.api.response.QuotaResourceStatementResponse;
+import org.apache.commons.lang3.BooleanUtils;
+import org.apache.commons.lang3.ObjectUtils;
+
+import javax.inject.Inject;
+
+import java.util.Date;
+
+@APICommand(name = "quotaResourceStatement", responseObject = QuotaResourceStatementResponse.class, since = "4.23.0.0",
+        description = "Generates a detailed Quota statement for a specific resource.", requestHasSensitiveInfo = false,
+        responseHasSensitiveInfo = false)
+public class QuotaResourceStatementCmd extends BaseCmd {
+
+    @Parameter(name = ApiConstants.ID, type = CommandType.STRING, required = true, description = "ID of the resource.")
+    private String id;
+
+    @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class,
+            description = "Generate the statement for this Account. A resource may have belonged to different owners at distinct points in time, " +
+                    "so this parameter can be used to only consider the period for which it belonged to a specific Account.")
+    private Long accountId;
+
+    @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class,
+            description = "Generate the statement for this Project. A resource may have belonged to different owners at distinct points in time, " +
+                    "so this parameter can be used to only consider the period for which it belonged to a specific Project.")
+    private Long projectId;
+
+    @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
+            description = "ID of the Domain for which the Quota statement will be generated.")
+    private Long domainId;
+
+    @Parameter(name = ApiConstants.USAGE_TYPE, type = CommandType.INTEGER, required = true, description = "Usage type of the Quota usage.")
+    private Integer usageType;
+
+    @Parameter(name = ApiConstants.START_DATE, type = CommandType.DATE, required = true, description = "Start date for the query. " +
+            ApiConstants.PARAMETER_DESCRIPTION_START_DATE_POSSIBLE_FORMATS)
+    private Date startDate;
+
+    @Parameter(name = ApiConstants.END_DATE, type = CommandType.DATE, required = true, description = "End date for the query. " +
+            ApiConstants.PARAMETER_DESCRIPTION_END_DATE_POSSIBLE_FORMATS)
+    private Date endDate;
+
+    @Parameter(name = ApiConstants.IS_RECURSIVE, type = CommandType.BOOLEAN, description = "Whether to include usage records from children of the filtered domain. "
+            + " Defaults to false.")
+    private Boolean recursive;
+
+    @Inject
+    QuotaResponseBuilder responseBuilder;
+
+    @Override
+    public void execute() {
+        QuotaResourceStatementResponse response = responseBuilder.createQuotaResourceStatement(this);
+        response.setResponseName(getCommandName());
+        setResponseObject(response);
+    }
+
+    @Override
+    public long getEntityOwnerId() {
+        if (ObjectUtils.allNull(accountId, projectId)) {
+            return -1;
+        }
+        return _accountService.finalizeAccountId(accountId, null, null, projectId);
+    }
+
+    public String getId() {
+        return id;
+    }
+
+    public Integer getUsageType() {
+        return usageType;
+    }
+
+    public Date getStartDate() {
+        return startDate;
+    }
+
+    public Date getEndDate() {
+        return endDate;
+    }
+
+    public Long getAccountId() {
+        return accountId;
+    }
+
+    public Long getDomainId() {
+        return domainId;
+    }
+
+    public boolean isRecursive() {
+        return BooleanUtils.isTrue(recursive);
+    }
+
+}
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java
index bfe26a9f4250..f3a27ea58718 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/command/QuotaStatementCmd.java
@@ -20,7 +20,6 @@
 
 import javax.inject.Inject;
 
-import org.apache.cloudstack.api.ACL;
 import org.apache.cloudstack.api.APICommand;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.BaseCmd;
@@ -32,18 +31,17 @@
 import org.apache.cloudstack.api.response.QuotaStatementItemResponse;
 import org.apache.cloudstack.api.response.QuotaStatementResponse;
 
+import org.apache.commons.lang3.BooleanUtils;
 import org.apache.commons.lang3.ObjectUtils;
 
 @APICommand(name = "quotaStatement", responseObject = QuotaStatementItemResponse.class, description = "Create a Quota statement for the provided Account, Project, or Domain.",
         since = "4.7.0", requestHasSensitiveInfo = false, responseHasSensitiveInfo = false, httpMethod = "GET")
 public class QuotaStatementCmd extends BaseCmd {
 
-    @ACL
     @Parameter(name = ApiConstants.ACCOUNT, type = CommandType.STRING,
             description = "Name of the Account for which the Quota statement will be generated. Deprecated, please use accountid instead.")
     private String accountName;
 
-    @ACL
     @Parameter(name = ApiConstants.DOMAIN_ID, type = CommandType.UUID, entityType = DomainResponse.class,
             description = "ID of the Domain for which the Quota statement will be generated. May be used individually or with account.")
     private Long domainId;
@@ -60,16 +58,18 @@ public class QuotaStatementCmd extends BaseCmd {
             description = "Consider only Quota usage records for the specified usage type in the statement.")
     private Integer usageType;
 
-    @ACL
     @Parameter(name = ApiConstants.ACCOUNT_ID, type = CommandType.UUID, entityType = AccountResponse.class,
             description = "ID of the Account for which the Quota statement will be generated. Can not be specified with projectid.")
     private Long accountId;
 
-    @ACL
     @Parameter(name = ApiConstants.PROJECT_ID, type = CommandType.UUID, entityType = ProjectResponse.class,
             description = "ID of the Project for which the Quota statement will be generated. Can not be specified with accountid.", since = "4.23.0")
     private Long projectId;
 
+    @Parameter(name = ApiConstants.IS_RECURSIVE, type = CommandType.BOOLEAN, description = "Whether to include usage records from children of the filtered domain. "
+            + " Defaults to false.")
+    private Boolean recursive;
+
     @Parameter(name = ApiConstants.SHOW_RESOURCES, type = CommandType.BOOLEAN, description = "List the resources of each Quota type in the period.", since = "4.23.0")
     private boolean showResources;
 
@@ -152,4 +152,9 @@ public void execute() {
         response.setResponseName(getCommandName());
         setResponseObject(response);
     }
+
+    public boolean isRecursive() {
+        return BooleanUtils.isTrue(recursive);
+    }
+
 }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementItemResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementItemResponse.java
new file mode 100644
index 000000000000..9f0a28389a9d
--- /dev/null
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementItemResponse.java
@@ -0,0 +1,82 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//with the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.api.response;
+
+import java.math.BigDecimal;
+import java.util.Date;
+
+import com.google.gson.annotations.SerializedName;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import com.cloud.serializer.Param;
+
+public class QuotaResourceStatementItemResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.TARIFF_ID)
+    @Param(description = "ID of the tariff.")
+    private String tariffId;
+
+    @SerializedName(ApiConstants.TARIFF_NAME)
+    @Param(description = "Name of the tariff.")
+    private String tariffName;
+
+    @SerializedName(ApiConstants.QUOTA_CONSUMED)
+    @Param(description = "Amount of quota used.")
+    private BigDecimal quotaUsed;
+
+    @SerializedName(ApiConstants.START_DATE)
+    @Param(description = "Item's start date.")
+    private Date startDate;
+
+    @SerializedName(ApiConstants.END_DATE)
+    @Param(description = "Item's end date.")
+    private Date endDate;
+
+    @SerializedName(ApiConstants.ACCOUNT_ID)
+    @Param(description = "UUID of the resource's owner.")
+    private String accountId;
+
+    public QuotaResourceStatementItemResponse() {
+        super("quotaresourcestatementitem");
+    }
+
+    public void setTariffId(String tariffId) {
+        this.tariffId = tariffId;
+    }
+
+    public void setTariffName(String tariffName) {
+        this.tariffName = tariffName;
+    }
+
+    public void setQuotaUsed(BigDecimal quotaUsed) {
+        this.quotaUsed = quotaUsed;
+    }
+
+    public void setStartDate(Date startDate) {
+        this.startDate = startDate;
+    }
+
+    public void setEndDate(Date endDate) {
+        this.endDate = endDate;
+    }
+
+    public void setAccountId(String accountId) {
+        this.accountId = accountId;
+    }
+}
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementResponse.java
new file mode 100644
index 000000000000..ce3ab1f177ba
--- /dev/null
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResourceStatementResponse.java
@@ -0,0 +1,66 @@
+//Licensed to the Apache Software Foundation (ASF) under one
+//or more contributor license agreements.  See the NOTICE file
+//distributed with this work for additional information
+//regarding copyright ownership.  The ASF licenses this file
+//to you under the Apache License, Version 2.0 (the
+//"License"); you may not use this file except in compliance
+//with the License.  You may obtain a copy of the License at
+//
+//http://www.apache.org/licenses/LICENSE-2.0
+//
+//Unless required by applicable law or agreed to in writing,
+//software distributed under the License is distributed on an
+//"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+//KIND, either express or implied.  See the License for the
+//specific language governing permissions and limitations
+//under the License.
+package org.apache.cloudstack.api.response;
+
+import com.cloud.serializer.Param;
+import com.google.gson.annotations.SerializedName;
+
+import org.apache.cloudstack.api.ApiConstants;
+import org.apache.cloudstack.api.BaseResponse;
+
+import java.math.BigDecimal;
+import java.util.List;
+
+public class QuotaResourceStatementResponse extends BaseResponse {
+
+    @SerializedName(ApiConstants.USAGE_NAME)
+    @Param(description = "Name of the usage type.")
+    private String usageName;
+
+    @SerializedName(ApiConstants.UNIT)
+    @Param(description = "Unit of the usage type.")
+    private String unit;
+
+    @SerializedName(ApiConstants.ITEMS)
+    @Param(description = "List of Quota tariff usages.", responseObject = QuotaResourceStatementItemResponse.class)
+    private List<QuotaResourceStatementItemResponse> items;
+
+    @SerializedName(ApiConstants.TOTAL_QUOTA)
+    @Param(description = "Total amount of quota used.")
+    private BigDecimal totalQuotaUsed;
+
+    public QuotaResourceStatementResponse() {
+        super("quotaresourcestatement");
+    }
+
+    public void setUsageName(String usageName) {
+        this.usageName = usageName;
+    }
+
+    public void setUnit(String unit) {
+        this.unit = unit;
+    }
+
+    public void setQuotaUsageDetails(List<QuotaResourceStatementItemResponse> items) {
+        this.items = items;
+    }
+
+    public void setTotalQuotaUsed(BigDecimal totalQuotaUsed) {
+        this.totalQuotaUsed = totalQuotaUsed;
+    }
+
+}
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
index f0390bf626d0..63bf043f4fa9 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilder.java
@@ -23,6 +23,7 @@
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateUpdateCmd;
 import org.apache.cloudstack.api.command.QuotaPresetVariablesListCmd;
+import org.apache.cloudstack.api.command.QuotaResourceStatementCmd;
 import org.apache.cloudstack.api.command.QuotaStatementCmd;
 import org.apache.cloudstack.api.command.QuotaSummaryCmd;
 import org.apache.cloudstack.api.command.QuotaTariffCreateCmd;
@@ -83,4 +84,6 @@ public interface QuotaResponseBuilder {
     Pair<List<QuotaCreditsResponse>, Integer> createQuotaCreditsListResponse(QuotaCreditsListCmd cmd);
 
     QuotaValidateActivationRuleResponse validateActivationRule(QuotaValidateActivationRuleCmd cmd);
+
+    QuotaResourceStatementResponse createQuotaResourceStatement(QuotaResourceStatementCmd cmd);
 }
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
index 231ba777e600..77099bcdc889 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
@@ -66,11 +66,14 @@
 import com.cloud.user.UserVO;
 import com.cloud.utils.DateUtil;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.EntityManager;
 import com.cloud.utils.exception.CloudRuntimeException;
 import com.cloud.vm.VMInstanceVO;
 import com.cloud.vm.dao.VMInstanceDao;
+import org.apache.cloudstack.acl.ControlledEntity;
 import org.apache.cloudstack.api.ApiConstants;
 import org.apache.cloudstack.api.ApiErrorCode;
+import org.apache.cloudstack.api.InternalIdentity;
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.command.QuotaBalanceCmd;
 import org.apache.cloudstack.api.command.QuotaConfigureEmailCmd;
@@ -78,6 +81,7 @@
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateUpdateCmd;
 import org.apache.cloudstack.api.command.QuotaPresetVariablesListCmd;
+import org.apache.cloudstack.api.command.QuotaResourceStatementCmd;
 import org.apache.cloudstack.api.command.QuotaStatementCmd;
 import org.apache.cloudstack.api.command.QuotaSummaryCmd;
 import org.apache.cloudstack.api.command.QuotaTariffCreateCmd;
@@ -107,16 +111,20 @@
 import org.apache.cloudstack.quota.dao.QuotaEmailTemplatesDao;
 import org.apache.cloudstack.quota.dao.QuotaSummaryDao;
 import org.apache.cloudstack.quota.dao.QuotaTariffDao;
+import org.apache.cloudstack.quota.dao.QuotaTariffUsageDao;
 import org.apache.cloudstack.quota.dao.QuotaUsageDao;
+import org.apache.cloudstack.quota.dao.QuotaUsageJoinDao;
 import org.apache.cloudstack.quota.vo.QuotaAccountVO;
 import org.apache.cloudstack.quota.vo.QuotaBalanceVO;
 import org.apache.cloudstack.quota.vo.QuotaCreditsVO;
 import org.apache.cloudstack.quota.vo.QuotaEmailConfigurationVO;
 import org.apache.cloudstack.quota.vo.QuotaEmailTemplatesVO;
 import org.apache.cloudstack.quota.vo.QuotaSummaryVO;
+import org.apache.cloudstack.quota.vo.QuotaTariffUsageVO;
 import org.apache.cloudstack.quota.vo.QuotaTariffVO;
 import org.apache.cloudstack.quota.vo.QuotaUsageJoinVO;
 import org.apache.cloudstack.quota.vo.QuotaUsageResourceVO;
+import org.apache.cloudstack.usage.UsageTypes;
 import org.apache.cloudstack.utils.jsinterpreter.JsInterpreter;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 import org.apache.commons.collections4.CollectionUtils;
@@ -181,7 +189,12 @@ public class QuotaResponseBuilderImpl implements QuotaResponseBuilder {
     private VMTemplateDao vmTemplateDao;
     @Inject
     private VolumeDao volumeDao;
-
+    @Inject
+    private QuotaUsageJoinDao quotaUsageJoinDao;
+    @Inject
+    private QuotaTariffUsageDao quotaTariffUsageDao;
+    @Inject
+    private EntityManager entityMgr;
 
     private final Class<?>[] assignableClasses = {GenericPresetVariable.class, ComputingResources.class, ResourceCounting.class};
 
@@ -342,9 +355,9 @@ public QuotaBalanceResponse createQuotaBalanceResponse(QuotaBalanceCmd cmd) {
 
     @Override
     public QuotaStatementResponse createQuotaStatementResponse(QuotaStatementCmd cmd) {
-        Long accountId = getAccountIdForQuotaStatement(cmd);
-        Long domainId = getDomainIdForQuotaStatement(cmd, accountId);
-        List<QuotaUsageJoinVO> quotaUsages = _quotaService.getQuotaUsage(accountId, null, domainId, cmd.getUsageType(), cmd.getStartDate(), cmd.getEndDate());
+        Long accountId = getAccountIdForQuotaStatement(cmd.getEntityOwnerId(), null);
+        Pair<Long, List<Long>> baseDomainAndFilteredDomains = getDomainIdsForQuotaStatement(accountId, cmd.getDomainId(), cmd.isRecursive());
+        List<QuotaUsageJoinVO> quotaUsages = _quotaService.getQuotaUsage(accountId, null, baseDomainAndFilteredDomains.second(), cmd.getUsageType(), cmd.getStartDate(), cmd.getEndDate());
 
         logger.debug("Creating quota statement from [{}] usage records for parameters [{}].", quotaUsages.size(),
                 ReflectionToStringBuilderUtils.reflectOnlySelectedFields(cmd, "accountName", "accountId", "projectId", "domainId", "startDate", "endDate", "usageType", "showResources"));
@@ -367,52 +380,16 @@ public QuotaStatementResponse createQuotaStatementResponse(QuotaStatementCmd cmd
             Account account = _accountDao.findByIdIncludingRemoved(accountId);
             statement.setAccountId(account.getUuid());
             statement.setAccountName(account.getAccountName());
-            domainId = account.getDomainId();
         }
-        if (domainId != null) {
-            DomainVO domain = domainDao.findByIdIncludingRemoved(domainId);
+        Long baseDomainId = baseDomainAndFilteredDomains.first();
+        if (baseDomainId != null) {
+            DomainVO domain = domainDao.findByIdIncludingRemoved(baseDomainId);
             statement.setDomainId(domain.getUuid());
         }
 
         return statement;
     }
 
-    protected Long getAccountIdForQuotaStatement(QuotaStatementCmd cmd) {
-        if (Account.Type.NORMAL.equals(CallContext.current().getCallingAccount().getType())) {
-            logger.debug("Limiting the Quota statement for the calling Account, as they are a User Account.");
-            return CallContext.current().getCallingAccountId();
-        }
-
-        long accountId = cmd.getEntityOwnerId();
-        if (accountId != -1) {
-            return accountId;
-        }
-
-        if (cmd.getDomainId() == null) {
-            logger.debug("Limiting the Quota statement for the calling Account, as 'domainid' was not informed.");
-            return CallContext.current().getCallingAccountId();
-        }
-
-        logger.debug("Allowing admin/domain admin to generate the Quota statement for the provided Domain.");
-        return null;
-    }
-
-    protected Long getDomainIdForQuotaStatement(QuotaStatementCmd cmd, Long accountId) {
-        if (accountId != null) {
-            logger.debug("Quota statement is already limited to Account [{}].", accountId);
-            Account account = _accountDao.findByIdIncludingRemoved(accountId);
-            return account.getDomainId();
-        }
-
-        Long domainId = cmd.getDomainId();
-        if (domainId != null) {
-            return domainId;
-        }
-
-        logger.debug("Limiting the Quota statement for the calling Account's Domain.");
-        return CallContext.current().getCallingAccount().getDomainId();
-    }
-
     protected void createDummyRecordForEachQuotaTypeIfUsageTypeIsNotInformed(List<QuotaUsageJoinVO> quotaUsages, Integer usageType) {
         if (usageType != null) {
             logger.debug("As the usage type [{}] was informed as parameter of the API quotaStatement, we will not create dummy records.", usageType);
@@ -1158,6 +1135,184 @@ public QuotaValidateActivationRuleResponse validateActivationRule(QuotaValidateA
         return createValidateActivationRuleResponse(activationRule, quotaName, false, message);
     }
 
+    @Override
+    public QuotaResourceStatementResponse createQuotaResourceStatement(QuotaResourceStatementCmd cmd) {
+        String resourceUuid = cmd.getId();
+        Integer usageType = cmd.getUsageType();
+        Date startDate = cmd.getStartDate();
+        Date endDate = cmd.getEndDate();
+
+        if (startDate.after(endDate)) {
+            throw new InvalidParameterValueException(String.format("The start date [%s] must be before the end date [%s].", startDate, endDate));
+        }
+
+        InternalIdentity resource = retrieveResource(resourceUuid, usageType);
+        if (resource == null) {
+            logger.error("Could not find resource [{}] of type [{}]. Returning an empty list.", resourceUuid, usageType);
+            return createQuotaResourceStatementResponse(resourceUuid, usageType,  new ArrayList<>(), new BigDecimal(0));
+        }
+
+        long id = resource.getId();
+
+        Long currentOwnerId = null;
+        if (resource instanceof ControlledEntity) {
+            currentOwnerId = ((ControlledEntity) resource).getAccountId();
+        }
+        Long accountId = getAccountIdForQuotaStatement(cmd.getEntityOwnerId(), currentOwnerId);
+        Pair<Long, List<Long>> baseDomainAndFilteredDomains = getDomainIdsForQuotaStatement(accountId, cmd.getDomainId(), cmd.isRecursive());
+
+        Long resourceId = null;
+        Long networkId = null;
+        Long offeringId = null;
+
+        switch (usageType) {
+            case UsageTypes.NETWORK_OFFERING:
+            case UsageTypes.BACKUP:
+                offeringId = id;
+                break;
+            case UsageTypes.NETWORK_BYTES_RECEIVED:
+            case UsageTypes.NETWORK_BYTES_SENT:
+                networkId = id;
+                break;
+            default:
+                resourceId = id;
+        }
+
+        logger.debug("Attempting to find quota usages with parameters usage type [{}], usage id [{}], network id [{}], offering id [{}], and between [{}] and [{}].",
+                usageType, resourceId, networkId, offeringId, startDate, endDate);
+
+        List<QuotaUsageJoinVO> quotaUsageJoinList = quotaUsageJoinDao.findQuotaUsage(accountId, baseDomainAndFilteredDomains.second(), usageType, resourceId, networkId, offeringId, startDate, endDate, null);
+
+        logger.debug("Found [{}] quota usages using as parameter usage type [{}], usage id [{}], network id [{}], offering id [{}], and between [{}] and [{}].",
+                quotaUsageJoinList.size(), usageType, resourceId, networkId, offeringId, startDate, endDate);
+
+        List<QuotaResourceStatementItemResponse> quotaResourceStatementItemResponseList = new ArrayList<>();
+        BigDecimal totalQuotaUsed = new BigDecimal(0);
+        List<QuotaTariffVO> quotaTariffs = _quotaTariffDao.listQuotaTariffs(null, null, usageType, null, null, true, null, null).first();
+
+        for (QuotaUsageJoinVO quotaUsageJoin : quotaUsageJoinList) {
+            Account account = _accountMgr.getAccount(quotaUsageJoin.getAccountId());
+            String accountUuid = account.getUuid();
+
+            List<QuotaTariffUsageVO> quotaTariffUsageList = quotaTariffUsageDao.listQuotaTariffUsages(quotaUsageJoin.getId());
+            logger.debug("Found [{}] quota tariff usages associated to the quota usage [{}] of resource [{}] and type [{}] between [{}] and [{}].",
+                    quotaTariffUsageList.size(), quotaUsageJoin, resourceUuid, usageType, startDate, endDate);
+            for (QuotaTariffUsageVO quotaTariffUsage: quotaTariffUsageList) {
+                quotaResourceStatementItemResponseList.add(createQuotaResourceStatementItemResponse(quotaTariffUsage, quotaTariffs, quotaUsageJoin.getStartDate(),
+                        quotaUsageJoin.getEndDate(), accountUuid));
+                totalQuotaUsed = totalQuotaUsed.add(quotaTariffUsage.getQuotaUsed());
+            }
+        }
+        logger.debug("The total quota used of type [{}] between [{}] and [{}] for the resource [{}] was [{}].", usageType, startDate, endDate, resourceUuid, totalQuotaUsed);
+
+        return createQuotaResourceStatementResponse(resourceUuid, usageType, quotaResourceStatementItemResponseList, totalQuotaUsed);
+    }
+
+    protected Long getAccountIdForQuotaStatement(long providedAccountId, Long fallbackAccountId) {
+        Account caller = CallContext.current().getCallingAccount();
+
+        if (providedAccountId != -1L) {
+            Account account = _accountDao.findByIdIncludingRemoved(providedAccountId);
+            _accountMgr.checkAccess(caller, null, false, account);
+            logger.debug("Limiting the Quota resource statement for the provided Account [{}].", providedAccountId);
+            return providedAccountId;
+        }
+
+        Account.Type callerType = caller.getType();
+        if (Account.Type.ADMIN.equals(callerType) || Account.Type.DOMAIN_ADMIN.equals(callerType)) {
+            logger.debug("Not limiting the Quota resource statement for a specific Account, as no specific Account was provided and the caller is either an admin or domain admin.");
+            return null;
+        }
+
+        if (fallbackAccountId != null) {
+            Account fallbackAccount = _accountDao.findByIdIncludingRemoved(fallbackAccountId);
+            _accountMgr.checkAccess(caller, null, false, fallbackAccount);
+            logger.debug("Limiting the Quota statement for the fallback Account [{}], as no specific Account was provided.", fallbackAccountId);
+            return fallbackAccountId;
+        }
+
+        logger.debug("Limiting the Quota resource statement for the calling account, as no specific Account was provided and no fallback account was provided.");
+        return caller.getAccountId();
+    }
+
+    protected Pair<Long, List<Long>> getDomainIdsForQuotaStatement(Long finalAccountId, Long providedDomainId, boolean isRecursive) {
+        if (finalAccountId != null) {
+            // Access to the provided account has already been validated
+            logger.debug("Not limiting the Quota statement for a specific Domain, as we are already limiting by Account.");
+            return new Pair<>(null, null);
+        }
+
+        // User accounts will have already been limited to themselves
+        Account caller = CallContext.current().getCallingAccount();
+        Long domainId = providedDomainId;
+
+        if (domainId != null) {
+            Domain domain = domainDao.findByIdIncludingRemoved(domainId);
+            _accountMgr.checkAccess(caller, domain);
+            logger.debug("Limiting the Quota statement for the provided Domain [{}].", domainId);
+        } else {
+            domainId = caller.getDomainId();
+            logger.debug("Limiting the Quota statement for the caller's Domain [{}], as no 'domainid' was provided.", domainId);
+        }
+
+        if (isRecursive) {
+            logger.debug("Allowing the Quota statement for the Domain's children, as the 'isrecursive' parameter was provided.");
+            return new Pair<>(domainId, domainDao.getDomainAndChildrenIds(domainId));
+        }
+
+        return new Pair<>(domainId, List.of(domainId));
+    }
+
+    protected InternalIdentity retrieveResource(String resourceUuid, Integer usageType) {
+        Class<?> clazz = QuotaTypes.getClazz(usageType);
+        if (clazz == null) {
+            throw new InvalidParameterValueException(String.format("Invalid usage type [%s] provided.", usageType));
+        }
+
+        logger.debug("Attempting to find a resource with ID [{}] and of type [{}].", resourceUuid, usageType);
+        Object object = entityMgr.findByUuidIncludingRemoved(clazz, resourceUuid);
+        if (object == null) {
+            return null;
+        }
+        return (InternalIdentity) object;
+    }
+
+    protected QuotaResourceStatementItemResponse createQuotaResourceStatementItemResponse(QuotaTariffUsageVO quotaTariffUsage, List<QuotaTariffVO> quotaTariffs,
+                                                                                          Date startDate, Date endDate, String accountUuid) {
+        logger.trace("Creating quota resource statement item associated to quota tariff usage [{}].", quotaTariffUsage);
+        QuotaResourceStatementItemResponse quotaResourceStatementItemResponse = new QuotaResourceStatementItemResponse();
+
+        QuotaTariffVO quotaTariff = quotaTariffs.stream().filter(quotaTariffVO -> quotaTariffUsage.getTariffId().equals(quotaTariffVO.getId())).findAny().orElse(null);
+
+        quotaResourceStatementItemResponse.setQuotaUsed(quotaTariffUsage.getQuotaUsed());
+        quotaResourceStatementItemResponse.setStartDate(startDate);
+        quotaResourceStatementItemResponse.setEndDate(endDate);
+        quotaResourceStatementItemResponse.setAccountId(accountUuid);
+        if (quotaTariff != null) {
+            logger.trace("Quota usage details item will be associated to the quota tariff [{}].", quotaTariff);
+            quotaResourceStatementItemResponse.setTariffId(quotaTariff.getUuid());
+            quotaResourceStatementItemResponse.setTariffName(quotaTariff.getName());
+        }
+
+        return quotaResourceStatementItemResponse;
+    }
+
+    protected QuotaResourceStatementResponse createQuotaResourceStatementResponse(String resourceUuid, Integer usageType,
+                                                                                  List<QuotaResourceStatementItemResponse> quotaUsageDetailsItems, BigDecimal totalQuotaUsed) {
+        logger.trace("Creating quota usage details list response associated to the resource of  UUID [{}], with an usage type of [{}], [{}] quota" +
+                " usage details items, and a total quota used of [{}].", resourceUuid, usageType, quotaUsageDetailsItems.size(), totalQuotaUsed);
+        QuotaResourceStatementResponse quotaResourceStatementResponse = new QuotaResourceStatementResponse();
+
+        QuotaTypes quotaType = QuotaTypes.getQuotaType(usageType);
+        quotaResourceStatementResponse.setUsageName(quotaType.getQuotaName());
+        quotaResourceStatementResponse.setUnit(quotaType.getQuotaUnit());
+
+        quotaResourceStatementResponse.setQuotaUsageDetails(quotaUsageDetailsItems);
+        quotaResourceStatementResponse.setTotalQuotaUsed(totalQuotaUsed);
+
+        return quotaResourceStatementResponse;
+    }
+
     /**
      * Checks whether script variables are compatible with the usage type. First, we remove all script variables that correspond to the script's usage type variables.
      * Then, returns true if none of the remaining script variables match any usage types variables, and false otherwise.
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementResponse.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementResponse.java
index 81cb1011182d..c30780582d36 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementResponse.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaStatementResponse.java
@@ -31,11 +31,11 @@ public class QuotaStatementResponse  extends BaseResponse {
     @Param(description = "ID of the Account.")
     private String accountId;
 
-    @SerializedName(ApiConstants.ACCOUNT)
+    @SerializedName(ApiConstants.ACCOUNT_NAME)
     @Param(description = "Name of the Account.")
     private String accountName;
 
-    @SerializedName(ApiConstants.DOMAIN)
+    @SerializedName(ApiConstants.DOMAIN_ID)
     @Param(description = "ID of the Domain.")
     private String domainId;
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java
index 478e43d2e203..cc257c233def 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaService.java
@@ -28,7 +28,7 @@
 
 public interface QuotaService extends PluggableService {
 
-    List<QuotaUsageJoinVO> getQuotaUsage(Long accountId, String accountName, Long domainId, Integer usageType, Date startDate, Date endDate);
+    List<QuotaUsageJoinVO> getQuotaUsage(Long accountId, String accountName, List<Long> domainIds, Integer usageType, Date startDate, Date endDate);
 
     List<QuotaBalanceVO> listQuotaBalancesForAccount(Long accountId, Date startDate, Date endDate);
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java
index e1ec2ebb2a60..a788f0c8b01e 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/quota/QuotaServiceImpl.java
@@ -38,6 +38,7 @@
 import org.apache.cloudstack.api.command.QuotaEnabledCmd;
 import org.apache.cloudstack.api.command.QuotaListEmailConfigurationCmd;
 import org.apache.cloudstack.api.command.QuotaPresetVariablesListCmd;
+import org.apache.cloudstack.api.command.QuotaResourceStatementCmd;
 import org.apache.cloudstack.api.command.QuotaStatementCmd;
 import org.apache.cloudstack.api.command.QuotaSummaryCmd;
 import org.apache.cloudstack.api.command.QuotaTariffCreateCmd;
@@ -131,6 +132,7 @@ public List<Class<?>> getCommands() {
         cmdList.add(QuotaListEmailConfigurationCmd.class);
         cmdList.add(QuotaPresetVariablesListCmd.class);
         cmdList.add(QuotaValidateActivationRuleCmd.class);
+        cmdList.add(QuotaResourceStatementCmd.class);
         return cmdList;
     }
 
@@ -203,15 +205,15 @@ protected void validateStartDateAndEndDateForListQuotaBalancesForAccount(Date st
     }
 
     @Override
-    public List<QuotaUsageJoinVO> getQuotaUsage(Long accountId, String accountName, Long domainId, Integer usageType, Date startDate, Date endDate) {
+    public List<QuotaUsageJoinVO> getQuotaUsage(Long accountId, String accountName, List<Long> domainIds, Integer usageType, Date startDate, Date endDate) {
         if (startDate.after(endDate)) {
             throw new InvalidParameterValueException("Incorrect Date Range. Start date: " + startDate + " is after end date:" + endDate);
         }
 
-        logger.debug("Getting quota records of type [{}] for account [{}] in domain [{}], between [{}] and [{}].",
-                usageType, accountId, domainId, startDate, endDate);
+        logger.debug("Getting quota records of type [{}] for account [{}] in domains [{}], between [{}] and [{}].",
+                usageType, accountId, domainIds, startDate, endDate);
 
-        return quotaUsageJoinDao.findQuotaUsage(accountId, domainId, usageType, null, null, null, startDate, endDate, null);
+        return quotaUsageJoinDao.findQuotaUsage(accountId, domainIds, usageType, null, null, null, startDate, endDate, null);
     }
 
     @Override
diff --git a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
index 0c7610461c15..37307db45629 100644
--- a/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
+++ b/plugins/database/quota/src/test/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImplTest.java
@@ -38,14 +38,15 @@
 import com.cloud.user.AccountManager;
 import com.cloud.user.UserVO;
 import com.cloud.utils.Pair;
+import com.cloud.utils.db.EntityManager;
 import com.cloud.utils.exception.CloudRuntimeException;
+import org.apache.cloudstack.api.InternalIdentity;
 import org.apache.cloudstack.api.ServerApiException;
 import org.apache.cloudstack.api.command.QuotaBalanceCmd;
 import org.apache.cloudstack.api.command.QuotaConfigureEmailCmd;
 import org.apache.cloudstack.api.command.QuotaCreditsListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateListCmd;
 import org.apache.cloudstack.api.command.QuotaEmailTemplateUpdateCmd;
-import org.apache.cloudstack.api.command.QuotaStatementCmd;
 import org.apache.cloudstack.api.command.QuotaSummaryCmd;
 import org.apache.cloudstack.api.command.QuotaValidateActivationRuleCmd;
 import org.apache.cloudstack.context.CallContext;
@@ -156,7 +157,7 @@ public class QuotaResponseBuilderImplTest extends TestCase {
     Date date = new Date();
 
     @Mock
-    Account accountMock;
+    AccountVO accountMock;
 
     @Mock
     DomainVO domainVoMock;
@@ -188,6 +189,9 @@ public class QuotaResponseBuilderImplTest extends TestCase {
     @Mock
     User callerUserMock;
 
+    @Mock
+    EntityManager entityManagerMock;
+
     @Before
     public void setup() {
         CallContext.register(callerUserMock, callerAccountMock);
@@ -1024,107 +1028,161 @@ public void setStatementItemResourcesTestDoNotShowResourcesDoNothing() {
     }
 
     @Test
-    public void getAccountIdForQuotaStatementTestLimitsToCallingAccountForNormalUser() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getAccountIdForQuotaStatementTestReturnsProvidedAccount() {
+        long providedAccountId = 200L;
 
-        Mockito.doReturn(accountMock).when(callContextMock).getCallingAccount();
-        Mockito.doReturn(Account.Type.NORMAL).when(accountMock).getType();
+        Mockito.when(accountDaoMock.findByIdIncludingRemoved(providedAccountId)).thenReturn(accountMock);
+        Mockito.doNothing().when(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
 
-        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
-            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+        long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(providedAccountId, null);
 
-            Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(cmd);
-
-            Assert.assertEquals(Long.valueOf(callerAccountMock.getAccountId()), result);
-        }
+        Assert.assertEquals(200L, result);
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
     }
 
     @Test
-    public void getAccountIdForQuotaStatementTestReturnsEntityOwnerIdWhenProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getAccountIdForQuotaStatementTestReturnsNullWhenCallerIsAdminWithoutProvidedAccount() {
+        Mockito.when(callerAccountMock.getType()).thenReturn(Account.Type.ADMIN);
 
-        Mockito.doReturn(42L).when(cmd).getEntityOwnerId();
+        Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(-1L, null);
+
+        assertNull(result);
+        Mockito.verify(accountManagerMock, Mockito.never()).getAccount(Mockito.anyLong());
+    }
+
+    @Test
+    public void getAccountIdForQuotaStatementTestReturnsNullWhenCallerIsDomainAdminWithoutProvidedAccount() {
+        Mockito.when(callerAccountMock.getType()).thenReturn(Account.Type.DOMAIN_ADMIN);
 
-        Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(cmd);
+        Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(-1L, null);
 
-        Assert.assertEquals(Long.valueOf(42L), result);
+        assertNull(result);
+        Mockito.verify(accountManagerMock, Mockito.never()).getAccount(Mockito.anyLong());
     }
 
     @Test
-    public void getAccountIdForQuotaStatementTestLimitsToCallingAccountWhenCallerIsAdminAndDomainIsNotProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getAccountIdForQuotaStatementTestReturnsFallbackAccountWhenNoAccountProvidedAndCallerIsNotAdmin() {
+        Mockito.when(callerAccountMock.getType()).thenReturn(Account.Type.NORMAL);
 
-        Mockito.doReturn(accountMock).when(callContextMock).getCallingAccount();
-        Mockito.doReturn(Account.Type.ADMIN).when(accountMock).getType();
-        Mockito.doReturn(-1L).when(cmd).getEntityOwnerId();
-        Mockito.doReturn(null).when(cmd).getDomainId();
+        Mockito.when(accountDaoMock.findByIdIncludingRemoved(300L)).thenReturn(accountMock);
+        Mockito.doNothing().when(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
 
-        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
-            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+        long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(-1L, 300L);
 
-            Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(cmd);
+        assertEquals(300L, result);
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
+    }
 
-            Assert.assertEquals(Long.valueOf(callerAccountMock.getAccountId()), result);
-        }
+    @Test
+    public void getAccountIdForQuotaStatementTestAccessDeniedForProvidedAccount() {
+        Mockito.when(accountDaoMock.findByIdIncludingRemoved(200L)).thenReturn(accountMock);
+        Mockito.doThrow(new PermissionDeniedException("Access denied"))
+                .when(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
+
+        Assert.assertThrows(PermissionDeniedException.class,
+                () -> quotaResponseBuilderSpy.getAccountIdForQuotaStatement(200L, null));
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, null, false, accountMock);
     }
 
     @Test
-    public void getAccountIdForQuotaStatementTestReturnsNullWhenCallerIsAdminAndDomainIsProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getDomainIdsForQuotaStatementTestReturnsNullPairWhenAccountIsProvided() {
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(100L, null, false);
 
-        Mockito.doReturn(accountMock).when(callContextMock).getCallingAccount();
-        Mockito.doReturn(Account.Type.ADMIN).when(accountMock).getType();
-        Mockito.doReturn(-1L).when(cmd).getEntityOwnerId();
-        Mockito.doReturn(10L).when(cmd).getDomainId();
+        assertNull(result.first());
+        assertNull(result.second());
+        Mockito.verify(domainDaoMock, Mockito.never()).findByIdIncludingRemoved(Mockito.anyLong());
+    }
 
-        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
-            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+    @Test
+    public void getDomainIdsForQuotaStatementTestReturnsProvidedDomainIdNonRecursively() {
+        Mockito.when(domainDaoMock.findByIdIncludingRemoved(5L)).thenReturn(domainVoMock);
+        Mockito.doNothing().when(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
 
-            Long result = quotaResponseBuilderSpy.getAccountIdForQuotaStatement(cmd);
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, 5L, false);
 
-            Assert.assertNull(result);
-        }
+        assertEquals(5L, (long) result.first());
+        assertEquals(List.of(5L), result.second());
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
     }
 
     @Test
-    public void getDomainIdForQuotaStatementTestReturnsAccountDomainIdWhenAccountIdIsProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
-        AccountVO account = Mockito.mock(AccountVO.class);
+    public void getDomainIdsForQuotaStatementTestReturnsCallerDomainNonRecursively() {
+        Mockito.when(callerAccountMock.getDomainId()).thenReturn(7L);
 
-        Mockito.doReturn(account).when(accountDaoMock).findByIdIncludingRemoved(55L);
-        Mockito.doReturn(77L).when(account).getDomainId();
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, null, false);
 
-        Long result = quotaResponseBuilderSpy.getDomainIdForQuotaStatement(cmd, 55L);
+        assertEquals(7L, (long) result.first());
+        assertEquals(List.of(7L), result.second());
+        Mockito.verify(domainDaoMock, Mockito.never()).findByIdIncludingRemoved(Mockito.anyLong());
+    }
+
+    @Test
+    public void getDomainIdsForQuotaStatementTestReturnsProvidedDomainRecursively() {
+        List<Long> domainAndChildren = List.of(5L, 10L, 15L);
+        Mockito.when(domainDaoMock.findByIdIncludingRemoved(5L)).thenReturn(domainVoMock);
+        Mockito.when(domainDaoMock.getDomainAndChildrenIds(5L)).thenReturn(domainAndChildren);
+        Mockito.doNothing().when(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
 
-        Assert.assertEquals(Long.valueOf(77L), result);
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, 5L, true);
+
+        assertEquals(5L, (long) result.first());
+        assertEquals(domainAndChildren, result.second());
+        Mockito.verify(domainDaoMock).getDomainAndChildrenIds(5L);
     }
 
     @Test
-    public void getDomainIdForQuotaStatementTestReturnsProvidedDomainIdWhenAccountIdIsNull() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
+    public void getDomainIdsForQuotaStatementReturnsCallerDomainRecursively() {
+        List<Long> domainAndChildren = List.of(1L, 2L, 3L);
+        Mockito.when(callerAccountMock.getDomainId()).thenReturn(1L);
 
-        Mockito.doReturn(99L).when(cmd).getDomainId();
+        Mockito.when(domainDaoMock.getDomainAndChildrenIds(1L)).thenReturn(domainAndChildren);
 
-        Long result = quotaResponseBuilderSpy.getDomainIdForQuotaStatement(cmd, null);
+        Pair<Long, List<Long>> result = quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, null, true);
 
-        Assert.assertEquals(Long.valueOf(99L), result);
+        assertEquals(1L, (long) result.first());
+        assertEquals(domainAndChildren, result.second());
+        Mockito.verify(domainDaoMock).getDomainAndChildrenIds(1L);
     }
 
     @Test
-    public void getDomainIdForQuotaStatementTestFallsBackToCallingAccountDomainIdWhenNeitherAccountNorDomainIsProvided() {
-        QuotaStatementCmd cmd = Mockito.mock(QuotaStatementCmd.class);
-        Account account = Mockito.mock(Account.class);
+    public void getDomainIdsForQuotaStatementTestThrowsAccessDeniedForProvidedDomain() {
+        Mockito.when(domainDaoMock.findByIdIncludingRemoved(5L)).thenReturn(domainVoMock);
+        Mockito.doThrow(new PermissionDeniedException("Access denied"))
+                .when(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
 
-        Mockito.doReturn(null).when(cmd).getDomainId();
-        Mockito.doReturn(123L).when(account).getDomainId();
-        Mockito.doReturn(account).when(callContextMock).getCallingAccount();
+        Assert.assertThrows(PermissionDeniedException.class,
+                () -> quotaResponseBuilderSpy.getDomainIdsForQuotaStatement(null, 5L, false));
+        Mockito.verify(accountManagerMock).checkAccess(callerAccountMock, domainVoMock);
+    }
 
-        try (MockedStatic<CallContext> callContextMocked = Mockito.mockStatic(CallContext.class)) {
-            callContextMocked.when(CallContext::current).thenReturn(callContextMock);
+    @Test(expected = InvalidParameterValueException.class)
+    public void retrieveResourceTestThrowsExceptionForInvalidUsageType() {
+        Integer invalidUsageType = 999;
+        quotaResponseBuilderSpy.retrieveResource("validUuid", invalidUsageType);
+    }
+
+    @Test
+    public void retrieveResourceTestReturnsNullForNonexistentResource() {
+        String invalidUuid = "nonexistentUuid";
+        Integer validUsageType = QuotaTypes.ALLOCATED_VM;
 
-            Long result = quotaResponseBuilderSpy.getDomainIdForQuotaStatement(cmd, null);
+        Mockito.doReturn(null).when(entityManagerMock).findByUuidIncludingRemoved(Mockito.any(), Mockito.eq(invalidUuid));
+        InternalIdentity result = quotaResponseBuilderSpy.retrieveResource(invalidUuid, validUsageType);
 
-            Assert.assertEquals(123L, result.longValue());
-        }
+        Assert.assertNull(result);
+    }
+
+    @Test
+    public void retrieveResourceTestReturnsCorrectResource() {
+        String validUuid = "validUuid";
+        Integer validUsageType = QuotaTypes.ALLOCATED_VM;
+        InternalIdentity mockResource = Mockito.mock(InternalIdentity.class);
+
+        Mockito.doReturn(mockResource).when(entityManagerMock).findByUuidIncludingRemoved(Mockito.any(), Mockito.eq(validUuid));
+
+        InternalIdentity result = quotaResponseBuilderSpy.retrieveResource(validUuid, validUsageType);
+
+        Assert.assertNotNull(result);
+        Assert.assertEquals(mockResource, result);
     }
 }
diff --git a/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java b/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java
index 89c48b1cc660..c0ee6c5fc3fe 100644
--- a/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java
+++ b/plugins/database/quota/src/test/java/org/apache/cloudstack/quota/QuotaServiceImplTest.java
@@ -117,12 +117,12 @@ public void setup() throws IllegalAccessException, NoSuchFieldException, Configu
     public void testGetQuotaUsage() {
         final long accountId = 2L;
         final String accountName = "admin123";
-        final long domainId = 1L;
+        final List<Long> domainIds = List.of(1L);
         final Date startDate = new DateTime().minusDays(2).toDate();
         final Date endDate = new Date();
 
-        quotaServiceImplSpy.getQuotaUsage(accountId, accountName, domainId, QuotaTypes.IP_ADDRESS, startDate, endDate);
-        Mockito.verify(quotaUsageJoinDaoMock, Mockito.times(1)).findQuotaUsage(Mockito.eq(accountId), Mockito.eq(domainId), Mockito.eq(QuotaTypes.IP_ADDRESS), Mockito.any(),
+        quotaServiceImplSpy.getQuotaUsage(accountId, accountName, domainIds, QuotaTypes.IP_ADDRESS, startDate, endDate);
+        Mockito.verify(quotaUsageJoinDaoMock, Mockito.times(1)).findQuotaUsage(Mockito.eq(accountId), Mockito.eq(domainIds), Mockito.eq(QuotaTypes.IP_ADDRESS), Mockito.any(),
                 Mockito.any(), Mockito.any(), Mockito.any(Date.class), Mockito.any(Date.class), Mockito.any());
     }
 

From 2081ac4666e2763755f4c34806a783d0f13f03fd Mon Sep 17 00:00:00 2001
From: Bryan Lima <42067040+BryanMLima@users.noreply.github.com>
Date: Mon, 15 Jun 2026 13:25:55 +0200
Subject: [PATCH 63/64] Guest OS rules (#10098)

Co-authored-by: Fabricio Duarte <fabricio.duarte.jr@gmail.com>
---
 api/src/main/java/com/cloud/host/Host.java    |  2 +
 .../apache/cloudstack/api/ApiConstants.java   |  1 +
 .../api/command/admin/host/UpdateHostCmd.java | 11 ++-
 .../cloudstack/api/response/HostResponse.java | 12 +++
 .../src/main/java/com/cloud/host/HostVO.java  |  5 +-
 .../main/java/com/cloud/host/dao/HostDao.java |  7 ++
 .../java/com/cloud/host/dao/HostDaoImpl.java  | 37 ++++++-
 .../META-INF/db/views/cloud.host_view.sql     |  1 +
 .../cloudstack/quota/QuotaManagerImpl.java    |  2 +-
 .../response/QuotaResponseBuilderImpl.java    |  2 +-
 .../manager/allocator/impl/BaseAllocator.java | 25 +++++
 .../allocator/impl/FirstFitAllocator.java     |  7 +-
 .../allocator/impl/RandomAllocator.java       |  3 +-
 .../main/java/com/cloud/api/ApiDBUtils.java   | 12 +++
 .../cloud/api/query/dao/HostJoinDaoImpl.java  |  1 +
 .../api/query/dao/StoragePoolJoinDaoImpl.java |  5 +-
 .../com/cloud/api/query/vo/HostJoinVO.java    |  7 ++
 .../ConfigurationManagerImpl.java             |  8 +-
 .../deploy/DeploymentPlanningManagerImpl.java | 52 ++++++++--
 .../cloud/resource/ResourceManagerImpl.java   | 98 +++++++++++++------
 .../cloud/storage/VolumeApiServiceImpl.java   |  5 +-
 .../heuristics/HeuristicRuleHelper.java       |  2 +-
 .../allocator/impl/FirstFitAllocatorTest.java | 18 ++--
 .../allocator/impl/RandomAllocatorTest.java   |  8 ++
 ui/public/locales/en.json                     |  2 +
 ui/public/locales/pt_BR.json                  |  2 +
 ui/src/views/infra/HostUpdate.vue             | 32 +++++-
 ...RuleHelper.java => GenericRuleHelper.java} | 53 ++++++----
 .../utils/jsinterpreter/JsInterpreter.java    |  6 +-
 .../jsinterpreter/JsInterpreterTest.java      |  4 +-
 30 files changed, 339 insertions(+), 91 deletions(-)
 rename utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/{TagAsRuleHelper.java => GenericRuleHelper.java} (61%)

diff --git a/api/src/main/java/com/cloud/host/Host.java b/api/src/main/java/com/cloud/host/Host.java
index b52348201516..8b14cfd3a390 100644
--- a/api/src/main/java/com/cloud/host/Host.java
+++ b/api/src/main/java/com/cloud/host/Host.java
@@ -63,6 +63,8 @@ public static String[] toStrings(Host.Type... types) {
     String HOST_OVFTOOL_VERSION = "host.ovftool.version";
     String HOST_VIRTV2V_VERSION = "host.virtv2v.version";
     String HOST_SSH_PORT = "host.ssh.port";
+    String GUEST_OS_CATEGORY_ID = "guest.os.category.id";
+    String GUEST_OS_RULE = "guest.os.rule";
 
     int DEFAULT_SSH_PORT = 22;
 
diff --git a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
index c5671d22d07b..17416f08690a 100644
--- a/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
+++ b/api/src/main/java/org/apache/cloudstack/api/ApiConstants.java
@@ -449,6 +449,7 @@ public class ApiConstants {
     public static final String MAX_VGPU_PER_PHYSICAL_GPU = "maxvgpuperphysicalgpu";
     public static final String GUEST_OS_LIST = "guestoslist";
     public static final String GUEST_OS_COUNT = "guestoscount";
+    public static final String GUEST_OS_RULE = "guestosrule";
     public static final String OS_MAPPING_CHECK_ENABLED = "osmappingcheckenabled";
     public static final String OUTOFBANDMANAGEMENT_POWERSTATE = "outofbandmanagementpowerstate";
     public static final String OUTOFBANDMANAGEMENT_ENABLED = "outofbandmanagementenabled";
diff --git a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/UpdateHostCmd.java b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/UpdateHostCmd.java
index c085abd42c76..69bca7c79e21 100644
--- a/api/src/main/java/org/apache/cloudstack/api/command/admin/host/UpdateHostCmd.java
+++ b/api/src/main/java/org/apache/cloudstack/api/command/admin/host/UpdateHostCmd.java
@@ -49,9 +49,14 @@ public class UpdateHostCmd extends BaseCmd {
     @Parameter(name = ApiConstants.OS_CATEGORY_ID,
                type = CommandType.UUID,
                entityType = GuestOSCategoryResponse.class,
-               description = "The ID of OS category to update the host with")
+               description = "the ID of OS category used to prioritize VMs with matching OS category during the allocation process. " +
+                       "It cannot be used alongside the 'guestosrule' parameter.")
     private Long osCategoryId;
 
+    @Parameter(name = ApiConstants.GUEST_OS_RULE, type = CommandType.STRING, description = "the guest OS rule written in JavaScript to match with the OS of the VM." +
+            "It cannot be used alongside the 'oscategoryid' parameter.")
+    private String guestOsRule;
+
     @Parameter(name = ApiConstants.ALLOCATION_STATE,
                type = CommandType.STRING,
                description = "Change resource state of host, valid values are [Enable, Disable]. Operation may failed if host in states not allowing Enable/Disable")
@@ -96,6 +101,10 @@ public Long getOsCategoryId() {
         return osCategoryId;
     }
 
+    public String getGuestOsRule() {
+        return guestOsRule;
+    }
+
     public String getAllocationState() {
         return allocationState;
     }
diff --git a/api/src/main/java/org/apache/cloudstack/api/response/HostResponse.java b/api/src/main/java/org/apache/cloudstack/api/response/HostResponse.java
index 5d085d1bee05..f8e1af8d5b76 100644
--- a/api/src/main/java/org/apache/cloudstack/api/response/HostResponse.java
+++ b/api/src/main/java/org/apache/cloudstack/api/response/HostResponse.java
@@ -63,6 +63,10 @@ public class HostResponse extends BaseResponseWithAnnotations {
     @Param(description = "The OS category name of the host")
     private String osCategoryName;
 
+    @SerializedName(ApiConstants.GUEST_OS_RULE)
+    @Param(description = "the guest OS rule")
+    private String guestOsRule;
+
     @SerializedName(ApiConstants.IP_ADDRESS)
     @Param(description = "The IP address of the host")
     private String ipAddress;
@@ -999,4 +1003,12 @@ public void setExtensionName(String extensionName) {
     public String getExtensionName() {
         return extensionName;
     }
+
+    public String getGuestOsRule() {
+        return guestOsRule;
+    }
+
+    public void setGuestOsRule(String guestOsRule) {
+        this.guestOsRule = guestOsRule;
+    }
 }
diff --git a/engine/schema/src/main/java/com/cloud/host/HostVO.java b/engine/schema/src/main/java/com/cloud/host/HostVO.java
index d51b4eca0577..468caf1e2271 100644
--- a/engine/schema/src/main/java/com/cloud/host/HostVO.java
+++ b/engine/schema/src/main/java/com/cloud/host/HostVO.java
@@ -45,7 +45,7 @@
 import com.cloud.cpu.CPU;
 import org.apache.cloudstack.util.CPUArchConverter;
 import org.apache.cloudstack.util.HypervisorTypeConverter;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.lang.BooleanUtils;
@@ -856,7 +856,8 @@ public boolean checkHostServiceOfferingTags(ServiceOffering serviceOffering) {
         }
 
         if (BooleanUtils.isTrue(this.getIsTagARule())) {
-            return TagAsRuleHelper.interpretTagAsRule(this.getHostTags().get(0), serviceOffering.getHostTag(), HostTagsDao.hostTagRuleExecutionTimeout.value());
+            return GenericRuleHelper.interpretTagAsRule(this.getHostTags().get(0), serviceOffering.getHostTag(), HostTagsDao.hostTagRuleExecutionTimeout.value(),
+                    HostTagsDao.hostTagRuleExecutionTimeout.key());
         }
 
         if (StringUtils.isEmpty(serviceOffering.getHostTag())) {
diff --git a/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java b/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
index 5f5b2affee08..5c0d04fb2be8 100644
--- a/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
+++ b/engine/schema/src/main/java/com/cloud/host/dao/HostDao.java
@@ -32,12 +32,17 @@
 import com.cloud.utils.db.GenericDao;
 import com.cloud.utils.fsm.StateDao;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
+import org.apache.cloudstack.framework.config.ConfigKey;
 
 /**
  * Data Access Object for server
  *
  */
 public interface HostDao extends GenericDao<HostVO, Long>, StateDao<Status, Status.Event, Host> {
+
+    ConfigKey<Long> guestOsRuleExecutionTimeout = new ConfigKey<>("Advanced", Long.class, "guest.os.rule.execution.timeout", "3000", "The maximum runtime, in milliseconds, " +
+            "to execute a guest OS rule; if it is reached, a timeout will happen.", true);
+
     long countBy(long clusterId, ResourceState... states);
 
     Integer countAllByType(final Host.Type type);
@@ -220,6 +225,8 @@ int countHostsByMsResourceStateTypeAndHypervisorType(long msId, List<ResourceSta
 
     List<HostVO> findHostsWithTagRuleThatMatchComputeOfferingTags(String computeOfferingTags);
 
+    List<HostVO> findHostsWithGuestOsRulesThatDidNotMatchOsOfGuestVm(String templateGuestOSName);
+
     List<Long> findClustersThatMatchHostTagRule(String computeOfferingTags);
 
     List<Long> listSsvmHostsWithPendingMigrateJobsOrderedByJobCount();
diff --git a/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java b/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
index 99c9a979c3bf..cd4423dfa269 100644
--- a/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
+++ b/engine/schema/src/main/java/com/cloud/host/dao/HostDaoImpl.java
@@ -37,7 +37,9 @@
 
 import com.cloud.vm.VirtualMachine;
 import org.apache.cloudstack.engine.subsystem.api.storage.VolumeInfo;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.framework.config.ConfigKey;
+import org.apache.cloudstack.framework.config.Configurable;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
 import org.apache.commons.collections.CollectionUtils;
 
 import com.cloud.agent.api.VgpuTypesInfo;
@@ -84,7 +86,7 @@
 
 @DB
 @TableGenerator(name = "host_req_sq", table = "op_host", pkColumnName = "id", valueColumnName = "sequence", allocationSize = 1)
-public class HostDaoImpl extends GenericDaoBase<HostVO, Long> implements HostDao { //FIXME: , ExternalIdDao {
+public class HostDaoImpl extends GenericDaoBase<HostVO, Long> implements HostDao, Configurable {
 
     private static final String LIST_HOST_IDS_BY_HOST_TAGS = "SELECT filtered.host_id, COUNT(filtered.tag) AS tag_count "
                                                              + "FROM (SELECT host_id, tag, is_tag_a_rule FROM host_tags GROUP BY host_id,tag,is_tag_a_rule) AS filtered "
@@ -1520,11 +1522,13 @@ private List<Long> findHostIdsByHostTags(String hostTags){
         }
     }
 
+    @Override
     public List<HostVO> findHostsWithTagRuleThatMatchComputeOfferingTags(String computeOfferingTags) {
         List<HostTagVO> hostTagVOList = _hostTagsDao.findHostRuleTags();
         List<HostVO> result = new ArrayList<>();
         for (HostTagVO rule: hostTagVOList) {
-            if (TagAsRuleHelper.interpretTagAsRule(rule.getTag(), computeOfferingTags, HostTagsDao.hostTagRuleExecutionTimeout.value())) {
+            if (GenericRuleHelper.interpretTagAsRule(rule.getTag(), computeOfferingTags, HostTagsDao.hostTagRuleExecutionTimeout.value(),
+                    HostTagsDao.hostTagRuleExecutionTimeout.key())) {
                 result.add(findById(rule.getHostId()));
             }
         }
@@ -1532,6 +1536,23 @@ public List<HostVO> findHostsWithTagRuleThatMatchComputeOfferingTags(String comp
         return result;
     }
 
+    @Override
+    public List<HostVO> findHostsWithGuestOsRulesThatDidNotMatchOsOfGuestVm(String templateGuestOSName) {
+        List<DetailVO> hostIdsWithGuestOsRule = _detailsDao.findByName(Host.GUEST_OS_RULE);
+        List<HostVO> hostsWithIncompatibleRules = new ArrayList<>();
+        for (DetailVO guestOsRule : hostIdsWithGuestOsRule) {
+            if (!GenericRuleHelper.interpretGuestOsRule(guestOsRule.getValue(), templateGuestOSName, HostDao.guestOsRuleExecutionTimeout.value(),
+                    HostDao.guestOsRuleExecutionTimeout.key())) {
+                logger.trace("The guest OS rule [{}] of the host with ID [{}] is incompatible with the OS of the VM.",
+                        guestOsRule.getHostId(), guestOsRule.getValue());
+                hostsWithIncompatibleRules.add(findById(guestOsRule.getHostId()));
+            }
+        }
+        logger.trace("The hosts with the following IDs [{}] are incompatible with the VM considering their guest OS rule.",
+                hostsWithIncompatibleRules);
+        return hostsWithIncompatibleRules;
+    }
+
     public List<Long> findClustersThatMatchHostTagRule(String computeOfferingTags) {
         Set<Long> result = new HashSet<>();
         List<HostVO> hosts = findHostsWithTagRuleThatMatchComputeOfferingTags(computeOfferingTags);
@@ -1984,4 +2005,14 @@ public List<String> listDistinctStorageAccessGroups(String name, String keyword)
 
         return customSearch(sc, null);
     }
+
+    @Override
+    public ConfigKey<?>[] getConfigKeys() {
+        return new ConfigKey<?>[] {guestOsRuleExecutionTimeout};
+    }
+
+    @Override
+    public String getConfigComponentName() {
+        return HostDaoImpl.class.getSimpleName();
+    }
 }
diff --git a/engine/schema/src/main/resources/META-INF/db/views/cloud.host_view.sql b/engine/schema/src/main/resources/META-INF/db/views/cloud.host_view.sql
index d9f4e2671595..255ce866c427 100644
--- a/engine/schema/src/main/resources/META-INF/db/views/cloud.host_view.sql
+++ b/engine/schema/src/main/resources/META-INF/db/views/cloud.host_view.sql
@@ -64,6 +64,7 @@ SELECT
     guest_os_category.id guest_os_category_id,
     guest_os_category.uuid guest_os_category_uuid,
     guest_os_category.name guest_os_category_name,
+    (SELECT `value` FROM `cloud`.`host_details` `hd` WHERE `hd`.`host_id` = `cloud`.`host`.`id` AND `hd`.`name` = 'guest.os.rule') AS `guest_os_rule`,
     mem_caps.used_capacity memory_used_capacity,
     mem_caps.reserved_capacity memory_reserved_capacity,
     cpu_caps.used_capacity cpu_used_capacity,
diff --git a/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java b/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
index 20bc0b015bb1..5afef8bc95b6 100644
--- a/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
+++ b/framework/quota/src/main/java/org/apache/cloudstack/quota/QuotaManagerImpl.java
@@ -320,7 +320,7 @@ protected List<QuotaUsageVO> createQuotaUsagesAccordingToQuotaTariffs(AccountVO
 
         Map<UsageVO, Pair<QuotaUsageVO, List<QuotaTariffUsageVO>>> mapUsageAndQuotaUsage = new LinkedHashMap<>();
 
-        try (JsInterpreter jsInterpreter = new JsInterpreter(QuotaConfig.QuotaActivationRuleTimeout.value())) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(QuotaConfig.QuotaActivationRuleTimeout.value(), QuotaConfig.QuotaActivationRuleTimeout.key())) {
             for (UsageVO usageRecord : usageRecords) {
                 int usageType = usageRecord.getUsageType();
 
diff --git a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
index 77099bcdc889..b71057e64234 100644
--- a/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
+++ b/plugins/database/quota/src/main/java/org/apache/cloudstack/api/response/QuotaResponseBuilderImpl.java
@@ -1115,7 +1115,7 @@ public QuotaValidateActivationRuleResponse validateActivationRule(QuotaValidateA
         addAllPresetVariables(PresetVariables.class, quotaType, usageTypeVariablesAndDescriptions, null);
         List<String> usageTypeVariables = usageTypeVariablesAndDescriptions.stream().map(Pair::first).collect(Collectors.toList());
 
-        try (JsInterpreter jsInterpreter = new JsInterpreter(QuotaConfig.QuotaActivationRuleTimeout.value())) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(QuotaConfig.QuotaActivationRuleTimeout.value(), QuotaConfig.QuotaActivationRuleTimeout.key())) {
             Map<String, String> newVariables = injectUsageTypeVariables(jsInterpreter, usageTypeVariables);
             String scriptToExecute = jsInterpreterHelper.replaceScriptVariables(activationRule, newVariables);
             jsInterpreter.executeScript(String.format("new Function(\"%s\")", scriptToExecute.replaceAll("\n", "")));
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java
index 58fcc62cdc31..ad5726e0a010 100644
--- a/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/BaseAllocator.java
@@ -17,11 +17,13 @@
 package com.cloud.agent.manager.allocator.impl;
 
 import com.cloud.agent.manager.allocator.HostAllocator;
+import com.cloud.api.ApiDBUtils;
 import com.cloud.capacity.CapacityManager;
 import com.cloud.host.Host;
 import com.cloud.host.HostVO;
 import com.cloud.host.dao.HostDao;
 import com.cloud.offering.ServiceOffering;
+import com.cloud.storage.VMTemplateVO;
 import com.cloud.utils.Pair;
 import com.cloud.utils.component.AdapterBase;
 import org.apache.commons.collections.CollectionUtils;
@@ -69,6 +71,29 @@ protected void addHostsBasedOnTagRules(String hostTagOnOffering, List<HostVO> cl
         clusterHosts.addAll(hostsWithTagRules);
     }
 
+    protected void filterHostsBasedOnGuestOsRules(VMTemplateVO vmTemplate, List<? extends Host> clusterHosts) {
+        if (clusterHosts.isEmpty()) {
+            logger.info("Will not filter hosts based on guest OS as there is no available hosts left to verify.");
+            return;
+        }
+
+        String templateGuestOSName = ApiDBUtils.getTemplateGuestOSName(vmTemplate);
+        List<HostVO> incompatibleHosts = hostDao.findHostsWithGuestOsRulesThatDidNotMatchOsOfGuestVm(templateGuestOSName);
+
+        if (incompatibleHosts.isEmpty()) {
+            logger.info("No incompatible hosts found with guest OS rules matching the VM guest OS [{}].", templateGuestOSName);
+            return;
+        }
+
+        logger.info("Found incompatible hosts {} with guest OS rules that did not match the VM guest OS [{}]. They will be removed from the suitable hosts list.",
+                incompatibleHosts, templateGuestOSName);
+        clusterHosts.removeAll(incompatibleHosts);
+
+        if (clusterHosts.isEmpty()) {
+            logger.info("After filtering by guest OS rules, no compatible hosts were found for VM with OS [{}].", templateGuestOSName);
+        }
+    }
+
     /**
      * Adds hosts with enough CPU capability and enough CPU capacity to the suitable hosts list.
      */
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java
index 8b4ca318bf78..4bc34d8a5c60 100644
--- a/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocator.java
@@ -123,7 +123,7 @@ public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan pla
         String hostTagOnTemplate = template.getTemplateTag();
         String paramAsStringToLog = String.format("zone [%s], pod [%s], cluster [%s]", dcId, podId, clusterId);
 
-        List<HostVO> suitableHosts = retrieveHosts(vmProfile, type, (List<HostVO>) hosts, clusterId, podId, dcId, hostTagOnOffering, hostTagOnTemplate);
+        List<HostVO> suitableHosts = retrieveHosts(vmProfile, type, (List<HostVO>) hosts, template, clusterId, podId, dcId, hostTagOnOffering, hostTagOnTemplate);
 
         if (suitableHosts.isEmpty()) {
             logger.info("No suitable host found for VM [{}] in {}.", vmProfile, paramAsStringToLog);
@@ -137,8 +137,8 @@ public List<Host> allocateTo(VirtualMachineProfile vmProfile, DeploymentPlan pla
         return allocateTo(vmProfile, plan, offering, template, avoid, suitableHosts, returnUpTo, considerReservedCapacity, account);
     }
 
-    protected List<HostVO> retrieveHosts(VirtualMachineProfile vmProfile, Type type, List<HostVO> hostsToFilter, Long clusterId, Long podId, long dcId, String hostTagOnOffering,
-                                         String hostTagOnTemplate) {
+    protected List<HostVO> retrieveHosts(VirtualMachineProfile vmProfile, Type type, List<HostVO> hostsToFilter, VMTemplateVO template,
+                                         Long clusterId, Long podId, long dcId, String hostTagOnOffering, String hostTagOnTemplate) {
         String haVmTag = (String) vmProfile.getParameter(VirtualMachineProfile.Param.HaTag);
         List<HostVO> clusterHosts;
 
@@ -159,6 +159,7 @@ protected List<HostVO> retrieveHosts(VirtualMachineProfile vmProfile, Type type,
         filterHostsWithUefiEnabled(type, vmProfile, clusterId, podId, dcId, clusterHosts);
 
         addHostsBasedOnTagRules(hostTagOnOffering, clusterHosts);
+        filterHostsBasedOnGuestOsRules(template, clusterHosts);
 
         return clusterHosts;
 
diff --git a/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java b/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
index 96b4255b876d..92fdaf7faf0e 100644
--- a/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
+++ b/server/src/main/java/com/cloud/agent/manager/allocator/impl/RandomAllocator.java
@@ -42,7 +42,7 @@ public class RandomAllocator extends BaseAllocator {
     private ResourceManager _resourceMgr;
 
     protected List<Host> findSuitableHosts(VirtualMachineProfile vmProfile, DeploymentPlan plan, Type type, ExcludeList avoid, List<? extends Host> hosts, int returnUpTo,
-                                         boolean considerReservedCapacity) {
+                                           boolean considerReservedCapacity) {
         if (type == Host.Type.Storage) {
             return null;
         }
@@ -115,6 +115,7 @@ protected List<HostVO> retrieveHosts(Type type, List<HostVO> hosts, VMTemplateVO
         }
 
         addHostsBasedOnTagRules(offeringHostTag, availableHosts);
+        filterHostsBasedOnGuestOsRules(template, availableHosts);
 
         return availableHosts;
     }
diff --git a/server/src/main/java/com/cloud/api/ApiDBUtils.java b/server/src/main/java/com/cloud/api/ApiDBUtils.java
index 1d00e9ec16ba..d8b3c155ae8c 100644
--- a/server/src/main/java/com/cloud/api/ApiDBUtils.java
+++ b/server/src/main/java/com/cloud/api/ApiDBUtils.java
@@ -31,6 +31,7 @@
 import javax.inject.Inject;
 
 import com.cloud.cpu.CPU;
+import com.cloud.storage.GuestOSVO;
 import org.apache.cloudstack.acl.Role;
 import org.apache.cloudstack.acl.RoleService;
 import org.apache.cloudstack.affinity.AffinityGroup;
@@ -2345,4 +2346,15 @@ public static SharedFSJoinVO newSharedFSView(SharedFS sharedFS) {
     public static List<CPU.CPUArch> listZoneClustersArchs(long zoneId) {
         return s_clusterDao.getClustersArchsByZone(zoneId);
     }
+
+    public static String getTemplateGuestOSName(VMTemplateVO template) {
+        long guestOSId = template.getGuestOSId();
+        GuestOSVO guestOS = s_guestOSDao.findById(guestOSId);
+
+        if (guestOS == null) {
+            return null;
+        }
+
+        return guestOS.getDisplayName();
+    }
 }
diff --git a/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java
index 0200dec2cd3c..b7464ba987ce 100644
--- a/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/HostJoinDaoImpl.java
@@ -225,6 +225,7 @@ private void setNewHostResponseBase(HostJoinVO host, EnumSet<HostDetails> detail
                 hostResponse.setHaHost(containsHostHATag(hostTags));
                 hostResponse.setExplicitHostTags(host.getExplicitTag());
                 hostResponse.setImplicitHostTags(host.getImplicitTag());
+                hostResponse.setGuestOsRule(host.getGuestOsRule());
 
                 hostResponse.setHypervisorVersion(host.getHypervisorVersion());
                 if (host.getArch() != null) {
diff --git a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java
index a9d5b726b860..6c8e683d7b3a 100644
--- a/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java
+++ b/server/src/main/java/com/cloud/api/query/dao/StoragePoolJoinDaoImpl.java
@@ -35,7 +35,7 @@
 import org.apache.cloudstack.storage.datastore.db.StoragePoolDetailVO;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolDetailsDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.collections.MapUtils;
 import org.springframework.stereotype.Component;
@@ -401,7 +401,8 @@ public List<StoragePoolVO> findStoragePoolByScopeAndRuleTags(Long datacenterId,
         String injectableTag = injectableTagsBuilder.toString();
 
         for (StoragePoolJoinVO storagePoolJoinVO : storagePools) {
-            if (TagAsRuleHelper.interpretTagAsRule(storagePoolJoinVO.getTag(), injectableTag, VolumeApiServiceImpl.storageTagRuleExecutionTimeout.value())) {
+            if (GenericRuleHelper.interpretTagAsRule(storagePoolJoinVO.getTag(), injectableTag, VolumeApiServiceImpl.storageTagRuleExecutionTimeout.value(),
+                    VolumeApiServiceImpl.storageTagRuleExecutionTimeout.key())) {
                 StoragePoolVO storagePoolVO = storagePoolDao.findById(storagePoolJoinVO.getId());
                 if (storagePoolVO != null) {
                     filteredPools.add(storagePoolVO);
diff --git a/server/src/main/java/com/cloud/api/query/vo/HostJoinVO.java b/server/src/main/java/com/cloud/api/query/vo/HostJoinVO.java
index 83cfcc8375f3..24ab5291a42a 100644
--- a/server/src/main/java/com/cloud/api/query/vo/HostJoinVO.java
+++ b/server/src/main/java/com/cloud/api/query/vo/HostJoinVO.java
@@ -173,6 +173,9 @@ public class HostJoinVO extends BaseViewVO implements InternalIdentity, Identity
     @Column(name = "guest_os_category_name")
     private String osCategoryName;
 
+    @Column(name = "guest_os_rule")
+    private String guestOsRule;
+
     @Column(name = "tag")
     private String tag;
 
@@ -373,6 +376,10 @@ public String getOsCategoryName() {
         return osCategoryName;
     }
 
+    public String getGuestOsRule() {
+        return guestOsRule;
+    }
+
     public Long getJobId() {
         return jobId;
     }
diff --git a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
index ad31cfbaef9a..6889d33c5c80 100644
--- a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
@@ -143,7 +143,7 @@
 import org.apache.cloudstack.storage.datastore.db.StoragePoolDetailsDao;
 import org.apache.cloudstack.storage.datastore.db.StoragePoolVO;
 import org.apache.cloudstack.userdata.UserDataManager;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 import org.apache.cloudstack.vm.UnmanagedVMsManager;
 import org.apache.cloudstack.vm.lease.VMLeaseManager;
@@ -5115,7 +5115,8 @@ protected void updateOfferingTagsIfIsNotNull(String tags, DiskOfferingVO diskOff
 
                     if ((CollectionUtils.isNotEmpty(tagsAsString) && tagsAsString.containsAll(listOfTags)) ||
                         (tagsOnPool.size() == 1 && tagsOnPool.get(0).isTagARule() &&
-                        TagAsRuleHelper.interpretTagAsRule(tagsOnPool.get(0).getTag(), tags, VolumeApiServiceImpl.storageTagRuleExecutionTimeout.value()))) {
+                        GenericRuleHelper.interpretTagAsRule(tagsOnPool.get(0).getTag(), tags, VolumeApiServiceImpl.storageTagRuleExecutionTimeout.value(),
+                                VolumeApiServiceImpl.storageTagRuleExecutionTimeout.key()))) {
                         continue;
                     }
 
@@ -5158,7 +5159,8 @@ protected void updateServiceOfferingHostTagsIfNotNull(String hostTags, ServiceOf
 
                     if ((CollectionUtils.isNotEmpty(tagsAsString) && tagsAsString.containsAll(listOfHostTags)) ||
                         (tagsOnHost.size() == 1 && tagsOnHost.get(0).getIsTagARule() &&
-                        TagAsRuleHelper.interpretTagAsRule(tagsOnHost.get(0).getTag(), hostTags, HostTagsDao.hostTagRuleExecutionTimeout.value()))) {
+                        GenericRuleHelper.interpretTagAsRule(tagsOnHost.get(0).getTag(), hostTags, HostTagsDao.hostTagRuleExecutionTimeout.value(),
+                                HostTagsDao.hostTagRuleExecutionTimeout.key()))) {
                         continue;
                     }
 
diff --git a/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java b/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
index 7fb4a97e149b..2eaa44af1b0c 100644
--- a/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
+++ b/server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java
@@ -35,6 +35,7 @@
 import javax.inject.Inject;
 import javax.naming.ConfigurationException;
 
+import com.cloud.api.ApiDBUtils;
 import com.cloud.gpu.dao.VgpuProfileDao;
 import com.cloud.resource.ResourceState;
 import org.apache.cloudstack.affinity.AffinityGroupDomainMapVO;
@@ -805,18 +806,49 @@ protected boolean checkVmProfileAndHost(final VirtualMachineProfile vmProfile, f
                 return false;
             }
         }
+
+        DetailVO guestOsRule = _hostDetailsDao.findDetail(host.getId(), HostVO.GUEST_OS_RULE);
+        if (guestOsRule != null) {
+            return isHostGuestOsCompatible(vmProfile, host, guestOsRule);
+        }
+
+        DetailVO guestOsCategoryId = _hostDetailsDao.findDetail(host.getId(), HostVO.GUEST_OS_CATEGORY_ID);
+        if (guestOsCategoryId != null) {
+            return isHostGuestOsCategoryCompatible(vmProfile, host, guestOsCategoryId);
+        }
+
+        return true;
+    }
+
+    private boolean isHostGuestOsCategoryCompatible(VirtualMachineProfile vmProfile, HostVO host, DetailVO guestOsCategoryId) {
         long guestOSId = vmProfile.getTemplate().getGuestOSId();
         GuestOSVO guestOS = _guestOSDao.findById(guestOSId);
-        if (guestOS != null) {
-            long guestOSCategoryId = guestOS.getCategoryId();
-            DetailVO hostDetail = _hostDetailsDao.findDetail(host.getId(), "guest.os.category.id");
-            if (hostDetail != null) {
-                String guestOSCategoryIdString = hostDetail.getValue();
-                if (String.valueOf(guestOSCategoryId) != guestOSCategoryIdString) {
-                    logger.debug("The last host has different guest.os.category.id than guest os category of VM, skipping");
-                    return false;
-                }
-            }
+
+        if (guestOS == null) {
+            return true;
+        }
+
+        long guestOSCategoryId = guestOS.getCategoryId();
+        String guestOSCategoryIdString = guestOsCategoryId.getValue();
+        if (!String.valueOf(guestOSCategoryId).equals(guestOSCategoryIdString)) {
+            logger.debug("The last host has different `{}` than guest os category of VM, skipping", Host.GUEST_OS_CATEGORY_ID);
+            return false;
+        }
+
+        return true;
+    }
+
+    private boolean isHostGuestOsCompatible(VirtualMachineProfile vmProfile, HostVO host, DetailVO guestOsRule) {
+        VMTemplateVO template = (VMTemplateVO) vmProfile.getTemplate();
+        String templateGuestOSName = ApiDBUtils.getTemplateGuestOSName(template);
+
+        List<HostVO> incompatibleHosts = _hostDao.findHostsWithGuestOsRulesThatDidNotMatchOsOfGuestVm(templateGuestOSName);
+
+        boolean isHostCompatible = incompatibleHosts.stream().noneMatch(incompatibleHost -> incompatibleHost.getId() == host.getId());
+
+        if (!isHostCompatible) {
+            logger.debug("The template [{}] is incompatible with the host [{}] due to the guest OS rule [{}].", template, host, guestOsRule);
+            return false;
         }
         return true;
     }
diff --git a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
index 0f6933664f93..8db55790fd8a 100755
--- a/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
+++ b/server/src/main/java/com/cloud/resource/ResourceManagerImpl.java
@@ -84,8 +84,8 @@
 import org.apache.cloudstack.utils.identity.ManagementServerNode;
 import org.apache.commons.collections.CollectionUtils;
 import org.apache.commons.collections.MapUtils;
-import org.apache.commons.lang.ObjectUtils;
 import org.apache.commons.lang3.ArrayUtils;
+import org.apache.commons.lang3.ObjectUtils;
 import org.jetbrains.annotations.NotNull;
 import org.springframework.stereotype.Component;
 
@@ -2046,31 +2046,74 @@ private void updateHostName(HostVO host, String name) {
         _hostDao.update(host.getId(), host);
     }
 
-    private void updateHostGuestOSCategory(Long hostId, Long guestOSCategoryId) {
-        // Verify that the guest OS Category exists
-        if (!(guestOSCategoryId > 0) || _guestOSCategoryDao.findById(guestOSCategoryId) == null) {
+    /**
+     * Updates the guest OS details related to the host ({@code guest.os.rule} and {@code guest.os.category.id}); only one can be set at a time for a given host.
+     */
+    private void updateGuestOsRelatedFields(Long hostId, Long cmdOsCategoryId, String cmdGuestOsRule) {
+        if (ObjectUtils.allNotNull(cmdOsCategoryId, cmdGuestOsRule)) {
+            throw new InvalidParameterValueException("Informing both guest OS category and guest OS rule is invalid; please, inform only one of them.");
+        }
+
+        if (cmdOsCategoryId != null) {
+            updateHostCategoryOs(hostId, cmdOsCategoryId);
+        } else if (cmdGuestOsRule != null) {
+            updateHostGuestOsRule(hostId, cmdGuestOsRule);
+        }
+    }
+
+    /**
+     * Associates/removes a guest OS rule to a host and removes any guest OS category associated with it.
+     */
+    private void updateHostGuestOsRule(Long hostId, String cmdGuestOsRule) {
+        final DetailVO hostGuestOsRule = _hostDetailsDao.findDetail(hostId, Host.GUEST_OS_RULE);
+
+        if (StringUtils.isNotBlank(cmdGuestOsRule)) {
+            createOrUpdateHostDetails(hostGuestOsRule, cmdGuestOsRule, Host.GUEST_OS_RULE, hostId);
+        } else if (hostGuestOsRule != null) {
+            _hostDetailsDao.remove(hostGuestOsRule.getId());
+        }
+        removeHostDetails(hostId, Host.GUEST_OS_CATEGORY_ID);
+    }
+
+    /**
+     * Removes a host details if it exists.
+     */
+    private void removeHostDetails(Long hostId, String detailString) {
+        DetailVO detailVO = _hostDetailsDao.findDetail(hostId, detailString);
+
+        if (detailVO != null) {
+            _hostDetailsDao.remove(detailVO.getId());
+        }
+    }
+
+    private void createOrUpdateHostDetails(DetailVO hostDetail, String detailValue, String detailName, Long hostId) {
+        if (hostDetail != null) {
+            hostDetail.setValue(detailValue);
+            _hostDetailsDao.update(hostDetail.getId(), hostDetail);
+        } else {
+            Map<String, String> detail = new HashMap<>();
+            detail.put(detailName, detailValue);
+            _hostDetailsDao.persist(hostId, detail);
+        }
+    }
+
+    /**
+     * Associates/removes a valid guest OS category to a host and removes any guest OS rules associated with it.
+     */
+    private void updateHostCategoryOs(Long hostId, Long cmdOsCategoryId) {
+        if (cmdOsCategoryId <= 0 || _guestOSCategoryDao.findById(cmdOsCategoryId) == null) {
             throw new InvalidParameterValueException("Please specify a valid guest OS category.");
         }
 
-        final GuestOSCategoryVO guestOSCategory = _guestOSCategoryDao.findById(guestOSCategoryId);
-        final DetailVO guestOSDetail = _hostDetailsDao.findDetail(hostId, "guest.os.category.id");
+        GuestOSCategoryVO guestOSCategory = _guestOSCategoryDao.findById(cmdOsCategoryId);
+        DetailVO guestOSDetail = _hostDetailsDao.findDetail(hostId, Host.GUEST_OS_CATEGORY_ID);
 
         if (guestOSCategory != null && !GuestOSCategoryVO.CATEGORY_NONE.equalsIgnoreCase(guestOSCategory.getName())) {
-            // Create/Update an entry for guest.os.category.id
-            if (guestOSDetail != null) {
-                guestOSDetail.setValue(String.valueOf(guestOSCategory.getId()));
-                _hostDetailsDao.update(guestOSDetail.getId(), guestOSDetail);
-            } else {
-                final Map<String, String> detail = new HashMap<>();
-                detail.put("guest.os.category.id", String.valueOf(guestOSCategory.getId()));
-                _hostDetailsDao.persist(hostId, detail);
-            }
-        } else {
-            // Delete any existing entry for guest.os.category.id
-            if (guestOSDetail != null) {
-                _hostDetailsDao.remove(guestOSDetail.getId());
-            }
+            createOrUpdateHostDetails(guestOSDetail, String.valueOf(guestOSCategory.getId()), Host.GUEST_OS_CATEGORY_ID, hostId);
+        } else if (guestOSDetail != null) {
+            _hostDetailsDao.remove(guestOSDetail.getId());
         }
+        removeHostDetails(hostId, Host.GUEST_OS_RULE);
     }
 
     private void removeStorageAccessGroupsOnPodsInZone(long zoneId, List<String> newStoragePoolTags, List<String> tagsToDeleteOnZone) {
@@ -2821,16 +2864,17 @@ private void updateHostTags(HostVO host, Long hostId, List<String> hostTags, Boo
 
     @Override
     public Host updateHost(final UpdateHostCmd cmd) throws NoTransitionException {
-        return updateHost(cmd.getId(), cmd.getName(), cmd.getOsCategoryId(),
+        return updateHost(cmd.getId(), cmd.getName(), cmd.getOsCategoryId(), cmd.getGuestOsRule(),
                 cmd.getAllocationState(), cmd.getUrl(), cmd.getHostTags(), cmd.getIsTagARule(), cmd.getAnnotation(), false,
                 cmd.getExternalDetails(), cmd.isCleanupExternalDetails());
     }
 
-    private Host updateHost(Long hostId, String name, Long guestOSCategoryId, String allocationState,
+    private Host updateHost(Long hostId, String name, Long guestOSCategoryId, String guestOsRule, String allocationState,
             String url, List<String> hostTags, Boolean isTagARule, String annotation,
             boolean isUpdateFromHostHealthCheck, Map<String, String> externalDetails,
             boolean cleanupExternalDetails) throws NoTransitionException {
         jsInterpreterHelper.ensureInterpreterEnabledIfParameterProvided(ApiConstants.IS_TAG_A_RULE, Boolean.TRUE.equals(isTagARule));
+        jsInterpreterHelper.ensureInterpreterEnabledIfParameterProvided(ApiConstants.GUEST_OS_RULE, guestOsRule != null);
 
         // Verify that the host exists
         final HostVO host = _hostDao.findById(hostId);
@@ -2847,9 +2891,7 @@ private Host updateHost(Long hostId, String name, Long guestOSCategoryId, String
             updateHostName(host, name);
         }
 
-        if (guestOSCategoryId != null) {
-            updateHostGuestOSCategory(hostId, guestOSCategoryId);
-        }
+        updateGuestOsRelatedFields(hostId, guestOSCategoryId, guestOsRule);
 
         if (hostTags != null) {
             updateHostTags(host, hostId, hostTags, isTagARule);
@@ -2919,7 +2961,7 @@ private void sendAlertAndAnnotationForAutoEnableDisableKVMHostFeature(HostVO hos
 
     @Override
     public Host autoUpdateHostAllocationState(Long hostId, ResourceState.Event resourceEvent) throws NoTransitionException {
-        return updateHost(hostId, null, null, resourceEvent.toString(), null, null, null, null, true, null, false);
+        return updateHost(hostId, null, null, null, resourceEvent.toString(), null, null, null, null, true, null, false);
     }
 
     @Override
@@ -3639,7 +3681,7 @@ private void checkIPConflicts(final HostPodVO pod, final DataCenterVO dc, final
         // If the server's private IP is the same as is public IP, this host has
         // a host-only private network. Don't check for conflicts with the
         // private IP address table.
-        if (!ObjectUtils.equals(serverPrivateIP, serverPublicIP)) {
+        if (!StringUtils.equals(serverPrivateIP, serverPublicIP)) {
             if (!_privateIPAddressDao.mark(dc.getId(), pod.getId(), serverPrivateIP)) {
                 // If the server's private IP address is already in the
                 // database, return false
@@ -4284,7 +4326,7 @@ public Long getGuestOSCategoryId(final long hostId) {
             return null;
         } else {
             _hostDao.loadDetails(host);
-            final DetailVO detail = _hostDetailsDao.findDetail(hostId, "guest.os.category.id");
+            final DetailVO detail = _hostDetailsDao.findDetail(hostId, Host.GUEST_OS_CATEGORY_ID);
             if (detail == null) {
                 return null;
             } else {
diff --git a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
index afe16c2b574e..ee27e171a731 100644
--- a/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
+++ b/server/src/main/java/com/cloud/storage/VolumeApiServiceImpl.java
@@ -112,7 +112,7 @@
 import org.apache.cloudstack.storage.to.VolumeObjectTO;
 import org.apache.cloudstack.utils.identity.ManagementServerNode;
 import org.apache.cloudstack.utils.imagestore.ImageStoreUtil;
-import org.apache.cloudstack.utils.jsinterpreter.TagAsRuleHelper;
+import org.apache.cloudstack.utils.jsinterpreter.GenericRuleHelper;
 import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;
 import org.apache.cloudstack.utils.volume.VirtualMachineDiskInfo;
 import org.apache.commons.collections.CollectionUtils;
@@ -3904,7 +3904,8 @@ public boolean doesStoragePoolSupportDiskOfferingTags(StoragePool destPool, Stri
 
         boolean result;
         if (storagePoolTags.second()) {
-            result =  TagAsRuleHelper.interpretTagAsRule(storageTagsList.get(0), diskOfferingTags, storageTagRuleExecutionTimeout.value());
+            result =  GenericRuleHelper.interpretTagAsRule(storageTagsList.get(0), diskOfferingTags, storageTagRuleExecutionTimeout.value(),
+                    storageTagRuleExecutionTimeout.key());
         } else {
             result = CollectionUtils.isSubCollection(Arrays.asList(newDiskOfferingTagsAsStringArray), storageTagsList);
         }
diff --git a/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java b/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
index beecf90d2b83..97c13f714474 100644
--- a/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
+++ b/server/src/main/java/org/apache/cloudstack/storage/heuristics/HeuristicRuleHelper.java
@@ -257,7 +257,7 @@ protected Domain setDomainPresetVariable(long domainId) {
      * @return the {@link DataStore} returned by the script.
      */
     public DataStore interpretHeuristicRule(String rule, HeuristicType heuristicType, Object obj, long zoneId) {
-        try (JsInterpreter jsInterpreter = new JsInterpreter(HEURISTICS_SCRIPT_TIMEOUT)) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(HEURISTICS_SCRIPT_TIMEOUT, StorageManager.HEURISTICS_SCRIPT_TIMEOUT.key())) {
             buildPresetVariables(jsInterpreter, heuristicType, zoneId, obj);
             Object scriptReturn = jsInterpreter.executeScript(rule);
 
diff --git a/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java b/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java
index 00cac5bbd52c..f39ed06a656b 100644
--- a/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java
+++ b/server/src/test/java/com/cloud/agent/manager/allocator/impl/FirstFitAllocatorTest.java
@@ -193,7 +193,7 @@ public void allocateToTestSuitableHostsEmptyShouldReturnNull() {
     Mockito.doReturn(account).when(virtualMachineProfile).getOwner();
     Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
     Mockito.doReturn(templateTag).when(vmTemplateVO).getTemplateTag();
-    Mockito.doReturn(emptyList).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    Mockito.doReturn(emptyList).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.any(VMTemplateVO.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
     List<Host> suitableHosts = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
 
     Assert.assertNull(suitableHosts);
@@ -208,7 +208,7 @@ public void allocateToTestSuitableHostsNotEmptyShouldCallAllocateToMethod() {
     Mockito.doReturn(account).when(virtualMachineProfile).getOwner();
     Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
     Mockito.doReturn(templateTag).when(vmTemplateVO).getTemplateTag();
-    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.any(VMTemplateVO.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
     Mockito.doReturn(hosts).when(firstFitAllocatorSpy).allocateTo(Mockito.any(VirtualMachineProfile.class), Mockito.any(DeploymentPlan.class), Mockito.any(ServiceOffering.class), Mockito.any(VMTemplateVO.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean(), Mockito.any(Account.class));
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsToAvoidSet(Mockito.any(Host.Type.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     List<Host> suitableHosts = firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
@@ -226,7 +226,7 @@ public void allocateToTestProvidedHostsNotNullShouldCallAddHostsToAvoidSetMethod
     Mockito.doReturn(account).when(virtualMachineProfile).getOwner();
     Mockito.doReturn(hostTag).when(serviceOffering).getHostTag();
     Mockito.doReturn(templateTag).when(vmTemplateVO).getTemplateTag();
-    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
+    Mockito.doReturn(hosts).when(firstFitAllocatorSpy).retrieveHosts(Mockito.any(VirtualMachineProfile.class), Mockito.any(Host.Type.class), Mockito.nullable(List.class), Mockito.any(VMTemplateVO.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
     Mockito.doReturn(hosts).when(firstFitAllocatorSpy).allocateTo(Mockito.any(VirtualMachineProfile.class), Mockito.any(DeploymentPlan.class), Mockito.any(ServiceOffering.class), Mockito.any(VMTemplateVO.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyList(), Mockito.anyInt(), Mockito.anyBoolean(), Mockito.any(Account.class));
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsToAvoidSet(Mockito.any(Host.Type.class), Mockito.any(DeploymentPlanner.ExcludeList.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     firstFitAllocatorSpy.allocateTo(virtualMachineProfile, deploymentPlan, type, excludeList, null, HostAllocator.RETURN_UPTO_ALL, considerReservedCapacity);
@@ -245,7 +245,8 @@ public void retrieveHostsTestHostsToFilterIsNullAndHaTagNotNullShouldReturnOnlyH
     Mockito.doReturn(hostsWithHaTag).when(hostDaoMock).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
     Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.anyString(), Mockito.anyList());
-    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, clusterId, podId, dcId, hostTag, templateTag);
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
+    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, vmTemplateVO, clusterId, podId, dcId, hostTag, templateTag);
 
     Assert.assertEquals(2, resultHosts.size());
     Assert.assertEquals(host1, resultHosts.get(0));
@@ -262,7 +263,8 @@ public void retrieveHostsTestHostsToFilterIsNotNullAndHaTagNotNullShouldReturnOn
     Mockito.doReturn(hostsWithHaTag).when(hostDaoMock).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
     Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.anyString(), Mockito.anyList());
-    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, hostsToFilter, clusterId, podId, dcId, hostTag, templateTag);
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
+    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, hostsToFilter, vmTemplateVO, clusterId, podId, dcId, hostTag, templateTag);
 
     Assert.assertEquals(2, resultHosts.size());
     Assert.assertEquals(host1, resultHosts.get(0));
@@ -278,7 +280,8 @@ public void retrieveHostsTestHostsToFilterIsNullAndNoHaTagAndNoHostTagShouldRetu
     Mockito.doReturn(upAndEnabledHostsWithNoHa).when(resourceManagerMock).listAllUpAndEnabledNonHAHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
     Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.nullable(String.class), Mockito.anyList());
-    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, clusterId, podId, dcId, null, null);
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
+    List<HostVO> resultHosts = firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, vmTemplateVO, clusterId, podId, dcId, null, null);
 
     Assert.assertEquals(2, resultHosts.size());
     Assert.assertEquals(host1, resultHosts.get(0));
@@ -293,7 +296,8 @@ public void retrieveHostsTestHostsToFilterIsNullAndNoHaTagWithHostTagShouldCallR
     Mockito.doNothing().when(firstFitAllocatorSpy).retainHostsMatchingServiceOfferingAndTemplateTags(Mockito.anyList(), Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
     Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsWithUefiEnabled(Mockito.any(Host.Type.class), Mockito.any(VirtualMachineProfile.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyList());
     Mockito.doNothing().when(firstFitAllocatorSpy).addHostsBasedOnTagRules(Mockito.anyString(), Mockito.anyList());
-    firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, clusterId, podId, dcId, hostTag, templateTag);
+    Mockito.doNothing().when(firstFitAllocatorSpy).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
+    firstFitAllocatorSpy.retrieveHosts(virtualMachineProfile, type, emptyList, vmTemplateVO, clusterId, podId, dcId, hostTag, templateTag);
 
     Mockito.verify(firstFitAllocatorSpy, Mockito.times(1)).retainHostsMatchingServiceOfferingAndTemplateTags(Mockito.anyList(), Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString(), Mockito.anyString());
   }
diff --git a/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java b/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
index ab9b322eb843..938ed7a152ea 100644
--- a/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
+++ b/server/src/test/java/com/cloud/agent/manager/allocator/impl/RandomAllocatorTest.java
@@ -222,6 +222,7 @@ public void retrieveHostsTestProvidedHostsNullAndNoHostTagAndNoTagRuleShouldOnly
         Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, null, clusterId, podId, zoneId);
 
         Assert.assertEquals(1, availableHosts.size());
@@ -237,6 +238,7 @@ public void retrieveHostsTestProvidedHostsNullAndOnlyHostTagsRulesShouldReturnHo
         Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, null, clusterId, podId, zoneId);
 
         Assert.assertEquals(2, availableHosts.size());
@@ -252,6 +254,7 @@ public void retrieveHostsTestProvidedHostsNullProvidedHostTagsNotNullAndNoHostWi
         Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
         Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, hostTag, clusterId, podId, zoneId);
 
         Assert.assertEquals(1, availableHosts.size());
@@ -267,6 +270,7 @@ public void retrieveHostsTestProvidedHostsNullProvidedHostTagsNotNullAndHostWith
         Mockito.doReturn(upAndEnabledHosts).when(resourceManagerMock).listAllUpAndEnabledHosts(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
         Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, null, vmTemplateVO, hostTag, clusterId, podId, zoneId);
 
         Assert.assertEquals(2, availableHosts.size());
@@ -281,6 +285,7 @@ public void retrieveHostsTestProvidedHostsNotNullAndNoHostTagAndNoTagRuleShouldO
 
         Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, null, clusterId, podId, zoneId);
 
         Assert.assertEquals(1, availableHosts.size());
@@ -295,6 +300,7 @@ public void retrieveHostsTestProvidedHostsNotNullAndOnlyHostTagsRulesShouldRetur
 
         Mockito.doReturn(hostsWithNoRuleTagsAndHostTags).when(hostDao).listAllHostsThatHaveNoRuleTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong());
         Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, null, clusterId, podId, zoneId);
 
         Assert.assertEquals(2, availableHosts.size());
@@ -309,6 +315,7 @@ public void retrieveHostsTestProvidedHostsNotNullProvidedHostTagsNotNullAndNoHos
 
         Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
         Mockito.doReturn(emptyList).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, hostTag, clusterId, podId, zoneId);
 
         Assert.assertEquals(1, availableHosts.size());
@@ -323,6 +330,7 @@ public void retrieveHostsTestProvidedHostsNullNotProvidedHostTagsNotNullAndHostW
 
         Mockito.doReturn(hostsWithMatchingTags).when(hostDao).listByHostTag(Mockito.any(Host.Type.class), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyLong(), Mockito.anyString());
         Mockito.doReturn(hostsMatchingRuleTags).when(hostDao).findHostsWithTagRuleThatMatchComputeOfferingTags(Mockito.nullable(String.class));
+        Mockito.doNothing().when(randomAllocator).filterHostsBasedOnGuestOsRules(Mockito.any(VMTemplateVO.class), Mockito.anyList());
         List<HostVO> availableHosts = randomAllocator.retrieveHosts(type, providedHosts, vmTemplateVO, hostTag, clusterId, podId, zoneId);
 
         Assert.assertEquals(2, availableHosts.size());
diff --git a/ui/public/locales/en.json b/ui/public/locales/en.json
index 3a16d613f37a..7d848e821130 100644
--- a/ui/public/locales/en.json
+++ b/ui/public/locales/en.json
@@ -1219,6 +1219,8 @@
 "label.guestnetwork": "Guest Network",
 "label.guestnetworkid": "Network ID",
 "label.guestnetworkname": "Network name",
+"label.guestosasrule": "Guest OS as rule",
+"label.guestosrule": "Guest OS rule",
 "label.gueststartip": "Guest start IP",
 "label.guest.vlan": "Guest VLAN",
 "label.guestvlanrange": "VLAN range(s)",
diff --git a/ui/public/locales/pt_BR.json b/ui/public/locales/pt_BR.json
index 91f0fd895e58..ad27813f1ce0 100644
--- a/ui/public/locales/pt_BR.json
+++ b/ui/public/locales/pt_BR.json
@@ -1090,6 +1090,8 @@
 "label.guestnetwork": "Rede guest",
 "label.guestnetworkid": "ID de rede",
 "label.guestnetworkname": "Nome da rede",
+"label.guestosasrule": "SO guest como regra JS",
+"label.guestosrule": "Regra SO guest",
 "label.gueststartip": "IP de in\u00edcio do guest",
 "label.guestvlanrange": "Intervalo(s) de VLAN",
 "label.guestvmcidr": "CIDR",
diff --git a/ui/src/views/infra/HostUpdate.vue b/ui/src/views/infra/HostUpdate.vue
index 1fee7a6846c0..5ef762443e9d 100644
--- a/ui/src/views/infra/HostUpdate.vue
+++ b/ui/src/views/infra/HostUpdate.vue
@@ -64,7 +64,22 @@
           </a-select-option>
         </a-select>
       </a-form-item>
-      <a-form-item name="oscategoryid" ref="oscategoryid">
+      <a-form-item name="guestosasrule" ref="guestosasrule">
+        <template #label>
+          <tooltip-label :title="$t('label.guestosasrule')"/>
+        </template>
+        <a-switch v-model:checked="form.guestosasrule"/>
+      </a-form-item>
+      <a-form-item v-if="form.guestosasrule" name="guestosrule" ref="guestosrule">
+        <template #label>
+          <tooltip-label :title="$t('label.guestosrule')" :tooltip="apiParams.guestosrule.description"/>
+        </template>
+        <a-textarea
+          v-model:value="form.guestosrule"
+          :placeholder="apiParams.guestosrule.name">
+        </a-textarea>
+      </a-form-item>
+      <a-form-item v-if="!form.guestosasrule" name="oscategoryid" ref="oscategoryid">
         <template #label>
           <tooltip-label :title="$t('label.oscategoryid')" :tooltip="apiParams.oscategoryid.description"/>
         </template>
@@ -149,6 +164,7 @@ export default {
   methods: {
     initForm () {
       this.formRef = ref()
+      const guestOsRule = this.resource?.guestosrule
       this.form = reactive({
         name: this.resource.name,
         hosttags: this.resource.explicithosttags,
@@ -157,7 +173,9 @@ export default {
           ? this.resource.storageaccessgroups.split(',')
           : [],
         oscategoryid: this.resource.oscategoryid,
-        externaldetails: this.resourceExternalDetails
+        externaldetails: this.resourceExternalDetails,
+        guestosasrule: guestOsRule !== undefined,
+        guestosrule: guestOsRule
       })
       this.rules = reactive({})
     },
@@ -194,7 +212,11 @@ export default {
         params.id = this.resource.id
         params.name = values.name
         params.hosttags = values.hosttags
-        params.oscategoryid = values.oscategoryid
+        if (values.guestosasrule === true) {
+          params.guestosrule = values.guestosrule
+        } else {
+          params.oscategoryid = values.oscategoryid || this.osCategories.opts.filter(os => os.name === 'None')[0]?.id
+        }
         if (values.istagarule !== undefined) {
           params.istagarule = values.istagarule
         }
@@ -205,9 +227,11 @@ export default {
         } else {
           params.cleanupexternaldetails = true
         }
+
+        Object.keys(params).forEach((key) => (params[key] == null) && delete params[key])
         this.loading = true
 
-        postAPI('updateHost', params).then(json => {
+        postAPI('updateHost', params).then(() => {
           this.$message.success({
             content: `${this.$t('label.action.update.host')} - ${values.name}`,
             duration: 2
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/TagAsRuleHelper.java b/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/GenericRuleHelper.java
similarity index 61%
rename from utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/TagAsRuleHelper.java
rename to utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/GenericRuleHelper.java
index b30135673524..506bbc1ea5c3 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/TagAsRuleHelper.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/GenericRuleHelper.java
@@ -16,41 +16,60 @@
 //under the License.
 package org.apache.cloudstack.utils.jsinterpreter;
 
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
 import com.cloud.utils.StringUtils;
+import com.cloud.utils.exception.CloudRuntimeException;
 import org.apache.logging.log4j.LogManager;
 import org.apache.logging.log4j.Logger;
 
-import com.cloud.utils.exception.CloudRuntimeException;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
 
-public class TagAsRuleHelper {
+public class GenericRuleHelper {
 
-    protected static Logger LOGGER = LogManager.getLogger(TagAsRuleHelper.class);
+    protected static Logger LOGGER = LogManager.getLogger(GenericRuleHelper.class);
 
-    public static boolean interpretTagAsRule(String rule, String tags, long timeout) {
+    public static boolean interpretTagAsRule(String rule, String tags, long timeout, String configName) {
         List<String> tagsPresetVariable = new ArrayList<>();
         if (!StringUtils.isEmpty(tags)) {
             tagsPresetVariable.addAll(Arrays.asList(tags.split(",")));
         }
 
-        try (JsInterpreter jsInterpreter = new JsInterpreter(timeout)) {
-            jsInterpreter.injectVariable("tags", tagsPresetVariable);
-            Object scriptReturn = jsInterpreter.executeScript(rule);
+        Boolean scriptReturn = interpretRule("tags", tagsPresetVariable, timeout, rule, configName);
+
+        if (scriptReturn != null) {
+            return scriptReturn;
+        }
+
+        LOGGER.debug("Result of tag rule [{}] was not a boolean, returning false.", rule);
+        return false;
+    }
+
+    public static boolean interpretGuestOsRule(String rule, String vmGuestOs, long timeout, String configName) {
+        Boolean scriptReturn = interpretRule("vmGuestOs", vmGuestOs, timeout, rule, configName);
+
+        if (scriptReturn != null) {
+            return scriptReturn;
+        }
+
+        LOGGER.debug("Result of guest OS rule [{}] was not a boolean, returning false.", rule);
+        return false;
+    }
+
+    private static Boolean interpretRule(String variableName, Object variableValue, long timeout, String script, String configName) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(timeout, configName)) {
+            jsInterpreter.injectVariable(variableName, variableValue);
+            Object scriptReturn = jsInterpreter.executeScript(script);
             if (scriptReturn instanceof Boolean) {
-                return (Boolean)scriptReturn;
+                return (Boolean) scriptReturn;
             }
         } catch (IOException ex) {
-            String message = String.format("Error while executing script [%s].", rule);
+            String message = String.format("Error while executing script [%s].", script);
             LOGGER.error(message, ex);
             throw new CloudRuntimeException(message, ex);
         }
-
-        LOGGER.debug("Result of tag rule [{}] was not a boolean, returning false.", rule);
-        return false;
+        return null;
     }
 
 }
diff --git a/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreter.java b/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreter.java
index 6e6ef2bbe599..85799e0f5614 100644
--- a/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreter.java
+++ b/utils/src/main/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreter.java
@@ -86,10 +86,10 @@ static final class DenyAllClassFilter implements ClassFilter {
      */
     protected JsInterpreter() { }
 
-    public JsInterpreter(long timeout) {
+    public JsInterpreter(long timeout, String configName) {
         this.timeout = timeout;
-        this.timeoutDefaultMessage = String.format(
-                "Timeout (in milliseconds) defined in the global setting [quota.activationrule.timeout]: [%s].", this.timeout);
+        this.timeoutDefaultMessage = String.format("Timeout (in milliseconds) defined in the global setting [%s]: [%s].",
+                configName, this.timeout);
 
         if (System.getProperty("nashorn.args") == null) {
             System.setProperty("nashorn.args", "--no-java --no-syntax-extensions");
diff --git a/utils/src/test/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreterTest.java b/utils/src/test/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreterTest.java
index e6ef43f2fc10..e4764b2af413 100644
--- a/utils/src/test/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreterTest.java
+++ b/utils/src/test/java/org/apache/cloudstack/utils/jsinterpreter/JsInterpreterTest.java
@@ -161,7 +161,7 @@ public void setScriptEngineDisablingJavaLanguageTest() {
 
     @Test
     public void executeScriptTestValidScriptShouldPassWithMixedVariables() {
-        try (JsInterpreter jsInterpreter = new JsInterpreter(1000)) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(1000, "timeout.configuration")) {
             jsInterpreter.injectVariable("x", 10);
             jsInterpreter.injectVariable("y", "hello");
             jsInterpreter.injectVariable("z", true);
@@ -174,7 +174,7 @@ public void executeScriptTestValidScriptShouldPassWithMixedVariables() {
     }
 
     private void runMaliciousScriptFileTest(String script, String filename) {
-        try (JsInterpreter jsInterpreter = new JsInterpreter(1000)) {
+        try (JsInterpreter jsInterpreter = new JsInterpreter(1000, "timeout.configuration")) {
             jsInterpreter.executeScript(script);
         } catch (CloudRuntimeException ex) {
             Assert.assertTrue(ex.getMessage().contains("Unable to execute script"));

From ac6c1c800d9f5c7504296522267f5f12c8d27ade Mon Sep 17 00:00:00 2001
From: dahn <daan@onecht.net>
Date: Tue, 16 Jun 2026 09:48:51 +0200
Subject: [PATCH 64/64] Add bhouse-nexthop to contributors list (#13420)

---
 .asf.yaml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.asf.yaml b/.asf.yaml
index 3b2f7691d136..df0dc3ab56c7 100644
--- a/.asf.yaml
+++ b/.asf.yaml
@@ -57,6 +57,7 @@ github:
     - Damans227
     - jmsperu
     - GaOrtiga
+    - bhouse-nexthop
 
   protected_branches: ~